diff --git a/.agents/engineering-guidelines.md b/.agents/engineering-guidelines.md
new file mode 100644
index 0000000000..0fd84f8dd3
--- /dev/null
+++ b/.agents/engineering-guidelines.md
@@ -0,0 +1,231 @@
+# How to build things here
+
+These rules apply in every chat and every repo. They are not a style preference. They exist because
+an agent can write thousands of lines in an hour, some of them invented, and a human then has to
+review all of it. Every rule below either cuts invention or makes the code easier to review.
+
+**Precedence.** A repo's own instruction file (`AGENTS.md` / `CLAUDE.md`) wins on everything
+mechanical: formatting, item order, comment rules, lint thresholds, schema rules, PR conventions.
+This file governs judgment: what to build, how much of it, and how to prove it works. If the two
+conflict, follow the repo file and say so in your report.
+
+The definitions and tests apply to every language in the repo. The examples in §2 and §3 are written
+for the Rust backend; a frontend list belongs next to them when the frontend owners write one.
+
+## 0. Pick the tier first
+
+Every task is one of three sizes. Say which one you are in before touching code; it decides how
+much of the rest applies.
+
+| Tier | What it is | Spec gate | Tests | Review |
+|---|---|---|---|---|
+| **Patch** | One cause, one place. No new public API, table, flag or dependency. Typically under ~50 changed lines. | None. One sentence: cause → fix. | One failing test that reproduces the cause, then green. | Self-review against the three tests in §2, then the gates. |
+| **Change** | New behaviour inside the existing architecture: a new branch of logic, a new field, a new error path. | Numbered rules and open questions (§5.2), a few lines each. | One per rule. | Full loop (§5). |
+| **Feature** | A new component, endpoint, table, background job or config flag. | Design doc first, per the repo's PR rules; the numbered rules derive from it. | One per rule, plus a failure-path test for every `[strong]` / `[weak]` function. | Full loop, security depth where §5 says so. |
+
+If a Patch outgrows its definition while you work, stop, say so, and re-enter as a Change. Do not
+keep going.
+
+## 1. Never invent facts
+
+- **A claim about existing code needs a `path:line` you opened in this session.** A function,
+  table, config flag, env var or endpoint you have not opened does not exist yet. Search for it
+  before you use it. This applies to specs, reviews and reports, not to every sentence in chat.
+- **A claim about an outside service** (Twilio, Slack, a cloud API) needs a link to the vendor's
+  docs. "Twilio probably returns X" is not allowed.
+- **"I don't know" is a correct answer.** Write it down as an open question. Do not fill the gap
+  with something that sounds right.
+- **If the spec does not decide something, stop and ask.** An invented decision is how a feature
+  turns into an endless fix loop. Anything new you discover while building becomes a new numbered
+  rule, and the human decides whether it is in scope.
+
+## 2. The three things we refuse
+
+Each one has a definition, a test you can apply mechanically, and examples. The cold reviewer (§5)
+applies the same three tests, so there is one vocabulary for writer and reviewer.
+
+### 2.1 Hacks
+
+**Definition.** Code that makes a symptom disappear while the underlying statement about the system
+stays false.
+
+**Test.** Delete the new code: is the thing it "fixed" still wrong, for the same reason? Then it was
+a hack. Second test: does the fix only work because of a value, name, order or timing that is not
+part of any contract?
+
+**Examples, all banned:**
+
+- A branch keyed on one input, test name, org id or environment so that one case passes.
+- Turning an error into success where the caller needed to know: `.ok()`, `.unwrap_or_default()`,
+  `let _ = …`, `if let Ok(x)` with no `else`, a handler that logs at debug and continues.
+- A sleep, retry or re-ordering that makes a race rarer instead of removing it.
+- Widening a type (`String`, `serde_json::Value`, `i64` for everything) so the compiler stops
+  complaining, instead of modelling the value.
+- `#[allow(clippy::…)]`, `#[ignore]`, a weakened assertion, or a raised lint threshold to get green.
+- A flag that defaults the new behaviour off so the bug stops reproducing.
+- A "temporary" anything with no issue number and no removal condition.
+
+**Not a hack:** a fallback the spec names and that is visible when it fires (a `warn!` with context,
+a metric, an error field in the response). A default is a decision; a silent default is a hack.
+
+**When the real cause is out of scope:** stop and report it. Do not patch the symptom to finish the
+task.
+
+### 2.2 Over-engineering
+
+**Definition.** Structure that exists for a future the spec does not contain.
+
+**Test.** Name the second concrete user that exists today, or that the spec names. If you cannot,
+inline it.
+
+**Examples, all banned until the second user exists:**
+
+- A trait with one impl; a generic with one instantiation; a type parameter "for testing".
+- A config option, env var or feature flag nobody asked for ("in case someone wants to tune it").
+- A newtype or wrapper that enforces no invariant.
+- Layers that only forward: `handler → service → manager → repository` with logic in one of them.
+- A builder for a struct with three fields; a registry or plugin point with one entry.
+- An error enum with variants nothing matches on; one variant per call site when every caller
+  just logs.
+- A new module or file for one function.
+
+**Counts as a second user:** another call site in the same diff, another provider the spec names,
+or an existing trait that every implementation in the repo already follows. **Does not count:** "the
+UI will need it", "we may add Postgres", or a test that is the only other caller.
+
+### 2.3 Over-complication
+
+**Definition.** Control flow or state a reviewer cannot predict from the signature and the first
+screen of the body. Over-engineering is too much structure around the code; over-complication is
+too much happening inside one piece of it.
+
+**Test.** Cover everything below the first screen of the function. Can you say what it returns for
+each kind of input? If not, split it.
+
+**Examples, each needs a split or a name:**
+
+- A `bool` parameter that switches behaviour (`send(msg, true, false)`): two functions, or an enum.
+- More than ~5 parameters: a named struct.
+- Nesting deeper than three: an early return or a helper.
+- `Option<Option<T>>`, `Result<Option<Result<…>>>`, `(bool, bool, Option<String>)` as a return
+  type: a named enum.
+- An iterator chain whose closures contain branches: a loop.
+- A function that is only correct if another one ran first: return the value and pass it in, or
+  make the ordering a type.
+- `Arc<Mutex<_>>` to share what could be passed by value; `async` or `spawn` for work that is not
+  I/O; a macro where a function works.
+- A `&str` or `i32` that is really an enum (`status == "running"`).
+- A mutable local that is reassigned across more than one screen.
+
+**Default when unsure:** the version with fewer names and fewer branches wins. If two versions both
+meet the rules, ship the shorter diff.
+
+## 3. Build in logical components with predictable behaviour
+
+Split each Change or Feature into **logical components**. A logical component is one unit with one
+job, such as "decide who to page", "render the SMS text" or "send through the provider".
+
+- **One line, no exceptions.** You must be able to explain each component in one plain sentence
+  that has no "except when". If you cannot, it is two components.
+- **Same input, same output.** Keep the decision logic pure: no I/O, and the clock (`now: i64`),
+  randomness and config are passed in as arguments. Side effects (database, network, queue) live in
+  a thin outer layer that only carries out what the pure core decided. In practice: the core takes
+  the config *values* it needs; the outer layer is the one that reads the global config.
+- **Deep is fine, wide is not.** A function may run many steps one after another. It should not
+  fan out into many branches. Prefer an exhaustive `match` on a project enum (no catch-all `_`
+  hiding a future variant; `_` is only for `#[non_exhaustive]` foreign enums), early returns, and
+  lookup tables over chains of `if/else`. If a decision has more than about four outcomes, give the
+  outcome a name: make it an enum.
+- **Write the guarantee in the type wherever the type can say it.** Adapted from Audacity's
+  safety guarantees (https://audacity.gitbook.io/dev/getting-started/coding-standards#safety_guarantees_defined):
+  - *pure*: the signature says it. Takes values or `&`, returns a value, not `async`, touches no
+    global. No tag needed.
+  - *no-fail*: returns `T`, not `Result<T>`. Any `unwrap`, `expect`, index or unchecked arithmetic
+    inside needs a one-line comment naming the invariant that makes failure impossible.
+  - `[strong]`, tagged at the end of the doc comment: either it fully succeeds, or it fails and
+    nothing changed. For example, one database transaction.
+  - `[weak: <what may be left behind>]`, tagged: a failure can leave partial effects, but
+    everything stays consistent. Name what is left behind and what makes a retry safe. For example:
+    `[weak: the ledger row may exist without a send; a retry is a no-op]`.
+
+  Only the outer I/O layer carries `[strong]` / `[weak]`. A tag is a promise: each one needs a test
+  of its failure path.
+
+## 4. TDD, without the bloat
+
+- **Test first, and see it fail.** A test written after the code, or one you never saw fail,
+  proves nothing. Run the narrowest target that contains it red, then make it green.
+  Exempt: a pure refactor (behaviour unchanged, the existing tests are the net and you do not edit
+  them) and a pure deletion.
+- **One test per numbered rule or per real branch.** Use table-driven tests (inputs → expected
+  outputs) for pure components. Do not test the framework, getters or private helpers on their
+  own. Do not repeat an assertion that another test already makes.
+- **Pass values, do not mock.** If a function needs a mock to be tested, its I/O is in the wrong
+  layer (§3). Mocks are for the thin outer layer only, and only when no real local dependency is
+  available.
+- **Never change a test's expectation to get green** unless the PR states why the old expectation
+  was wrong.
+- **Done = every numbered rule has a passing test and the repo's gates pass.** "It looks
+  complete" is not done.
+- **Size each diff by rule, not by subsystem.** One rule (or a few small ones), its test and its
+  code, small enough for a person to review in one sitting.
+
+## 5. The working loop
+
+In repos that have the `o2-loop` skill (openobserve, o2-enterprise), the skill *is* steps 3–6
+below: it owns the round cap and the findings ledger. Elsewhere, run the steps by hand.
+
+1. **The main chat is the monitor.** It holds the spec, the rule list and the progress. It
+   delegates the work and does not do bulk reading or writing itself.
+2. **Spec gate** (Change and Feature only). Before any code, write the numbered rules, the
+   components with their one-line jobs and guarantee tags, and the open questions. Ask the human
+   about every open question.
+3. **Tests.** A subagent writes the tests for the next rule-sized slice. Before it reports, it
+   checks them once against this list: does each test map to a rule, did it fail first, is any
+   test a duplicate, is anything invented.
+4. **Cold review.** A fresh reviewer (one that did not write the code) gets only the spec path
+   and the diff, not the conversation, and applies the three tests in §2. Each finding must give
+   `path:line` and a concrete failure: "input X gives wrong output Y". A finding with no concrete
+   failure is dropped.
+5. **Confirm each finding before acting on it.** Read the cited lines, or run a test that shows
+   the failure. Reviewers make things up too. Fix only the findings you confirmed, and record the
+   ones you rejected along with the reason.
+6. **Repeat step 4** until a round produces no confirmed finding. If the round cap is reached and
+   real problems remain, the spec is the problem: go back to the human.
+7. **Run the repo's gates (fmt, clippy, tests) before every review round** so reviewers do not
+   spend tokens on what a tool would catch.
+
+**Review depth follows risk.** Pure logic with good table tests needs one cold round. Full depth
+for anything that touches: unauthenticated endpoints, authorization, signature verification,
+secrets, money, data deletion, migrations, anything that pages a human.
+
+**Stop and ask the human when:**
+
+- the spec does not decide something (§1);
+- the only green path you can find is a hack (§2.1);
+- the fix needs to touch files or layers outside the stated scope;
+- an abstraction needs a second user and the spec has none (§2.2);
+- a test can only pass by changing its expectation;
+- the gates fail for a reason that predates your change.
+
+**Keeping the token cost down.** Give a subagent file paths and a narrow question, not pasted
+contents, and ask for conclusions with citations, capped in length. Use read-only search agents
+for searching. Continue an existing agent instead of starting one that has to re-read everything.
+Do not re-read files you already read, and do not re-derive facts you already settled.
+
+## 6. UI
+
+- Follow the repo's UI rules. In openobserve that is the `ui-architect` skill: O2 components,
+  rem not px, design tokens. Mock the flow on the real product UI before building it.
+- **Zero-config for 90% of users.** Defaults that work without any setup, controls whose meaning
+  is obvious from the screen, and no step that needs the docs. Advanced options stay out of the way
+  until someone needs them.
+
+## 7. How to write for the human
+
+- Write for a reader who has not followed the conversation. Define each term the first time you
+  use it, use plain words, and make the conclusion the first thing they read.
+- When agents reach a decision, present it as: what we will build, how it behaves for the user,
+  what we decided not to do, and what still needs a human answer.
+- A PR description states the tier (§0), lists the numbered rules with the test that covers each,
+  and lists the rejected review findings with their reasons.
diff --git a/.claude/agents/o2-coder.md b/.claude/agents/o2-coder.md
index 2fe33b1f4b..ceafcc734d 100644
--- a/.claude/agents/o2-coder.md
+++ b/.claude/agents/o2-coder.md
@@ -10,7 +10,7 @@ When the brief names a checkout path, every file you read or edit and every comm
 
 ## Ground rules
 
-- Follow the repo's `CLAUDE.md` exactly: item ordering, one-line comments, tests module last, clippy thresholds.
+- Follow the repo's `AGENTS.md` exactly: item ordering, one-line comments, tests module last, clippy thresholds.
 - Never run `git commit`, `git add`, `git reset`, `git stash`, or `git push`. The orchestrator's script freezes your working tree as a WIP commit; you only edit files.
 - Never spawn agents or split your work; if the spec needs more than one coder, that is the orchestrator's decision, and you say so in a `question:` line.
 - Never write to the ledger except the files named below, and never edit `verdict.json`.
@@ -27,7 +27,7 @@ When the brief names a checkout path, every file you read or edit and every comm
    cargo fmt --all
    cargo clippy --workspace --all-targets -- -W clippy::too_many_lines -W clippy::cognitive_complexity -W clippy::excessive_nesting -D warnings
    ```
-   If the change touches `#[cfg(feature = "enterprise")]` code, follow `CLAUDE.md`'s enterprise verification rule or say in the evidence that it was not checked.
+   If the change touches `#[cfg(feature = "enterprise")]` code, follow `AGENTS.md`'s enterprise verification rule or say in the evidence that it was not checked.
 4. Write `<ledger>/round-1/evidence.md`: the exact commands, pass or fail, test names, tails of any failure output, and anything skipped.
 5. Reply to the orchestrator with: files changed, gates run, anything you deviated from in the spec and why.
 
diff --git a/.claude/skills/o2-loop/prompts/backend-codex.md b/.claude/skills/o2-loop/prompts/backend-codex.md
index 10adb4e17d..615d24c4a6 100644
--- a/.claude/skills/o2-loop/prompts/backend-codex.md
+++ b/.claude/skills/o2-loop/prompts/backend-codex.md
@@ -1,2 +1,2 @@
 ## Notes for the Codex reviewer process
-You run in Codex's read-only sandbox inside a disposable checkout of the commit under review. There is no `AGENTS.md` in this repository; `CLAUDE.md` at the checkout root is the rules file, so do not search for anything else. The ledger paths given below are absolute and readable; `rg` is not installed, use `grep`, `cat`, and `git`. Do not run cargo; the evidence section already carries the build and test results.
+You run in Codex's read-only sandbox inside a disposable checkout of the commit under review. There is no `CLAUDE.md` in this repository; `AGENTS.md` at the checkout root is the rules file, so do not search for anything else. The ledger paths given below are absolute and readable; `rg` is not installed, use `grep`, `cat`, and `git`. Do not run cargo; the evidence section already carries the build and test results.
diff --git a/.claude/skills/o2-loop/prompts/review.md b/.claude/skills/o2-loop/prompts/review.md
index 1950fba27f..926ce47143 100644
--- a/.claude/skills/o2-loop/prompts/review.md
+++ b/.claude/skills/o2-loop/prompts/review.md
@@ -1,8 +1,9 @@
 You are the second reviewer in a two-AI loop: the coder (a Claude agent) wrote this change, you (an independent reviewer process) review it, the coder fixes, you verify. Your job is to find real defects that a careful senior Rust engineer would block a PR on. Be precise, not exhaustive.
 
 ## Before you look at the diff
-1. Read `CLAUDE.md` at the repo root. Its rules on item ordering, comments, and clippy thresholds are hard requirements for this repo.
-2. Read the evidence file listed below. It contains the build, clippy, and test results the coder already ran. Do not re-run cargo; the sandbox is read-only.
+1. Read `AGENTS.md` at the repo root. Its rules on item ordering, comments, and clippy thresholds are hard requirements for this repo.
+2. Read §2 of `.agents/engineering-guidelines.md`: the definitions and tests for a hack, over-engineering and over-complication. Apply those tests, not your own taste, when you report one.
+3. Read the evidence file listed below. It contains the build, clippy, and test results the coder already ran. Do not re-run cargo; the sandbox is read-only.
 
 ## What to review
 Only the change set described in the "Change set" section. Read surrounding code as needed to judge it, but do not report pre-existing problems outside the diff unless the diff makes them worse.
@@ -14,7 +15,8 @@ Look for, in priority order:
 - Error handling: swallowed errors, `unwrap` on fallible paths, wrong status codes, silent truncation of results.
 - API and compatibility contracts: wire-format changes, enterprise `cfg` gates, behaviour differences between OSS and enterprise builds.
 - Performance regressions on hot paths: extra allocations or clones in loops, O(n²), needless full scans, metrics with high-cardinality labels.
-- Repo conventions from `CLAUDE.md`: multi-line or narrating comments, functions placed above constants or types, tests module not last, `pub` and private functions interleaved.
+- Hacks, over-engineering and over-complication as `.agents/engineering-guidelines.md` §2 defines them: a symptom patch, an abstraction with one user, a function whose result cannot be predicted from its first screen.
+- Repo conventions from `AGENTS.md`: multi-line or narrating comments, functions placed above constants or types, tests module not last, `pub` and private functions interleaved.
 - Missing tests for new branches, or tests that cannot fail.
 
 Do not report: formatting, naming taste, anything `cargo fmt` or `cargo clippy` already enforces, or speculative issues you cannot point to a concrete line for.
diff --git a/.claude/skills/o2-loop/prompts/verify.md b/.claude/skills/o2-loop/prompts/verify.md
index d5016fc6bd..4c808a69be 100644
--- a/.claude/skills/o2-loop/prompts/verify.md
+++ b/.claude/skills/o2-loop/prompts/verify.md
@@ -1,7 +1,8 @@
 You are the second reviewer in a two-AI loop: the coder (a Claude agent) wrote this change, an independent reviewer process (possibly you) reviewed it in a previous round, the coder responded, and now you verify. You have no memory of the previous round; everything you need is in the files listed below.
 
 ## Before you look at the code
-1. Read `CLAUDE.md` at the repo root. Its rules are hard requirements for this repo.
+1. Read `AGENTS.md` at the repo root. Its rules are hard requirements for this repo.
+   Apply §2 of `.agents/engineering-guidelines.md` (hack, over-engineering, over-complication) by its tests, not by taste.
 2. Read the evidence file for this round (build, clippy, and test results the coder ran after fixing). Do not re-run cargo; the sandbox is read-only.
 3. Read every earlier round's findings and the coder's per-finding responses, all listed below in order. A finding's severity, location, and defect description live in the round that first reported it; later rounds only carry its id and status.
 
@@ -14,7 +15,7 @@ A prior finding is any id from any earlier round whose latest status is not `res
 Do not repeat a prior finding in `findings`; its status lives in `prior_findings`.
 
 ## Step 2: review what changed since the previous round
-The delta between the previous round's commit and this round's commit is listed below. Review only that delta for new defects, using the same priorities as a first-round review: correctness, concurrency, security, error handling, API contracts, performance, `CLAUDE.md` conventions, missing tests. New findings get fresh ids continuing after the highest id used in any earlier round.
+The delta between the previous round's commit and this round's commit is listed below. Review only that delta for new defects, using the same priorities as a first-round review: correctness, concurrency, security, error handling, API contracts, performance, `AGENTS.md` conventions, missing tests. New findings get fresh ids continuing after the highest id used in any earlier round.
 
 ## Output rules
 - `verdict` is `approve` only if no prior finding is `still_open` with an original severity of critical, high, or medium, and no new finding is critical, high, or medium.
diff --git a/.gitignore b/.gitignore
index 9c69de02e0..25a38a8e65 100644
--- a/.gitignore
+++ b/.gitignore
@@ -68,6 +68,7 @@ tests/ui-testing/playwright-tests/utils/auth/user.json
 
 # ---------- other agents ----------
 /.agents/*
+!/.agents/engineering-guidelines.md
 
 alert_mock
 # Local verification artifacts (browser screenshots, per-crate scratch DBs)
diff --git a/AGENTS.md b/AGENTS.md
index 5c2f7db9cb..919077ff86 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,5 +1,12 @@
 # OpenObserve — project rules
 
+## Engineering guidelines
+
+- [.agents/engineering-guidelines.md](.agents/engineering-guidelines.md) governs judgment: task
+  tiers, what counts as a hack / over-engineering / over-complication, TDD and the review loop.
+  Read it before any change bigger than a one-cause patch; reviewers apply its §2 tests. On
+  anything mechanical (ordering, comments, lint thresholds, schema, PR rules) this file wins.
+
 ## Build & workflow
 
 - Build with `cargo build` (debug). Never use `--release` unless explicitly asked.
diff --git a/Cargo.toml b/Cargo.toml
index f45cea1a6a..015d785250 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -51,8 +51,14 @@ cloud = [
 ]
 mimalloc = ["dep:mimalloc"]
 jemalloc = ["dep:tikv-jemallocator"]
+cpu-profiling = [
+    "openobserve-api-http/cpu-profiling",
+    "openobserve-jobs/cpu-profiling",
+    "openobserve-core/cpu-profiling",
+]
 profiling = [
     "jemalloc",
+    "cpu-profiling",
     "openobserve-api-http/profiling",
     "openobserve-jobs/profiling",
     "openobserve-core/profiling",
diff --git a/deploy/build/Dockerfile.profiling.amd64 b/deploy/build/Dockerfile.profiling.amd64
index efc262062d..b7c91e0fa6 100644
--- a/deploy/build/Dockerfile.profiling.amd64
+++ b/deploy/build/Dockerfile.profiling.amd64
@@ -23,7 +23,7 @@ COPY . /openobserve
 COPY --from=webbuilder /web/dist web/dist
 RUN mkdir -p /openobserve/target/release/
 
-RUN --mount=type=cache,target=/root/.cache/sccache cargo build --profile release-profiling --features mimalloc,profiling --target x86_64-unknown-linux-gnu \
+RUN --mount=type=cache,target=/root/.cache/sccache cargo build --profile release-profiling --features mimalloc,cpu-profiling --target x86_64-unknown-linux-gnu \
   && sccache --show-stats
 RUN mv /openobserve/target/x86_64-unknown-linux-gnu/release-profiling/openobserve /openobserve/target/release/openobserve
 
diff --git a/scripts/translations/.translation_state.json b/scripts/translations/.translation_state.json
index e872946d4e..ec18762b32 100644
--- a/scripts/translations/.translation_state.json
+++ b/scripts/translations/.translation_state.json
@@ -2361,8 +2361,8 @@
     "actions": {
       "attachDestination": "e4ee81538188171d",
       "attachDestinationDesc": "79999248115223c2",
-      "enableDeduplication": "23b7113a61773230",
-      "enableDeduplicationDesc": "51b6f906f1e9112d",
+      "enableDeduplication": "58597d12e244abbb",
+      "enableDeduplicationDesc": "312e4a7af5d06ccf",
       "fixAlertQuery": "d5402a926641e540",
       "fixAlertQueryDesc": "dfb99a99051ee69b",
       "lengthenEvaluationWindow": "a77df21ce70c24c1",
@@ -3337,6 +3337,8 @@
       "refreshDestinations": "30bb2318f36e608d",
       "sectionTitle": "74a883a037bc227f",
       "sendsToStatus": "df6e0cc2cad0b7b6",
+      "suppressRepeats": "fb0d6c1b34ed1c65",
+      "suppressRepeatsTooltip": "cfaddd8a61012886",
       "targetsDestinationsGroup": "72eb63f032e47e34",
       "targetsWorkflowsGroup": "e2073645cb0dbbdd",
       "timezoneWarning": "6baa6a168e65198c"
@@ -3654,27 +3656,6 @@
     "confirmDeleteDestinations": "9acb690d79a0b4e5",
     "confirmDeleteTemplates": "e7e356f0b59c474c",
     "continue": "31fbef162594de01",
-    "correlation": {
-      "cancelButton": "19766ed6ccb2f4a3",
-      "defaultWindow": "75ae7c854a023384",
-      "defaultWindowDescription": "10dca533b41a0e87",
-      "defaultWindowPlaceholder": "be8da1a40343815a",
-      "defaultWindowTooltip": "10dca533b41a0e87",
-      "description": "3e56d5465d4efdbe",
-      "enableCrossAlert": "57396cfdc96e6c94",
-      "enableCrossAlertTooltip": "9c3aaf4cc07f9aee",
-      "enableOrgLevel": "56334c505798bed6",
-      "enableOrgLevelTooltip": "7227130ee5c954f6",
-      "fingerprintGroups": "4784ece2c2a26f88",
-      "fingerprintGroupsHint": "eb3787c49ca121d4",
-      "fingerprintGroupsRequired": "a9ffea79feeeeef4",
-      "fingerprintGroupsTooltip": "ad5c93ed4ffc68fe",
-      "saveButton": "1509f561f2416598",
-      "semanticFieldNote": "746705420935a034",
-      "settingsSaveError": "4924972f958737c6",
-      "settingsSaved": "51b7016346687749",
-      "title": "eb8f2d364eed82fa"
-    },
     "createdAt": "3d44337010bfbdf7",
     "createdBy": "dfd60b9aa5ca29f4",
     "criticalIf": "d51f1d573fc13e14",
@@ -3682,17 +3663,6 @@
     "customDestination": "595795c3f2d32edd",
     "customDestinationDescription": "5966438ae41e979b",
     "customSql": "874d485cbc30fc67",
-    "dedup": "401f0a26aa07419c",
-    "deduplication": {
-      "fingerprintFields": "971a78dedba8e98c",
-      "fingerprintFieldsHelp": "3cae384fc3fc416f",
-      "fingerprintFieldsHint": "f4b085fa4f07283b",
-      "fingerprintFieldsTooltip": "e481b9fe6b452cdd",
-      "timeWindow": "671058294d73de1e",
-      "timeWindowHint": "01d49f5a8b894cd6",
-      "timeWindowTooltip": "04b798d6e4136819"
-    },
-    "deduplicationConfiguredTooltip": "ac43a07ea8e2bd56",
     "delete": "e2d0a54968ead24e",
     "deleteAlertMessage": "b5bd997057b8e7db",
     "deleteAlertTitle": "73d4e7aa312ba1ac",
@@ -5030,8 +5000,6 @@
       "actions": {
         "actionsFor": "c9cb1c707b38a9b8",
         "closeActions": "821790b7ba7639e1",
-        "configureDedup": "f352a1749543adbd",
-        "configureDedupTooltip": "160ba9c7a3b6ae2f",
         "editAlert": "55d309d6da250466",
         "editAlertTooltip": "b2960b39285cbde9",
         "viewAlertHistory": "0e26841319ab8a3b",
@@ -5134,9 +5102,6 @@
     "noData": "af75117dfbb0edb7",
     "noTemplatesMsg": "e9e871d4bebbbe00",
     "noTriggersLoaded": "980bb294c56dd9e3",
-    "notificationSent": "02e87bf90c4c4431",
-    "occurrence": "1b12a9d74483571f",
-    "occurrencesDeduplicated": "46d74043371765f4",
     "oncallTeam": "b250e6b0b87af388",
     "oncallTeamAtFireTime": "80a154924b2e1c49",
     "oncallTeamFromRules": "6ca74cdb253f8fc9",
@@ -5148,14 +5113,10 @@
     "outputMessages": "ace70a9ce0d04504",
     "outputMessagesLabel": "ace70a9ce0d04504",
     "owner": "4b1b8aa3608a26da",
-    "passedLabel": "11abdb02ce12dc7e",
     "pause": "858e4ba7a29fd38b",
-    "pendingBatches": "5a61ad2dc761ebb3",
-    "pendingBatchesTooltip": "1851046da4cddf4a",
     "period": "b885b560b9174430",
     "placeholders": {
       "addTag": "221f0b0cd0dd4842",
-      "autoUsesCheckInterval": "580e20ef34637b15",
       "savedFunctions": "e26ec955b2ba4407",
       "selectColumn": "91db086469f6b553",
       "typeSomething": "680ec866a90e116c",
@@ -5514,13 +5475,11 @@
       "alertSettings": "507c5a3eed5763d3",
       "alertSetup": "cce2cf121808b3fc",
       "compareWithPast": "2b534069633d462f",
-      "conditions": "6303136617bd2f68",
-      "deduplication": "b1136c8463de1038"
+      "conditions": "6303136617bd2f68"
     },
     "steps": {
       "advanced": "9f088dbebd6c3c70",
-      "compareWithPast": "f72a7d32906c557c",
-      "deduplication": "68c30f88becadc79"
+      "compareWithPast": "f72a7d32906c557c"
     },
     "streamConfig": "50009d375dd72fc0",
     "streamName": "4a25bb3cfd6fd66c",
@@ -5588,8 +5547,8 @@
     "summaryRecent": "5b047e7e0aea16e4",
     "summaryTotal": "c9b3c38247f744e1",
     "suppressed": "feb3abdafeb72a33",
-    "suppressedByDeduplication": "222f34152e79262d",
-    "suppressionRate24h": "84e7bccc111a1c19",
+    "suppressedAsRepeat": "e37596eb0cf6120b",
+    "suppression": "858c847b742b96bd",
     "tags": "1331275bc537b4c2",
     "tagsTooltip": "a56e372b90037999",
     "template": "84de89c26b0ff73f",
@@ -5611,15 +5570,12 @@
     "timestamp": "115a2cc92c1097ac",
     "timezoneRequiredLabel": "109c6d257c45352e",
     "title": "7e8cd2056da73a7f",
-    "total": "11239872d178729a",
-    "totalAlerts": "43ac1c2b6422ca65",
     "trainingWindow": "9480a67efe24c0ee",
     "triggerAlert": "8b9c643731c94119",
     "triggerDetection": "ad2fdbfe066f7a7e",
     "type": "baaddf70fb5d432b",
     "unknownHttpStatus": "b764cdc0eab71374",
     "useCurlyBracesNote": "40531e1b24e2da8b",
-    "usingDeduplication": "b9b769b6e61b4efa",
     "validation": {
       "aggregationColumnRequired": "c2a4688b43f9b7f7",
       "aggregationFunctionRequired": "4941ce4b9d80bcd5",
@@ -6225,7 +6181,7 @@
         "AddLibraryAlert": "babfb4ab4d1ddb7a",
         "AttachDestination": "3c4146ec72d1b65a",
         "CreateDetector": "f92e9e088ba7d13a",
-        "EnableDeduplication": "1f9ce350c9773ecf",
+        "EnableDeduplication": "eba2293ef985f5c3",
         "EvictLeakedConnections": "4d8d53793e2ad3b6",
         "FixAlertQuery": "39f58fd1741f97bd",
         "LengthenEvaluationWindow": "651154e9e09287fd",
@@ -6243,7 +6199,7 @@
       },
       "connected": "22965568d22a14ee",
       "defaultsNote": "e87dd6ae47bb0736",
-      "gateHint": "fd019c81f3b1f9e7",
+      "gateHint": "186791c4a234cc95",
       "groupCalibration": "2cc6a26ef5e2484f",
       "groupCoverage": "879ed1aa0d5a6ce9",
       "groupCoverageHint": "6c192c1211614195",
@@ -6385,11 +6341,11 @@
           "why": "7d27ee7ad327d185"
         },
         "L-302": {
-          "done": "c6a795b938e2583f",
-          "from": "154366e9201d07e3",
+          "done": "6d93312b7188de0d",
+          "from": "62bf37b09b005aee",
           "on": "294f3ee187954fa2",
-          "to": "6b86b273ff34fce1",
-          "why": "739fb6ef2a71c28e"
+          "to": "6979e49983feda16",
+          "why": "c5fea437c2f5558f"
         },
         "L-303": {
           "done": "752f6289efad802d",
@@ -6606,7 +6562,7 @@
         "foundWatch": "9251b3f34a2e81d8",
         "fridaySummary": "62905f1ed1b16b86",
         "gatewayPaged": "58a7e729458969c0",
-        "latencyGrouped": "9a1ebc4193819ad7",
+        "latencyGrouped": "a81dff48ae005919",
         "loginPaged": "d8e4ed65191a0363",
         "newWatch": "f21fc04ec0805552",
         "poolApproved": "8ff3647e9840cc9c",
@@ -8261,6 +8217,7 @@
         "critical": "427dd2969bd140be",
         "degraded": "a8494c12f2243903",
         "down": "b86d11af79188e58",
+        "error": "54a0e8c17ebb21a1",
         "failed": "031a8f0f659df890",
         "healthy": "7f1e323b6272c620",
         "offline": "a1794783aab72d20",
@@ -8944,6 +8901,9 @@
     "bits": "6b4ef7a4f34f2685",
     "bitsPerSecond": "f3b0dd77d1d3149a",
     "bottom": "479ad21ac9096236",
+    "boxplotWhisker": "ace8ebbdaba90aaa",
+    "boxplotWhiskerIqr": "3217336eec297a44",
+    "boxplotWhiskerMinMax": "a9636b513c88e43b",
     "browserDeniedFileDownload": "c29bc3d4a1ceed2b",
     "bucketUnit": "9c255386ebf5b06b",
     "bucketUnitCustom": "a7ea7b936ab593f2",
@@ -8966,12 +8926,14 @@
     "chartSelection": {
       "alertList": "e4e74afbcd38eab5",
       "barGauge": "9e949a5820332fca",
+      "boxplot": "e4d59eb4ea943661",
       "customChart": "5502642e42fe9de9",
       "distribution": "72a23e549d099bbd",
       "flameGraph": "d776d0b395c67943",
       "funnel": "fc063af055a3a9f3",
       "gauge": "f6d8f4c86cebb44b",
       "html": "07239dbd2a1a1dd7",
+      "logs": "ea2100dc89ae9fe2",
       "markdown": "0e52f6b9d02515c5",
       "nodeGraph": "4d9a159f99ec9f79",
       "sankey": "362c638c72a060cd",
@@ -9544,6 +9506,7 @@
     "hours": "21e8492938abc179",
     "hstackedLabel": "0bf475d412d632f3",
     "htmlPanelEmbedBlocked": "34424226c6a45711",
+    "htmlPanelFieldTooltip": "94c0048448e73412",
     "hundredPlaceholder": "ad57366865126e55",
     "id": "12156e921bdb6085",
     "identifier": "9b10587f84a2c374",
@@ -9675,6 +9638,16 @@
     "lineThicknessRange": "ab9f0dadabe42cc2",
     "linear": "e6950b45d25c2027",
     "localeFormat": "b8017eeb489109d9",
+    "logsLevelField": "67352c54cca99a32",
+    "logsMessageField": "8a0e4ee365cd7b37",
+    "logsOrder": "6be090825c997103",
+    "logsOrderNewest": "ffb6f5764bddb68c",
+    "logsOrderOldest": "6e2ebdab3c02a3e6",
+    "logsOrderTooltip": "c60ccd9e4b72b11c",
+    "logsPrettifyJson": "c96fbb7e82c0c6e3",
+    "logsShowTime": "c53847ca2389f46e",
+    "logsTimeField": "4e1ee7767412cb49",
+    "logsWrap": "6727132ac799a256",
     "longitudeLabel": "6d80458fd17d33fc",
     "mapCluster": "158f734a97e87cd5",
     "mapClusterRadius": "5b37352fbfb9f34c",
@@ -10100,6 +10073,7 @@
       "dashboardDeletedAction": "9af86340789ed912",
       "dashboardMissing": "5a625c76e6145acc",
       "defaultNotAvailable": "f100490863c82d99",
+      "disabledPaused": "4a436bdcf4fbf5d4",
       "editAccessRequired": "085cd7d51f0b9062",
       "editForbidden": "3a3a55d6afcabfbe",
       "editNote": "604f60afa00cb59c",
@@ -10122,6 +10096,7 @@
       "newLink": "39890d5b20848a6b",
       "openDashboard": "803f2313cdf44275",
       "openPublicPage": "193b919d4957430f",
+      "orgDisabledBanner": "b3c3f4ddc639449b",
       "orgDisabledHint": "76b67d3fe9918c0b",
       "pageSubtitle": "69e8f1d6eb64b08b",
       "pageTitle": "b4bee918655d4e11",
@@ -10670,6 +10645,7 @@
     "utils": {
       "addAtLeastOneFieldFor": "e6a070d000e6a750",
       "addAtLeastOneFieldOnEither": "c26044cb61956d35",
+      "addAtMostOneFieldFor": "15c467b3dfde01d6",
       "addExactlyOneFieldAreaStacked": "9307a7ecdb9a1807",
       "addExactlyOneFieldOnAreaStacked": "5e54b757bd6c1193",
       "addExactlyOneFieldStacked": "9728d7a031952d75",
@@ -10695,6 +10671,13 @@
       "argMustBeValidNumber": "333ba2eddd983a49",
       "argNumberNoValue": "1264a103288e24ce",
       "argStringNoValue": "cd79d486c995bca9",
+      "boxplotLowerWhisker": "3415f15325daa2cb",
+      "boxplotMax": "a1a5936d3b0f8a69",
+      "boxplotMedian": "daab7c435134742a",
+      "boxplotMin": "dea79332147ffe1f",
+      "boxplotOutlier": "c1f25bd5c2732041",
+      "boxplotSamples": "bc228b269ce0d87f",
+      "boxplotUpperWhisker": "8d54fdd65dbb7ecf",
       "configValueNotNegative": "1a5497bb6e9a2fff",
       "configValueNotNumeric": "c92a74f449a4d907",
       "configValueOutOfRange": "1a8f45a1d20d6cd4",
@@ -12304,6 +12287,12 @@
       "description": "b928f13366a82214",
       "title": "5cc7ab6259dc720f"
     },
+    "noBlockedUsers": {
+      "action": "38398e7642a68580",
+      "actionDesc": "b83179b51b4348ea",
+      "description": "f37628054e521e56",
+      "title": "7ee90761f864fedc"
+    },
     "noCipherKeys": {
       "action": "eda5496b306f05bc",
       "actionDesc": "1001dea858967963",
@@ -12354,6 +12343,16 @@
       "description": "58946c6145c03a73",
       "title": "29b0352f2dc58297"
     },
+    "noDomainMappings": {
+      "action": "160cc87a108cd97f",
+      "actionDesc": "2d52feca2091f687",
+      "description": "8d2a1d3961a85569",
+      "title": "5e555e9dfc2f7305"
+    },
+    "noDomainRequests": {
+      "description": "eec9ff2e2ca9e75f",
+      "title": "c242dd5f6af4b624"
+    },
     "noDowntimes": {
       "action": "928a7246a60c12cf",
       "actionDesc": "b39e9d84e595a81e",
@@ -12422,6 +12421,14 @@
       "description": "f8d04da459e9beac",
       "title": "dbeed0f9193cc3e6"
     },
+    "noLinkedDomains": {
+      "description": "fa12abdd3599d33a",
+      "dns": "4bed48849e63af07",
+      "dnsDesc": "c377b7285abb1d9d",
+      "request": "66151f5b1821c8d6",
+      "requestDesc": "6752b021a2d01da5",
+      "title": "f806dd9c9c9fccc4"
+    },
     "noLlmProviders": {
       "action": "8cd1856b03dd6844",
       "actionDesc": "b67cc2375086b515",
@@ -12695,10 +12702,13 @@
       "anomalyConfigs": "3eec8e1c618c4e60",
       "apiLimits": "277e1f454b2456f5",
       "backfillJobs": "9e55cd82af3ec79c",
+      "blockedUsers": "baa1092cc5cce495",
       "cipherKeys": "a4ec922695af251c",
       "dashboards": "21b2e2095fd38f7d",
       "datasetItems": "5f3c4f8580d392e4",
       "discoveryItems": "1ee23025c9c0c5a9",
+      "domainMappings": "2820946d61f000b8",
+      "domainRequests": "2e76551da294e5e7",
       "enrichmentTables": "2523e745479b9694",
       "evalJobs": "6559acc79b8655cb",
       "evalTemplates": "3d717d23df0a3510",
@@ -12708,6 +12718,7 @@
       "incidents": "a6d1765ab64d82a7",
       "ingestionTokens": "94150066b0bceb34",
       "invitations": "33cd5e40bb5fc8a9",
+      "linkedDomains": "3478feb608d25877",
       "llmProviders": "437dbe28117905aa",
       "logs": "98f38f12db221a8c",
       "modelPricing": "960087629fb9d135",
@@ -13754,13 +13765,34 @@
       "all": "a52ace420f2175d0",
       "allModulesTitle": "7bd30494297e0f94",
       "bulkSelectColumn": "917098c49df7353d",
+      "changeCount": "36b588a4e74d7752",
+      "changeOtherGroup": "f97e9da0e3b879f0",
       "childResource": "916cd7c979a0b3e2",
       "clearFilter": "910bda6aed78b23e",
       "collapseModuleGroup": "35044c06f245c5fe",
+      "companionAdd": "9fd728c66c9a256b",
+      "companionAddAll": "05401f46f7cada88",
+      "companionAddItem": "19daf8f79286b612",
+      "companionNeeds": "6818176c00700328",
+      "companionNeedsThis": "63a7087c9444e6e6",
+      "companionOpenStreams": "ef836aa4f8f14513",
+      "companionOpenStreamsTooltip": "b4fc0385e294d732",
+      "companionReasonAlertDestinations": "7919e3c99e13467e",
+      "companionReasonAlertStreams": "c9bd36f5d3a37867",
+      "companionReasonDashboardStreams": "1aa7a8e2230242b5",
+      "companionReasonDestinationTemplates": "0b434e9829465f1f",
+      "companionStillNeedsThis": "1aabb4e04dc120a6",
       "dbmPresetNoMatch": "db8e3bdafce56e16",
       "dbmPresetSeeded": "5248e9a5b6aace4f",
+      "effectCan": "653af35fcda08995",
+      "effectCanLoadDestinations": "bde2e69f02f75fde",
+      "effectCanLoadTemplates": "dec9cf07c30bd11a",
+      "effectCannot": "f6e679263cfda4e6",
+      "effectCannotLoadDestinations": "53a21e80ef59aaad",
+      "effectCannotLoadTemplates": "c79800a8598665dd",
+      "effectStillAllowed": "5f13d4761582023c",
       "expandModuleGroup": "ed520c2c4b64e090",
-      "filterModules": "ceee269a8c7fd7c6",
+      "filterModulesTasks": "ceee269a8c7fd7c6",
       "forAllInstances": "6407662fdde3ff55",
       "grantedByWiderScope": "0dce4fb6dbbe656b",
       "grantedHereAndByWiderScope": "842472e92e47c946",
@@ -13795,28 +13827,77 @@
       "moduleScopeAll": "a52ace420f2175d0",
       "moduleScopeGranted": "57fd7a0cf33f2666",
       "modulesTitle": "76c86c4c32432be3",
+      "neededBy": "ac5a7811408bde24",
       "noGrantedModule": "fce6c29bb74e45f0",
       "noMatchingResources": "0ff4417804c27000",
-      "noModuleMatch": "ee7dcb6a716543e0",
+      "noModuleMatchHint": "76eaaeed65096525",
+      "noModuleMatchQuery": "7d2ec4c807d9baba",
       "noUpdatesDetected": "5b015412d0730e6f",
+      "notAddedYetTitle": "eb7ab14d0c4a7368",
+      "noteDestinationsFiltered": "ab2187bc5bf81cca",
+      "noteTemplatesFiltered": "406e4b9e6af308cc",
       "openFolder": "68b3f4bff6de90ae",
       "permissionCountSingular": "051f06305d595a6b",
       "permissions": "abccc78cc93c0793",
+      "presetAddButton": "914af4653212a900",
+      "presetAddsTooltip": "13dac67f1e227459",
+      "presetAlertManagerDescription": "2844c891cb1db276",
+      "presetAlertManagerTitle": "e86bbad1e2cc63ab",
+      "presetAlertViewerDescription": "73f45a2fd669376e",
+      "presetAlertViewerTitle": "649642cf0302439e",
+      "presetApplied": "430fbac3cb84d5e1",
+      "presetApplyNote": "bd39009c9fc74003",
+      "presetBack": "5d84c790bd898dd1",
+      "presetDashboardEditorDescription": "9136fcdd6f7915f2",
+      "presetDashboardEditorTitle": "906da4e8764c7d56",
+      "presetDashboardViewerDescription": "d317eb6722ac155d",
+      "presetDashboardViewerTitle": "4c576a48726aee1b",
       "presetDbmDescription": "6fa3fc84efd23374",
       "presetDbmTitle": "e2795b484db7c9dc",
+      "presetInRole": "9f31bb38d9b6e0d1",
+      "presetInRoleTooltip": "0dcd109291b0802a",
       "presetK8sDescription": "1ab5869177620a3c",
       "presetK8sTitle": "1348fce2efb5d899",
+      "presetLoadingStreams": "497dfcec1787bb0e",
+      "presetMissingItem": "18fcad9e28c393d3",
+      "presetModuleCount": "3e5b84b40963657c",
+      "presetNoMatchingStreams": "9e739c44f5232efc",
+      "presetNothingMissing": "f3a4df9f5f9524c6",
+      "presetNothingToAdd": "aa4db700a5dec3e1",
+      "presetPermissionCount": "574057eeed7f5ff4",
+      "presetPipelineEditorDescription": "de6e3add2840c75e",
+      "presetPipelineEditorTitle": "af77ceae37d95856",
       "presetReadonlyDescription": "65d35f1e5efff445",
       "presetReadonlyTitle": "fd523668f3222a15",
+      "presetReadsEveryStream": "779eeb4275b6a7f3",
+      "presetRestoreButton": "37496b30cafdbd3f",
+      "presetRestored": "98af67b8d9a42604",
+      "presetRetry": "942087cc2d41e013",
       "presetRumEditorDescription": "45af3f7b0636c328",
       "presetRumEditorTitle": "f44097ce697f860c",
       "presetRumViewerDescription": "397aac1005ba2e4a",
       "presetRumViewerTitle": "098cb30398d04ae9",
+      "presetStillMissing": "7b74472a3465f1d2",
+      "presetStreamsFailed": "770dea01f8e12907",
+      "presetSummaryAdds": "28ba936dbff7014a",
+      "presetSummaryHasAll": "bbe8cad8cacfb4f3",
+      "presetSummaryRestores": "22d18edbad0b14ae",
+      "presetSummarySkipped": "9952d82e7c251536",
+      "presetSummaryViewOnly": "3f60f63609742357",
+      "presetSummaryWrite": "f9265078106ee504",
+      "presetsClose": "f592612715ae2d33",
+      "presetsSectionBuiltin": "86d50abefe4a4533",
+      "presetsSectionJob": "8cd9b4e7688723aa",
+      "presetsShow": "55ed0bb59f5ff96d",
+      "presetsSubtitle": "261cf9df639b302a",
+      "presetsTitle": "954f93fe1c66ae44",
       "quickReference": "8dc01f004f155067",
       "reviewChanges": "d9764d6d64cedf78",
+      "reviewMissingTooltip": "84f3995080a989b0",
       "roleNotFound": "eb230bc586caaebf",
       "rumPresetNoMatch": "95873dff644884f3",
       "rumPresetSeeded": "f9b03957a5cad1c5",
+      "saveSuccessCounts": "a424d67969865677",
       "scopeAllOf": "c600e6cbe1bf6ad6",
       "scopeCoveredByParent": "f8e7e0b7e085d5a1",
       "scopeDowntimeHint": "2d5e550e6c592398",
@@ -13833,9 +13914,10 @@
       "show": "0df6f1cad36c49da",
       "specificInstanceOr": "2b209ead151a81a7",
       "stillGrantedByWiderScope": "b18dc7bb028b3b76",
+      "stillNeededBy": "ece32491c7520328",
       "summaryChangeAdded": "6b02e0d363a4af1c",
       "summaryChangeRemoved": "4118fb4fed0ecec9",
-      "summaryEmptyDescription": "bfe990d7ed130301",
+      "summaryEmptyDescription": "d4777882f82af0b1",
       "summaryEmptyTitle": "afef6f392c9add8d",
       "summaryGrantCount": "7ea21433a2c5ca22",
       "summaryGrantsLabel": "c30209075bd95b47",
@@ -13849,13 +13931,41 @@
       "summaryReachSome": "de344ba2ec6092cb",
       "summaryUndoRemove": "a8283ade31856f71",
       "table": "16d1c9050a0b32e8",
+      "targetAlertsEveryFolder": "1b30c61b34c2aae2",
+      "targetAlertsInFolder": "d1132b49171b0895",
+      "targetAllOf": "4f6fb834c57dacf6",
+      "targetDashboardsEveryFolder": "de65b7ac822f6f8e",
+      "targetDashboardsInFolder": "4ad30bcf340c009a",
+      "targetEveryDestination": "8d06c600c367bbb4",
+      "targetEveryStream": "41831f70a3de8a91",
+      "targetEveryTemplate": "33d89317e5d6565f",
+      "targetItemIn": "0a405945881e1c6a",
+      "targetOneAlert": "b07dd9e4c2b99b1d",
+      "targetOneDashboard": "60e538b12883ecbb",
+      "targetOneDestination": "728f70dab0c79cf2",
+      "targetOneReport": "7373c57a2afb80cd",
+      "targetOneStream": "bda1eea240ccdce6",
+      "targetOneTemplate": "bec08c395e9bcbc4",
+      "targetReportsEveryFolder": "5735ad2a2035e6e4",
+      "targetReportsInFolder": "36b71f4bfab131ee",
+      "targetTypeStreams": "697c8545d79c6c2a",
       "undoAllChanges": "0ee88bcfd6a2821d",
       "unsavedDot": {
         "title": "10ba25333a83c618"
       },
       "updateError": "f63709346743dd32",
       "updateSuccess": "71bc5feee968e4c1",
-      "users": "6b0cc904d081a8c1"
+      "users": "6b0cc904d081a8c1",
+      "verbCreate": "fa8847b0c3318327",
+      "verbDelete": "6197595503f01ee2",
+      "verbEdit": "262121c5372be8af",
+      "verbList": "a330395cc0a53ad1",
+      "verbOpen": "2348f99874421257",
+      "verbSeeListOf": "6a3a48332191d4f9",
+      "verbView": "2bcb43cbc8f6b7ef",
+      "yourChanges": "ca00e53e8f4182b3",
+      "yourChangesCount": "6da14898b0687060",
+      "yourChangesNone": "98ca0d518997f8a4"
     },
     "externalUserWarningMessage": "0140f11bb6c72a86",
     "externalUserWarningTitle": "88bc98107237635a",
@@ -14058,9 +14168,14 @@
       "memberUpdatedSuccessfully": "b5f31eeadc42a082"
     },
     "user": {
+      "blockedButNotRemoved": "cc3e20dfda028109",
+      "blockedUsersNotRemoved": "da4d989021bf0d6e",
+      "blockedUsersPartial": "3396915b26488411",
+      "blockedUsersSuccess": "25d80ed957b338fd",
       "delete": "e2d0a54968ead24e",
       "deletedUsersPartial": "63dd9d50783eb53e",
       "deletedUsersSuccess": "ff64d76cb2cf3e31",
+      "errorBlockingUser": "8c9761a0644254f4",
       "errorDeletingUser": "1fdccd5e6ca1b3ac",
       "errorDeletingUsers": "4486d04a04ee6f34",
       "errorRevokingInvitation": "3a16c6ec8755e277",
@@ -14075,6 +14190,7 @@
       "pleaseWaitLoadingUsers": "fb6392d9b349425a",
       "unknownError": "27c2ccd962c2b8dc",
       "userAddedSuccess": "35cfd2ebb7ee4177",
+      "userBlockedSuccess": "51037bfae45b0ca4",
       "userDeletedSuccess": "b2d6db91aa0c838b",
       "userUpdatedSuccess": "c54ffa5dc3449c37"
     },
@@ -15429,6 +15545,7 @@
       "dynamodbPipelineDesc": "f636a7855f10eac7",
       "dynamodbPipelineTitle": "1e6cafceaead0e9e",
       "dynamodbTagline": "64b74c679cbff83d",
+      "ebpfNetworkFlowsGuideLink": "f9c328e8b9c96f47",
       "ebpfTracingGuideLink": "927dc7edecfa2962",
       "ec2IamNote": "6110e1fc314f8c86",
       "enableSessionReplayDesc": "40519dfa9b2e2269",
@@ -15546,6 +15663,9 @@
       "k8sInstallerNote": "5f425a9e70ac3551",
       "k8sInternalEndpointNote": "f126f11d13c13953",
       "k8sLibrariesVariant": "0c527194c5b7ec36",
+      "k8sNetworkFlowsDesc": "ff40fa4596abcb07",
+      "k8sNetworkFlowsNote": "f317e2bba99a032f",
+      "k8sNetworkFlowsTitle": "78e2b5cf58d2ef0d",
       "k8sTroubleAnnotationA": "aaedaf1ae3dca70c",
       "k8sTroubleAnnotationQ": "f1d7d6ac036d9fd4",
       "k8sTroubleEndpointA": "9a233ffcb5cb08e9",
@@ -15557,6 +15677,9 @@
       "k8sTroubleWebhookA": "91f81f5fbca81dea",
       "k8sTroubleWebhookQ": "a911ec912d7a5a4d",
       "linuxAgentFixBody": "998a0d0a4fb72d7d",
+      "linuxNetworkFlowsDesc": "ce7edf9369ed6098",
+      "linuxNetworkFlowsNote": "89060e6b3b2e637c",
+      "linuxNetworkFlowsTitle": "6d919988371b8fb8",
       "linuxTracesNote": "0301ee038a3d5143",
       "linuxTracesVerifyNote": "0278ba0252e48cc9",
       "logsMetricsTracesVariant": "0036533de19fb57f",
@@ -15579,6 +15702,9 @@
       "mysqlAdminNote": "077314ff6018fa5f",
       "mysqlHostLabel": "9897c29e4ea26191",
       "mysqlTagline": "71e733e42a22a969",
+      "networkFlowsHelp": "5935d43be1041111",
+      "networkFlowsLabel": "d814b8c3c8c539d7",
+      "networkFlowsRequired": "ba7a0d62fddf54fb",
       "noLogsFoundYet": "b33c2d121bfd5962",
       "noMetricsFoundYet": "ccedc0cc2959d1d3",
       "noSpansFoundYet": "c6e7c48e1b4b65e2",
@@ -19945,6 +20071,7 @@
       "textbox": "449d1c52f1b8acf6"
     },
     "weight": "81d27ef6d5033c3e",
+    "wellCategory": "292c06f0045a45d0",
     "wellGroup": "34ca0e76608842ff",
     "wellSize": "1af851907331c0ed",
     "wellSubgroup": "96fe12a20ed919a6",
@@ -20773,6 +20900,72 @@
     "unitPerSecond": "71f1adcb645b5392",
     "updateLimit": "0fc43ae1b62fbe3e"
   },
+  "recentSearches": {
+    "aboutKeptDays": "31640629384cbf7e",
+    "aboutKeptForever": "2e08559121a01fa6",
+    "allPages": "903542125c003f8f",
+    "allStreams": "7ba01d16e615fc96",
+    "clear": "0d0ff3d78c31ee1a",
+    "clearBodyAll": "3979c4c7803210eb",
+    "clearBodyPage": "51a8842d6e7464e8",
+    "confirmClear": "496121494e4a967a",
+    "copyFunction": "6fb093137db6056d",
+    "copyLink": "dbf362d4f210c780",
+    "copyQuery": "8e5a75e93167b5a0",
+    "datePlaceholder": "038e472923ed356d",
+    "deletedQuery": "6d7f86f5dc466780",
+    "emptyTitle": "3dca22657bdc4672",
+    "failed": "031a8f0f659df890",
+    "failedCount": "cd8f5051cba3686a",
+    "filterByDateRun": "e78d12f2d00398bd",
+    "functionCopied": "2f4b48e8061978cc",
+    "functionLabel": "350c73d410d6a3bc",
+    "includeStarred": "3e622ea859a8790a",
+    "keyHints": "ed540677df5e80bc",
+    "lineCount": "e7b8886bd3dbee6c",
+    "linkCopied": "d12860c21e78baa5",
+    "loadError": "bee6fadd3aefbbe7",
+    "loadMore": "ac8991ef01019cf5",
+    "loadOnly": "d25f6d7876fb7647",
+    "loadToFix": "529d4a9b26d98d6b",
+    "noMatch": "074aee6c434f78e0",
+    "page": {
+      "dbm": "fa7fe67124e94375",
+      "logs": "ea2100dc89ae9fe2",
+      "metrics": "a58da793c7250f1b",
+      "profiles": "535e52e4a2616ebe",
+      "traces": "998741a58ed2b411"
+    },
+    "pageTitle": {
+      "dbm": "228c84b5a56e6bce",
+      "logs": "21a9d8d924e102cd",
+      "metrics": "30219f1c45b8c972",
+      "profiles": "228c84b5a56e6bce",
+      "traces": "e1dc9727e9f50873"
+    },
+    "queryCopied": "2b5f7fe902cb48bc",
+    "ranCount": "e505811bceef8aa8",
+    "recentRow": "7cb59bfc93961fa0",
+    "relativeWindow": "e35e9688dee4f7ee",
+    "rerunNow": "22de87ddeda82846",
+    "rerunOriginal": "781be17093338815",
+    "reset": "645982c52b7c11ae",
+    "resetFilters": "10afa98480f2d06c",
+    "retry": "942087cc2d41e013",
+    "searchPlaceholder": "7d854a995bf7dc35",
+    "star": "e357d396871d1012",
+    "starredOnly": "fbee73c784a49660",
+    "statusAll": "ac78229d6b822ce5",
+    "statusError": "031a8f0f659df890",
+    "statusOk": "6d9a6f97a5fdaf3b",
+    "title": "228c84b5a56e6bce",
+    "today": "2b065c7c9ce466e5",
+    "undo": "a8283ade31856f71",
+    "unstar": "318e826a75161b9f",
+    "viewAll": "30a64216eaeac5d3",
+    "warning": "d0f76e2e3abbb739",
+    "yesterday": "566181254b293aa6"
+  },
   "refreshButton": {
     "dataFresh": "7c21db7765d42a41",
     "dataGettingStale": "4854378d5d270821",
@@ -20782,6 +20975,8 @@
     "lastRefreshed": "81969c7ddc3eb624",
     "minutesAgo": "33f4d52fdfa39099",
     "notYetRefreshed": "cde59065c4a2f1a1",
+    "refresh": "0e91610117029a62",
+    "refreshWithAge": "964aef05f56113a1",
     "secondsAgo": "8a421d3a725aacf9"
   },
   "regex_patterns": {
@@ -21096,6 +21291,7 @@
     "loginCallback": "abc3ccb8b27e3974",
     "modelPricingEditor": "bcb792875fefde91",
     "notFound": "2d857a3660e0240b",
+    "orgDomainMapping": "91537c30fffb01dc",
     "passwordPolicy": "11831de5b6d62b7c",
     "pipelineBackfillJobs": "54a8767a761a58e0",
     "regexPatterns": "83a58bf362610444",
@@ -21983,6 +22179,7 @@
     "events": "8d14f6e72de8f18a",
     "eventsCount": "70894bd5fc64132e",
     "eventsUnit": "862417b9e7c3720b",
+    "exitFullScreen": "897e0cf78b808edd",
     "failedToDeleteSourceMaps": "c0d7f7d0ff020512",
     "failedToFetchTraces": "bdde58cab9c24864",
     "failedToTranslateStackTrace": "f9d33e143a021bff",
@@ -22004,6 +22201,7 @@
     "frustrationRageTap": "cf9680dedd1e387e",
     "frustrationSignalType": "ad5bb48dadd8e856",
     "frustrationSignalsDetected": "7ec6a4626da9715c",
+    "fullScreen": "674fe2acd0d5f47b",
     "handled": "1e7536d56c45d9cd",
     "health": "55898449eb74fb2e",
     "inTimeRange": "e07beeb7056f9845",
@@ -22037,6 +22235,163 @@
     "orClickToBrowse": "1c412f2d53be72cd",
     "osImageAlt": "343d012d58b2e98f",
     "overview": "d4b1ea5708dd5329",
+    "overviewPage": {
+      "asideLabel": "7f42198dd61617ad",
+      "bandAria": "5ba32c31f9967b1e",
+      "bandAtP75": "2a617709dcd228a3",
+      "bandGood": "c939327ca16dcf97",
+      "bandGoodPct": "103634e5ca02f3b9",
+      "bandNeeds": "738a3278e945747c",
+      "bandNeedsPct": "bb57abeb7367b245",
+      "bandPoor": "94dfd46d9dae63e6",
+      "bandPoorPct": "975fd9ed2d52b52e",
+      "chartInterval": "bb124e5867fdbc08",
+      "chartIntervalOther": "bb124e5867fdbc08",
+      "chartPerDay": "489b7ab47238e88a",
+      "chartPerFiveMinutes": "021a55c7a6d71a4c",
+      "chartPerHour": "6c72a5669544996a",
+      "chartPerSixHours": "b5df04a98ef1b95b",
+      "chartPerThirtyMinutes": "f489c4e09a100b11",
+      "chartTableCaption": "6aa2268c5bb0e779",
+      "chartTableHide": "a0879dad7c3f8a3d",
+      "chartTableToggle": "96fa2b6893c3aa4d",
+      "chartTime": "33b93476cf597a33",
+      "chartTitle": "45405319ec4a4cba",
+      "clearFilters": "7179ea0035fca783",
+      "deadClicks": "00d8ca7f888311a1",
+      "deltaChange": "9f0e28d14900e0b2",
+      "deltaChangePts": "e13f0a1ddee092fe",
+      "deltaFaster": "6a325085434f1240",
+      "deltaFlat": "3a4846c0d2b92e66",
+      "deltaHigher": "a8850998e2087257",
+      "deltaLower": "6379bccb1ae0895d",
+      "deltaNewMsg": "ec3bed16707958c0",
+      "deltaNoPrev": "7d233f38225a052d",
+      "deltaNone": "5d69f9dac5b02100",
+      "deltaSlower": "946227b5e1582391",
+      "diffBody": "30d7cce86b377ec7",
+      "diffLink": "2486d2e78f281c29",
+      "diffNone": "15c50d905a7115dc",
+      "diffSegment": "e14ff835a13bf68f",
+      "diffTitle": "ab83f728b5d37538",
+      "filterAll": "a52ace420f2175d0",
+      "filterEnv": "9e471951a1b4106e",
+      "filterService": "d677190e0a9990e7",
+      "filterVersion": "dd167905de0defca",
+      "forbiddenBody": "70052a9d798c22aa",
+      "forbiddenTitle": "1995b5ea7f6ce981",
+      "frustrationHint": "55abdb4890279913",
+      "frustrationReplayHint": "1aa9a318829058cf",
+      "frustrationReplayLink": "20a5e44483605bea",
+      "frustrationTitle": "56e60702769e4a73",
+      "kpiEmptyBody": "906be48ece2078ea",
+      "kpiEmptyTitle": "22be08ecd16a04a6",
+      "kpiErrorFree": "7d060fc5d0c5e396",
+      "kpiErrors": "5ea9d9389ee079aa",
+      "kpiRegion": "fd18cfaf42d52eae",
+      "kpiSessions": "6fa3cbf451b2a1d5",
+      "kpiUnhandled": "5b135a6d535f6e27",
+      "legendErrors": "cb702378f31507ef",
+      "legendSessions": "6fa3cbf451b2a1d5",
+      "markNeeds": "be5d23a3a45353b5",
+      "markPoor": "4e3795d05d9d3ed2",
+      "mixedBrowserNote": "004e723c7f422b4d",
+      "mixedMobileNote": "a9faf098a9c11cc8",
+      "pageErrorBody": "18f57a4129ed3f49",
+      "pageErrorTitle": "a4a790365c6aaad9",
+      "pageForbiddenTitle": "18fb9490a361a81b",
+      "pagesAbout": "78549e1bd0c69ec8",
+      "pagesAllLink": "903542125c003f8f",
+      "pagesAllLinkAria": "ebc1f3d358b3b82f",
+      "pagesColCls": "c47c6c6948ec5634",
+      "pagesColErrors": "cb702378f31507ef",
+      "pagesColImpact": "d1f23f0d13613e27",
+      "pagesColInp": "515b1a2be24746c8",
+      "pagesColLcp": "32106b7f555aa7de",
+      "pagesColPage": "0a30a815d67d7dd2",
+      "pagesColViews": "69c404591e99d86f",
+      "pagesEmptyBody": "bb22ebea13bc952d",
+      "pagesEmptyTitle": "bedda18bba81977d",
+      "pagesHint": "6c666de4002fc017",
+      "pagesImpactAria": "26b2708a79bc02ab",
+      "pagesLegend": "e9750ad656e68f14",
+      "pagesOpenErrors": "d17006b266c9da39",
+      "pagesOpenSessions": "2bda223ed7de6e96",
+      "pagesShowAll": "1177039dd3c91649",
+      "pagesShowFewer": "f8d72db5eef844c0",
+      "pagesTableLabel": "4ade2839c953451c",
+      "pagesTitle": "84cae825462bef43",
+      "panelFrustration": "a599d4cf692cd001",
+      "panelKpis": "5c512dd66195eed3",
+      "panelPages": "bfa062de040f55a1",
+      "panelRelease": "e0e8c0c197f8220c",
+      "panelSegments": "08fddbc83d3de346",
+      "panelVitals": "41d00ea2b1306bee",
+      "percentileLabel": "bb13af3d0ba72ee2",
+      "rageClicks": "c75d81aa8628a403",
+      "regionLabel": "d96040fed3bf811d",
+      "releaseBefore": "227c3d8e40305d8c",
+      "releaseEmptyBody": "a1971f4e7dcf7e6b",
+      "releaseEmptyTitle": "5962ee6e0edc2f96",
+      "releaseErrorFree": "d2a16e135b1bc49e",
+      "releaseHint": "a62a0366c41737f4",
+      "releaseImproved": "e88853216dc0a71e",
+      "releaseInp": "515b1a2be24746c8",
+      "releaseLcp": "32106b7f555aa7de",
+      "releaseLink": "2ceeb359b1e6871a",
+      "releaseMarker": "60368fcfa4e99557",
+      "releaseMetric": "2d275a74912cca2e",
+      "releaseNewErrors": "1b43c82ebc7ff5e2",
+      "releaseNote": "904272b628b800b2",
+      "releaseSessions": "6fa3cbf451b2a1d5",
+      "releaseTitle": "c84fabaf892a66b0",
+      "releaseWorse": "e760bdbe0be65db9",
+      "retry": "942087cc2d41e013",
+      "schemaErrorBody": "ddb5a959ca3f0192",
+      "schemaErrorTitle": "1bee2618fa07ae28",
+      "segBrowser": "d31de1a5c5c8ba2a",
+      "segConnection": "639a40e82b9a96f0",
+      "segCountry": "701d021d08c54579",
+      "segDevice": "6ba0bdeccb426d7b",
+      "segEmptyBody": "4ece6c1e99aa06d5",
+      "segEmptyTitle": "f20e5e6eeb43ab16",
+      "segInp": "95e0af44dc3b5f10",
+      "segNone": "72b7d7e92c4845f1",
+      "segOs": "343d012d58b2e98f",
+      "segShare": "f5c9b642aacbb5d9",
+      "segmentLabel": "29ee089ccecadf9d",
+      "sparkAria": "0908e97f1487e4c7",
+      "stateEmptyAction": "ee7646b3f423fb67",
+      "stateEmptyBody": "0e869c5ea6c07f51",
+      "stateEmptyFiltered": "ea6f94beb910cab9",
+      "stateEmptyQuiet": "c17f96e5fe52e329",
+      "stateEmptyTitle": "6f319360f9e15afc",
+      "stateErrorBody": "9fe5eb8b129794f1",
+      "stateErrorTitle": "0aa75faea4d1d91c",
+      "stateLoading": "eacd56e95b5f3c76",
+      "stateLowBody": "41b00a8813ab4166",
+      "stateLowTitle": "1f9b63a6d01336ee",
+      "stateRefreshing": "b79aa54865301ba9",
+      "tileOpenErrors": "3f6db05d68ba6874",
+      "tileOpenSessions": "61c01a80f711f64b",
+      "verdictAllPass": "02eabfdc35dffe20",
+      "verdictAllSome": "259b1a4fcf57bf51",
+      "verdictAllThree": "f5530a6cda768528",
+      "verdictCompare": "eeb12384c2ff9fa8",
+      "verdictFail": "bb95413b26462bc7",
+      "verdictNeedWork": "3a4c30caa999f317",
+      "verdictNeutral": "41d00ea2b1306bee",
+      "verdictNoData": "a621207696b9e79f",
+      "verdictNoDataLead": "c9de9a6ba7dd1ddf",
+      "verdictOver": "6a95f5e212faa9c1",
+      "verdictP75Note": "fbf2ee1626eb57ac",
+      "verdictPass": "f638962f3cc6807c",
+      "verdictSessions": "8cce09a9cd4caa12",
+      "vitalCls": "2592bbc7acc7fc0d",
+      "vitalInp": "33a2dbe6373afa87",
+      "vitalLcp": "a1ce627d3525a22c",
+      "vitalLinkFull": "cd27d4c527ac12cb"
+    },
     "performance": "442aded87a55aa8c",
     "performanceEmptyDescription": "89af28b2afec4422",
     "performanceEmptyTitle": "b75c54a6d0ca045f",
@@ -22484,6 +22839,7 @@
     "queryPlan": "f44ad102b5dd5df1",
     "queryRangeHours": "1eb8a48ad2a585d1",
     "queryRangeRestrictionMsg": "ea63dde7a2a85e18",
+    "quickModeHiddenFields": "8be086af5b4a1a1a",
     "quickModeLabel": "6cd472b871517ce9",
     "quickPickMoreStreams": "4e1a29d3b10349d0",
     "quickPickStreamsLabel": "aa2db1e403a5ced8",
@@ -22587,6 +22943,7 @@
     "traceIdLabel": "13181f1360728438",
     "transformType": "658b33acde44acb7",
     "turnOffLiveMode": "c3dfdea2b88d959c",
+    "turnOffQuickMode": "a8830cbebeaf7cea",
     "turnOnLiveMode": "bcefde79656f0abc",
     "unknownError": "27c2ccd962c2b8dc",
     "unknownErrorOccurred": "43c4deec555b4c7e",
@@ -22594,6 +22951,7 @@
     "updateSavedView": "f0e9e5ac3af3b640",
     "updateSavedViewConfirm": "165c5f6398bd57f9",
     "updateSavedViewWithCurrent": "9ec1d2751c4654c4",
+    "usageCostHistory": "b97c1a6d83f75800",
     "userDefinedSchemaLabel": "ad895e214ecd7872",
     "viewCreatedSuccessfully": "6a620ddf5d4013a9",
     "viewDeletedSuccessfully": "6cc6f04153415865",
@@ -22608,11 +22966,11 @@
     "webUrlNotConfigured": "da2e1df8a17952bc"
   },
   "search_history": {
-    "delayMessage": "33ba3ca60b3d278e",
+    "delayMessage": "b61c3cadbb0996d7",
     "executed_at": "5f3ff136b10e28d5",
     "get_history": "0cccb92604f6a427",
     "sql_query": "9a4f1370f2b72c82",
-    "title": "66d7e4a1c738f0b1"
+    "title": "b97c1a6d83f75800"
   },
   "search_scheduler_job": {
     "actions": "ff8059dc6752afdd",
@@ -22819,7 +23177,6 @@
       "addFieldTooltip": "4607cc8ee893f1fa",
       "addGroup": "94901258ed029f18",
       "addGroupTooltip": "a01adc7d7cacdae4",
-      "alertCorrelationTab": "b9b26f1bed14a1cb",
       "autoSuggestedBanner": "2854b4d3462748aa",
       "configureServicesHint": "0e2d04c7b30c6a3b",
       "customizeFieldMappings": "9aa6f419e1527cc3",
@@ -22939,28 +23296,6 @@
     "domainManagementDesc": "88398e3ac40ce4d7",
     "domainNeedsBlockedEmails": "53170f72948b23a8",
     "domainNeedsEmails": "c68d07b51aa28f5a",
-    "domainOrgMappings": {
-      "addMapping": "160cc87a108cd97f",
-      "baseRole": "33551d66efcd283e",
-      "baseRoleHelp": "50482be96fa489a0",
-      "confirmRemove": "09bf5961ed02c7ae",
-      "createMissingRoles": "469ee08dedc79c24",
-      "deleteTitle": "06380e0419eca2ef",
-      "domain": "f865f1ee55b26840",
-      "domainHelp": "c927b335c093577b",
-      "duplicateDomain": "197ff12f947386be",
-      "editMapping": "d5ef1883268e1264",
-      "empty": "df0e529517206088",
-      "organization": "d764d42592fc9687",
-      "organizationHelp": "783574eea65c82ad",
-      "organizationPlaceholder": "d7f6cb5385e83aca",
-      "organizationRequired": "7d12b1ae42d8cc36",
-      "roleClaimName": "ed8728fb5ccdde85",
-      "roleClaimNameHelp": "3247090d0155c3cb",
-      "roleClaimNamePlaceholder": "2fc659f8dd586eba",
-      "subtitle": "031a53b7414811e0",
-      "title": "ac852cfa9baf6fa9"
-    },
     "domainPlaceholder": "cc921aaa05754257",
     "domainRemoved": "2984d48362fadf0b",
     "domainRequired": "025f3d105c5c8f7c",
@@ -23107,6 +23442,7 @@
     "modelPricingList": {
       "subtitle": "511e0ecb589643d4"
     },
+    "noAllowedEmailsDenyAll": "2fe011dd2aebac32",
     "noDomainMessage": "6e3b65f95acec5dd",
     "noRecentErrors": "6e11fa6ce48a8831",
     "noTextAvailable": "aed109960ed9410e",
@@ -23122,6 +23458,145 @@
     },
     "notAllowedAction": "516e566b5d2c3fb6",
     "orgDesc": "4a1927826d0fa512",
+    "orgDomainMapping": {
+      "accessTab": "f8173cd6b94a1c2d",
+      "addMapping": "160cc87a108cd97f",
+      "alreadyLinked": "6ae3405ed1780f90",
+      "answeredBy": "1cbdadbedf5c01a5",
+      "approve": "6007acbe30b2cd98",
+      "approveBody": "b00d39614ef4322d",
+      "approveTitle": "366542c6d1f68b00",
+      "approvedLinkInfo": "b1cfd424b6a7445e",
+      "baseRole": "33551d66efcd283e",
+      "baseRoleHelp": "85a90ff83b26634c",
+      "block": "211d0bb8cf4f5b52",
+      "blockUsers": "38398e7642a68580",
+      "blockedCount": "194ba0dff38e03e3",
+      "blockedEmails": "34325ba4b11e09a4",
+      "blocklistDeleted": "e2fad69615931a95",
+      "blocklistDomainHelp": "5f3dbd2ee5132f73",
+      "blocklistEmailsHelp": "686ebe2ffc2bddc9",
+      "blocklistSaved": "eb876f029f0688fa",
+      "blocklistSection": "61d2a6f5d1a11c99",
+      "copyTxtName": "def0de935f302292",
+      "copyTxtValue": "569f923bc810a4cb",
+      "createMissingRoles": "469ee08dedc79c24",
+      "createsRoles": "12c02b1ee83f01dc",
+      "decisionFailed": "b4fc33bc42ac27d2",
+      "deleteMappingBody": "6a3206c520f864ab",
+      "deleteTitle": "45afe4152eb71013",
+      "deleted": "6abd8b1966fb2d45",
+      "details": "45989de49fb7f66d",
+      "detailsDialogTitle": "63acc3402811b23a",
+      "domain": "f865f1ee55b26840",
+      "domainHelp": "1be318ee4cb4e85e",
+      "domainHelpRequest": "edd3090574cd3cf4",
+      "domainNotVerified": "15133907259330da",
+      "domainRequired": "025f3d105c5c8f7c",
+      "duplicateMapping": "61dcad620b1e2340",
+      "editBlockedUsers": "ee186f1494ed6d9a",
+      "editMapping": "d5ef1883268e1264",
+      "enforceConfirmAction": "5a1f096a0d8d7674",
+      "enforceConfirmBody": "5acef29e5051a39d",
+      "enforceConfirmTitle": "2dccc6f1294e2267",
+      "enforceDesc": "4d5ef499aabc3eff",
+      "enforceSaved": "7e6799ca91bfa75f",
+      "enforceTitle": "49e1311912a28788",
+      "failureReason": {
+        "dnsFailed": "191653c1e32269f8",
+        "recordMissing": "44606b9b5761726f",
+        "valueMismatch": "8be355f637c38207"
+      },
+      "filterAll": "a52ace420f2175d0",
+      "filterPending": "331551b0de4157c9",
+      "goToLinked": "032b897355406970",
+      "goToLinkedDesc": "708f38e4fa11734e",
+      "keepRecordHint": "d48e2893e3f293ff",
+      "lastCheckFailed": "fb0953690ba3562b",
+      "lastChecked": "0c0c351a971353b5",
+      "linkDomain": "c296ce16414c87a7",
+      "linkFailed": "4f298906f73e8190",
+      "linkMethod": "bf44e5102a62aa62",
+      "linked": "61375bb06624de6a",
+      "linkedTab": "7b80e95841c5b918",
+      "linkedVia": "fe93da5acf84729f",
+      "loadFailed": "ff3241d73e3ed1e1",
+      "mappingDomainHelp": "9be86be6ff2a9ceb",
+      "mappingsTab": "f64ec16b0d88b0da",
+      "method": {
+        "approved": "e0aa737c9d31c98a",
+        "dns": "ebda700dd30bb4e5",
+        "dnsDesc": "90d12954ebf11f00",
+        "dnsTitle": "e831fa84f01eda8c",
+        "request": "9f1faa720fa12bc5",
+        "requestDesc": "eeed9a515bfa9c53",
+        "requestTitle": "58c5afe53ea21557"
+      },
+      "noDomainForBlocklist": "a28c7f62b38ab2f3",
+      "noVerifiedDomains": "4b2fbc7b41b4dbbb",
+      "notVerifiedYet": "86d22cfc659ee79a",
+      "organization": "d764d42592fc9687",
+      "organizationHelp": "103c714455e69979",
+      "organizationRequired": "7d12b1ae42d8cc36",
+      "pageSubtitle": "50fdfbf47a2b0743",
+      "pendingRequestInfo": "780463319de82427",
+      "reason": "f81ab834de5f8491",
+      "reasonHelp": "f846e8387152bb77",
+      "reasonRequired": "79f223934e006694",
+      "recordDialogTitle": "8aa73754d5a7ee28",
+      "recordInstructions": "4ca5d0b0f5b2c777",
+      "reject": "ab604a360777735f",
+      "rejectBody": "930940c39aa22759",
+      "rejectTitle": "20536d41e50d6fa7",
+      "rejectedRequestInfo": "80371f6d79594b87",
+      "removeBody": "4b6ebb95913dfb3e",
+      "removeDomain": "5ce435076ca12c56",
+      "removeTitle": "716dfac9ef62efb1",
+      "removeWithMappingsBody": "a81e80b80275a075",
+      "removed": "186cc53091ad1fd8",
+      "requestApproved": "fe79a279deff856a",
+      "requestFailed": "c6cdee5b0a95e612",
+      "requestRejected": "0fb6a196029117df",
+      "requestSent": "5b7f10f4000b2af2",
+      "requestedAt": "2d9e28289facab94",
+      "requestedBy": "9199a054972b1489",
+      "requestsTab": "635cd0e916595276",
+      "roleClaimName": "ed8728fb5ccdde85",
+      "roleClaimNameHelp": "cc0d33be97a5ae25",
+      "roleClaimNamePlaceholder": "2fc659f8dd586eba",
+      "ruleBlockedRequired": "cb376d7e54530b2a",
+      "saveFailed": "4924972f958737c6",
+      "saved": "e0bc9ee67876b410",
+      "searchDomains": "df3b2794a7b1fe92",
+      "searchMappings": "0076316b776d02c6",
+      "searchRequests": "4132cecef4287500",
+      "sendRequest": "3a69f897298e727e",
+      "state": {
+        "approved": "87b42e40c2a290e0",
+        "failed": "031a8f0f659df890",
+        "pending": "331551b0de4157c9",
+        "rejected": "aea4a04a80426ed8",
+        "requested": "ae25c9b1d366d159",
+        "verified": "4f7838402f37674e"
+      },
+      "status": "920e413c7d411b61",
+      "tabDesc": "50fdfbf47a2b0743",
+      "tabLabel": "91537c30fffb01dc",
+      "txtNameCopied": "b353561fcad08b44",
+      "txtNameLabel": "e3f134323855ff3a",
+      "txtValueCopied": "c8dcad93b2b0d76f",
+      "txtValueLabel": "f7b42a22b9cedbfa",
+      "unblockAll": "1aec444ddd5eb456",
+      "unblockAllBody": "79b40d4f58e76828",
+      "unblockAllTitle": "3c8499510ce80365",
+      "unlinkFailed": "beae9c59b2f9f019",
+      "verified": "08e0df6712bb45ef",
+      "verifiedAt": "4f7838402f37674e",
+      "verifyDialogTitle": "91e82537dcacc7c5",
+      "verifyFailed": "f0f2383f8af8d23d",
+      "verifyHint": "32281a270a11f2f9",
+      "verifyNow": "db383efba6aef9d9"
+    },
     "orgLabel": "c12331aa1a61f587",
     "orgStorageEditor": {
       "accessKeyLabel": "176f1c109e28fa68",
@@ -23433,7 +23908,7 @@
       "logsRowOpen": "4e62957ded0d0dd0",
       "logsRunQuery": "0b9252e840f32989",
       "logsSaveView": "af29df0f9ca1446c",
-      "logsSearchHistory": "145dd6f1992eb214",
+      "logsSearchHistory": "8962685dd0fd843e",
       "logsToggleHistogram": "bebe67d66ebc5b81",
       "logsToggleSidebar": "9cf94e5f212e1985",
       "metricsAddToDashboard": "81c5e9c7bb53cc85",
@@ -23573,7 +24048,7 @@
       "runningQueries": "a026d17f06f54cec",
       "scoreConfigs": "c3c78db2263139e4",
       "scorers": "966ddbb027958248",
-      "searchHistory": "66d7e4a1c738f0b1",
+      "searchHistory": "b97c1a6d83f75800",
       "searchSchedulers": "047df1ad4dee93bc",
       "sessions": "6fa3cbf451b2a1d5",
       "sourceMaps": "74e923a5b4614cf6",
@@ -25148,6 +25623,7 @@
       "durationFast": "cfd210c0d957d454",
       "durationMid": "6a8fa448ca025881",
       "durationSlow": "03e0b960ac4d0d17",
+      "error": "54a0e8c17ebb21a1",
       "failed": "031a8f0f659df890",
       "passed": "436fe71bb9561f05",
       "warning": "e981ddae45d8f4ca"
@@ -25692,11 +26168,13 @@
         "back": "7e411e6d1fb73865",
         "checkName": "dcd1d5223f73b3a9",
         "checksTitle": "10014025dca36813",
+        "loadFailed": "0715f69c63f61005",
         "noAgents": "53f30015179ba65a",
         "noChecks": "3709b844e6f621e3",
         "notFound": "8df056a568a44b88",
         "pool": "f13024272c385f73",
         "restartConfig": "39cd3ae99887b0c9",
+        "retry": "942087cc2d41e013",
         "title": "57d84785ba9c4e19",
         "version": "dd167905de0defca"
       },
@@ -25919,6 +26397,10 @@
       "attempts": "06e70139fcf5e5c7",
       "detailAction": "64cff1319d2fd2cb",
       "detailSelector": "f02a172a35354ca2",
+      "detailSkipReason": "52bbd7b4a76b81ed",
+      "detailStatus": "920e413c7d411b61",
+      "detailStepId": "22e1beecfe5cf990",
+      "detailTargetUrl": "5b341c960fb7166e",
       "detailUrl": "e7a241debad56609",
       "downloadTrace": "0d79fab080c1efe2",
       "errorFullscreenTitle": "024c4be2f89daed1",
@@ -25963,8 +26445,11 @@
       "settleStaleNote": "0aee2b4a2b2be6a0",
       "showFullError": "4450d34301ab8d70",
       "showLess": "94ea9b1d33a02975",
+      "skippedCount": "28541aa9135d134e",
       "startLoadLabel": "db96939121284345",
       "stepOf": "9bd8548d86fd91f5",
+      "stepStatusSkipped": "12698ce1ea5cd4ab",
+      "stepStatusUnknown": "b764cdc0eab71374",
       "stepsCount": "6e336a2b2b738463",
       "title": "95ccb018c85dce04",
       "viewFullError": "e0fcf523d4155c70",
@@ -26069,7 +26554,7 @@
       "retriesOnFailure": "a2e021cdc7d91dbd",
       "retriesOnFailureSuffix": "ad5f0c777a2b470f",
       "retryDelay": "bbbdc7fae12b28e4",
-      "retryDelaySuffix": "48e77c7c4e24e2f4",
+      "retryDelaySuffix": "a2f9474ace454f9a",
       "schedule": "f4830a1dae298044",
       "scheduleLater": "058e3d9d22f8df88",
       "scheduleLaterTooltip": "946c56014f45896f",
@@ -26457,7 +26942,6 @@
       "aiAnalysisIsAlreadyRunningFor": "cff089f517a5afd5",
       "alertClonedSuccessfully": "93729e0e45c2f03b",
       "alertNotFound": "1cb1c54427acf236",
-      "alertNotFoundInAlerts": "8032bd1c0b1f7207",
       "alertPausedSuccessfully": "4bbb140b6866b255",
       "alertResumedSuccessfully": "83e2bd8646284c49",
       "alertSavedSuccessfully": "797986766aad6827",
@@ -26507,7 +26991,6 @@
       "noAlertsToPause": "e38354226ff0921c",
       "noAlertsToResume": "f8190fba75eb0c63",
       "noDestinationsSelectedForDeletion": "6f3d55af7be19703",
-      "openingDedupConfig": "8c2139ac0be96855",
       "pausingAlerts": "22bcfb597fcc0141",
       "pleaseSelectStreamName": "b7888dff292770a1",
       "pleaseSelectStreamType": "8dc36f136ae1dc78",
@@ -27604,13 +28087,17 @@
     "actions": "ff8059dc6752afdd",
     "add": "6384ffa7712cb2d5",
     "authType": "8eb3ea9bbde63159",
+    "block": "211d0bb8cf4f5b52",
     "cancel": "19766ed6ccb2f4a3",
     "changePassword": "a949f46230748d3f",
+    "confirmBlockHead": "e761ae1549da54aa",
+    "confirmBlockMsg": "90a9f36f481f86ee",
     "confirmDeleteHead": "4e920cc9cc7cd6e1",
     "confirmDeleteMsg": "3afa72b6b4978bf9",
     "currentPasswordRequired": "5000b74e76ec8b67",
     "customRole": "6e8453849bf2d267",
     "delete": "e2d0a54968ead24e",
+    "deleteUsersBlockNote": "783ff61096dbb22c",
     "deleteUsersMsg": "ce952715001e5703",
     "deleteUsersTitle": "329abf36a8bd020d",
     "description": "526e0087cc3f254d",
diff --git a/src/api/common/src/auth/jwt.rs b/src/api/common/src/auth/jwt.rs
index 3b1386026d..1693e11c1b 100644
--- a/src/api/common/src/auth/jwt.rs
+++ b/src/api/common/src/auth/jwt.rs
@@ -13,11 +13,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-#[cfg(feature = "cloud")]
-use openobserve_core::{
-    organization::list_org_users_by_user,
-    self_reporting::cloud_events::{CloudEvent, EventType, enqueue_cloud_event},
-};
 #[cfg(all(feature = "enterprise", not(feature = "cloud")))]
 use {
     crate::common::meta::user::RoleOrg,
@@ -36,6 +31,25 @@ use {
     std::collections::HashMap,
     std::sync::LazyLock as Lazy,
 };
+#[cfg(feature = "cloud")]
+use {
+    config::get_config,
+    config::{DEFAULT_ORG, meta::user::UserRole, utils::rand::generate_random_string},
+    db::org_status,
+    db::{org_users, organization::get_org_setting},
+    o2_enterprise::enterprise::cloud::org_invites,
+    o2_enterprise::enterprise::{cloud::billing_group, domain_management::meta::AccessDecision},
+    o2_openfga::authorizer::authz::get_add_user_to_org_tuples,
+    o2_openfga::authorizer::roles::{
+        check_and_get_crole_tuple_for_new_user, get_roles_for_org_user,
+        get_user_crole_removal_tuples,
+    },
+    openobserve_core::org_domain_ownership::get_cached_org_for_domain,
+    openobserve_core::organization::list_org_users_by_user,
+    openobserve_core::self_reporting::cloud_events::{CloudEvent, EventType, enqueue_cloud_event},
+    openobserve_core::users,
+    std::{collections::HashSet, str::FromStr as _},
+};
 #[cfg(all(feature = "enterprise", not(feature = "cloud")))]
 use {
     config::meta::user::{UserOrg, UserRole},
@@ -45,19 +59,6 @@ use {
     },
     std::str::FromStr,
 };
-#[cfg(feature = "cloud")]
-use {
-    config::{DEFAULT_ORG, META_ORG_ID, meta::user::UserRole, utils::rand::generate_random_string},
-    db::org_status,
-    db::{org_users, organization::get_org_setting},
-    o2_enterprise::enterprise::cloud::org_invites,
-    o2_openfga::authorizer::authz::get_add_user_to_org_tuples,
-    o2_openfga::authorizer::roles::{
-        check_and_get_crole_tuple_for_new_user, get_roles_for_org_user,
-        get_user_crole_removal_tuples,
-    },
-    std::{collections::HashSet, str::FromStr as _},
-};
 
 #[cfg(feature = "cloud")]
 use crate::common::meta::{
@@ -124,9 +125,9 @@ pub async fn process_token(
         let mut custom_roles: Vec<String> = vec![];
         let mut tuples_to_add = HashMap::new();
 
-        // Try custom claim parsing first
+        // Try custom claim parsing first, always from _meta
         if let Some((parsed_orgs, parsed_roles)) =
-            process_custom_claim_parsing(&dec_token.claims).await
+            process_custom_claim_parsing(&dec_token.claims, "_meta").await
         {
             log::info!(
                 "Using custom claim parsing results: {} orgs, {} custom roles",
@@ -879,141 +880,262 @@ pub async fn process_domain_org_mapping(
     claims: HashMap<String, Value>,
     is_new_user: bool,
 ) -> Result<bool, anyhow::Error> {
-    let meta_settings = get_org_setting(META_ORG_ID).await?;
-    let mappings = meta_settings.domain_org_mappings;
     // split email to get the domain
-    if let Some((_, domain)) = user_email.to_lowercase().split_once("@") {
-        if let Some(mapped) = mappings
-            .into_iter()
-            .find(|m| m.domain.to_lowercase() == domain)
-        {
-            match org_status::read_active(&mapped.org_id).await {
-                Ok(true) => {}
-                Ok(false) => {
-                    log::warn!(
-                        "domain org mapping for user {user_email} points at inactive org {}, skipping",
-                        mapped.org_id
-                    );
-                    return Ok(false);
+    let Some((_, domain)) = user_email.split_once("@") else {
+        log::warn!(
+            "user email {user_email} could not be split correctly at @, skipping org domain mapping"
+        );
+        return Ok(false);
+    };
+    let domain = domain.trim().to_lowercase();
+
+    let Some(org_id) = get_cached_org_for_domain(&domain).await else {
+        log::info!("no cached domain org mapping found for user {user_email}, continuing normally");
+        return Ok(false);
+    };
+
+    let org_settings = get_org_setting(&org_id).await?;
+    let mappings = org_settings.domain_org_mappings;
+
+    let mut allowed_orgs: HashSet<_> = billing_group::list_billing_group_members_of(&org_id)
+        .await?
+        .into_iter()
+        .map(|v| v.member_org_id)
+        .collect();
+    allowed_orgs.insert(org_id.clone());
+
+    let decision = org_settings.domain_management_config.evaluate(user_email);
+    if matches!(decision, AccessDecision::Deny) {
+        if is_new_user {
+            // for new user who is blocked via domain, we return false, so
+            // the normal flow can take place
+            return Ok(false);
+        }
+        let orgs = org_users::list_orgs_by_user(user_email).await?;
+        let mut orgs_to_remove = Vec::new();
+        for org in orgs {
+            if allowed_orgs.contains(&org.org_id) {
+                orgs_to_remove.push(org.org_id);
+            }
+        }
+
+        for org in orgs_to_remove {
+            match users::remove_user_from_org(
+                &org,
+                &user_email,
+                &get_config().auth.root_user_email,
+                users::RemovalTarget::User,
+            )
+            .await
+            {
+                Ok(v) => {
+                    if !v.status().is_success() {
+                        log::error!(
+                            "error user {user_email} was blocked from org {org_id}, but failed to remove from org {org} with status : {}",
+                            v.status().as_str()
+                        );
+                    }
                 }
                 Err(e) => {
-                    log::warn!(
-                        "domain org mapping for user {user_email}: cannot read the status of org {}, skipping: {e}",
-                        mapped.org_id
+                    log::error!(
+                        "error user {user_email} was blocked from org {org_id}, but failed to remove from org {org} : {e}"
                     );
-                    return Ok(false);
                 }
             }
+        }
 
-            log::info!("found domain org mapping for user {user_email}, processing");
-            let base_role = UserRole::from_str(&mapped.base_role).map_err(|e| {
-                anyhow::anyhow!(
-                    "error parsing domain org role {} to user role : {e:?}",
-                    mapped.base_role
-                )
-            })?;
+        log::info!("user {user_email} blocked by domain management config of org {org_id}");
+        return Ok(true);
+    }
 
-            let need_to_add_user = org_users::get_optional(&mapped.org_id, user_email)
-                .await?
-                .is_none();
+    let mapped_orgs: Vec<_> = mappings
+        .into_iter()
+        .filter(|m| m.domain.to_lowercase() == domain && allowed_orgs.contains(&m.org_id))
+        .collect();
 
-            if is_new_user || need_to_add_user {
-                let mut new_tuples = Vec::new();
-                get_add_user_to_org_tuples(
-                    &mapped.org_id,
-                    user_email,
-                    &mapped.base_role,
-                    &mut new_tuples,
+    if mapped_orgs.is_empty() {
+        log::info!(
+            "domain {domain} is owned by {org_id} but no mapping found, processing user {user_email} normally"
+        );
+        return Ok(false);
+    }
+
+    let mut added = 0;
+
+    for mapped in mapped_orgs {
+        match org_status::read_active(&mapped.org_id).await {
+            Ok(true) => {}
+            Ok(false) => {
+                log::warn!(
+                    "domain org mapping for user {user_email} points at inactive org {}, skipping",
+                    mapped.org_id
                 );
-                update_tuples(new_tuples, vec![]).await?;
-                org_users::add(
-                    &mapped.org_id,
-                    user_email,
-                    base_role,
-                    &generate_random_string(16),
-                    Some(format!("rum{}", generate_random_string(16))),
-                )
-                .await?;
+                continue;
             }
-            if let Some(claim_name) = mapped.role_claim_name
-                && let Some(v) = claims.get(&claim_name)
-                && let Some(arr) = v.as_array()
-            {
-                let mut roles = HashSet::new();
-                for claim in arr {
-                    if let Some(role) = claim.as_str() {
-                        roles.insert(format_role_name_only(role));
-                    }
-                }
-                let existing_roles = get_roles_for_org_user(&mapped.org_id, user_email).await;
+            Err(e) => {
+                log::warn!(
+                    "domain org mapping for user {user_email}: cannot read the status of org {}, skipping: {e}",
+                    mapped.org_id
+                );
+                continue;
+            }
+        }
 
-                let mut add_roles = Vec::new();
-                let mut add_tuples = Vec::new();
-                let mut remove_tuples = Vec::new();
+        if org_status::is_blocked(&mapped.org_id) {
+            log::info!(
+                "user {user_email} supposed to be mapped to org {} but org status is blocked, so skipping",
+                mapped.org_id
+            );
+            continue;
+        }
+        log::info!(
+            "found domain org mapping {} for user {user_email}, processing",
+            mapped.org_id
+        );
+        let base_role = UserRole::from_str(&mapped.base_role).map_err(|e| {
+            anyhow::anyhow!(
+                "error parsing domain org role {} to user role : {e:?}",
+                mapped.base_role
+            )
+        })?;
 
-                for role in &existing_roles {
-                    if !roles.contains(role) {
-                        let name = format_role_name(&mapped.org_id, role);
-                        get_user_crole_removal_tuples(user_email, &name, &mut remove_tuples);
-                    }
-                }
-                for role in &roles {
-                    if !existing_roles.contains(role) {
-                        add_roles.push(format_role_name(&mapped.org_id, role))
-                    }
-                }
-                if !add_roles.is_empty() {
-                    check_and_get_crole_tuple_for_new_user(
-                        user_email,
-                        &mapped.org_id,
-                        add_roles,
-                        mapped.create_missing_roles,
-                        &mut add_tuples,
-                    )
-                    .await;
-                }
+        let need_to_add_user = org_users::get_optional(&mapped.org_id, user_email)
+            .await?
+            .is_none();
 
-                if (!add_tuples.is_empty() || !remove_tuples.is_empty())
-                    && let Err(e) = update_tuples(add_tuples, remove_tuples).await
-                {
+        if is_new_user || need_to_add_user {
+            let mut new_tuples = Vec::new();
+            get_add_user_to_org_tuples(
+                &mapped.org_id,
+                user_email,
+                &mapped.base_role,
+                &mut new_tuples,
+            );
+            update_tuples(new_tuples, vec![]).await?;
+            org_users::add(
+                &mapped.org_id,
+                user_email,
+                base_role,
+                &generate_random_string(16),
+                Some(format!("rum{}", generate_random_string(16))),
+            )
+            .await?;
+        }
+        if let Some(claim_name) = mapped.role_claim_name
+            && let Some(v) = claims.get(&claim_name)
+            && let Some(arr) = v.as_array()
+        {
+            let mut roles = HashSet::new();
+            for claim in arr {
+                if let Some(role) = claim.as_str() {
+                    roles.insert(format_role_name_only(role));
+                }
+            }
+            let existing_roles = get_roles_for_org_user(&mapped.org_id, user_email).await;
+
+            let mut add_roles = Vec::new();
+            let mut add_tuples = Vec::new();
+            let mut remove_tuples = Vec::new();
+
+            for role in &existing_roles {
+                if !roles.contains(role) {
+                    let name = format_role_name(&mapped.org_id, role);
+                    get_user_crole_removal_tuples(user_email, &name, &mut remove_tuples);
+                }
+            }
+            for role in &roles {
+                if !existing_roles.contains(role) {
+                    add_roles.push(format_role_name(&mapped.org_id, role))
+                }
+            }
+            if !add_roles.is_empty() {
+                check_and_get_crole_tuple_for_new_user(
+                    user_email,
+                    &mapped.org_id,
+                    add_roles,
+                    mapped.create_missing_roles,
+                    &mut add_tuples,
+                )
+                .await;
+            }
+
+            if !add_tuples.is_empty() || !remove_tuples.is_empty() {
+                if let Err(e) = update_tuples(add_tuples, remove_tuples).await {
                     log::error!(
                         "error updating claim based role tuples for user {user_email} org {} : {e}",
                         mapped.org_id
                     );
                 }
             }
-
+        }
+        log::info!(
+            "user {user_email} mapped to org {} successfully via domain org mapping",
+            mapped.org_id
+        );
+        if need_to_add_user {
             log::info!(
-                "user {user_email} mapped to org {} successfully via domain org mapping",
+                "deleting any invites for {user_email} in org {} as added via org mapping",
                 mapped.org_id
             );
-            if need_to_add_user {
-                log::info!(
-                    "deleting any invites for {user_email} in org {} as added via org mapping",
+            if let Err(e) =
+                org_invites::delete_invites_for_user(&mapped.org_id, &user_email.to_lowercase())
+                    .await
+            {
+                log::error!(
+                    "error in deleting invites for user {user_email} for org {} after joining via domain mapping : {e}",
                     mapped.org_id
                 );
-                if let Err(e) =
-                    org_invites::delete_invites_for_user(&mapped.org_id, &user_email.to_lowercase())
-                        .await
-                {
-                    log::error!(
-                        "error in deleting invites for user {user_email} for org {} after joining via domain mapping : {e}",
-                        mapped.org_id
-                    );
-                }
             }
-            log::info!("domain org mapping for user {user_email} successfully processed");
-            Ok(true)
-        } else {
-            log::info!("no domain org mapping found for user {user_email}, continuing normally");
-            Ok(false)
         }
-    } else {
-        log::warn!(
-            "user email {user_email} could not be split correctly at @, skipping org domain mapping"
-        );
-        Ok(false)
+        added += 1;
     }
+
+    let mut removed = 0;
+    // if added = 0, it means no viable orgs were there for mapping,
+    // so removing the user would just keep recreating new orgs at each login
+    if org_settings.enforce_allowed_orgs_only && !is_new_user && added > 0 {
+        let orgs = org_users::list_orgs_by_user(user_email).await?;
+        let mut orgs_to_remove = Vec::new();
+        for org in orgs {
+            if !allowed_orgs.contains(&org.org_id) {
+                orgs_to_remove.push(org.org_id);
+            }
+        }
+
+        removed = orgs_to_remove.len();
+        for org in orgs_to_remove {
+            match users::remove_user_from_org(
+                &org,
+                &user_email,
+                &get_config().auth.root_user_email,
+                users::RemovalTarget::User,
+            )
+            .await
+            {
+                Ok(v) => {
+                    if !v.status().is_success() {
+                        log::error!(
+                            "error user {user_email} was domain mapped from org {org_id}, but failed to remove from extra org {org} with status : {}",
+                            v.status().as_str()
+                        );
+                    }
+                }
+                Err(e) => log::error!(
+                    "error user {user_email} was domain mapped from org {org_id}, but failed to remove from extra org {org} : {e}"
+                ),
+            }
+        }
+    }
+
+    if added == 0 && removed == 0 {
+        log::info!(
+            "no mapped orgs were viable, so skipped processing domain mapping for user {user_email} from org {org_id}"
+        );
+        return Ok(false);
+    }
+
+    log::info!("domain org mapping for user {user_email} successfully processed");
+    Ok(true)
 }
 
 #[cfg(feature = "cloud")]
@@ -1040,8 +1162,8 @@ pub async fn check_and_add_to_org(
             vec![]
         }
     };
-    let pending_invites = pending_invites
-        .into_iter()
+    let mut has_pending_invites = pending_invites
+        .iter()
         .any(|invite| invite.status == OrgInviteStatus::Pending && invite.expires_at > now);
     if db_user.is_none() {
         is_new_user = true;
@@ -1069,7 +1191,7 @@ pub async fn check_and_add_to_org(
             }
             Err(e) => {
                 log::error!("Error adding user to the database: {}", e);
-                return Ok((is_new_user, pending_invites));
+                return Ok((is_new_user, has_pending_invites));
             }
         }
     }
@@ -1078,8 +1200,48 @@ pub async fn check_and_add_to_org(
     match process_domain_org_mapping(user_email, claims, is_new_user).await {
         Ok(processed) => {
             if processed {
-                // domain based adding is done, so do not treat as a new user
-                return Ok((false, pending_invites));
+                let user_record = db::user::get_user_by_email(user_email).await;
+                if user_record.is_none() {
+                    is_new_user = true;
+                    has_pending_invites = false;
+                    match create_new_user(DBUser {
+                        email: user_email.to_owned(),
+                        first_name: first_name.to_owned(),
+                        last_name: last_name.to_owned(),
+                        password: "".to_owned(),
+                        salt: "".to_owned(),
+                        organizations: vec![], // No org
+                        is_external: true,
+                        password_ext: Some("".to_owned()),
+                    })
+                    .await
+                    {
+                        Ok(_) => {
+                            let mut tuples = vec![];
+                            get_new_user_creation_tuple(user_email, &mut tuples);
+                            tuples_to_add.insert(user_email.to_string(), tuples);
+                            log::info!("User added to the database");
+                        }
+                        Err(e) => {
+                            log::error!(
+                                "Error adding user to the database after domain mapping: {}",
+                                e
+                            );
+                            return Ok((is_new_user, has_pending_invites));
+                        }
+                    }
+                } else {
+                    // domain based adding is done, so do not treat as a new user
+                    let orgs = org_users::list_orgs_by_user(user_email).await?;
+                    if orgs.is_empty() {
+                        is_new_user = true;
+                        has_pending_invites = pending_invites.iter().any(|invite| {
+                            invite.status == OrgInviteStatus::Pending && invite.expires_at > now
+                        });
+                    } else {
+                        return Ok((false, has_pending_invites));
+                    }
+                }
             }
         }
         Err(e) => log::error!(
@@ -1108,8 +1270,8 @@ pub async fn check_and_add_to_org(
             existing_orgs[0].role.to_string(),
         ),
         // if there are some pending invites, we do not want to create any orgs for the user
-        _ if pending_invites => {
-            return Ok((is_new_user, pending_invites));
+        _ if has_pending_invites => {
+            return Ok((is_new_user, has_pending_invites));
         }
         _ => {
             // Create a default org for the user
@@ -1209,7 +1371,7 @@ pub async fn check_and_add_to_org(
             .await;
     }
 
-    Ok((is_new_user, pending_invites))
+    Ok((is_new_user, has_pending_invites))
 }
 
 /// Process custom claim parsing and populate source_orgs and custom_roles
@@ -1219,6 +1381,7 @@ pub async fn check_and_add_to_org(
 #[cfg(all(feature = "enterprise", not(feature = "cloud")))]
 async fn process_custom_claim_parsing(
     claims: &HashMap<String, Value>,
+    org_id: &str,
 ) -> Option<(Vec<UserOrg>, Vec<String>)> {
     use o2_openfga::config::get_config as get_openfga_config;
 
@@ -1234,8 +1397,9 @@ async fn process_custom_claim_parsing(
 
     // Prepare callback functions for claim parser
     let iam_settings_fn = || {
-        Box::pin(async {
-            match db::organization::get_org_setting("_meta").await {
+        let org_id = org_id.to_owned();
+        Box::pin(async move {
+            match db::organization::get_org_setting(&org_id).await {
                 Ok(settings) => settings.claim_parser_function,
                 Err(_) => "claim_parser".to_string(),
             }
@@ -1257,11 +1421,12 @@ async fn process_custom_claim_parsing(
 
     let function_loader_fn = |function_name: &str| {
         let function_name = function_name.to_string();
+        let org_id = org_id.to_owned();
         Box::pin(async move {
-            match db::functions::get("_meta", &function_name).await {
+            match db::functions::get(&org_id, &function_name).await {
                 Ok(func) => Ok(func), // Return full Transform object with trans_type
                 Err(e) => Err(anyhow::anyhow!(
-                    "Failed to load function '{}' from _meta org: {}",
+                    "Failed to load function '{}' from {org_id} org: {}",
                     function_name,
                     e
                 )),
@@ -1279,7 +1444,7 @@ async fn process_custom_claim_parsing(
     // Use String as compiled program type for Send compatibility
     let vrl_compile_fn = |function_content: &str| -> Result<String, anyhow::Error> {
         // Just validate that it compiles, but return the source for execution
-        transform::compile_vrl_function(function_content, "_meta")
+        transform::compile_vrl_function(function_content, org_id)
             .map_err(|e| anyhow::anyhow!("VRL compilation failed: {}", e))?;
         Ok(function_content.to_string())
     };
@@ -1289,7 +1454,7 @@ async fn process_custom_claim_parsing(
             use vrl::compiler::{TargetValue, runtime::Runtime};
 
             // Compile the VRL function
-            let vrl_config = transform::compile_vrl_function(function_content, "_meta")
+            let vrl_config = transform::compile_vrl_function(function_content, org_id)
                 .map_err(|e| anyhow::anyhow!("VRL compilation failed: {}", e))?;
 
             let mut runtime = Runtime::default();
@@ -1319,12 +1484,12 @@ async fn process_custom_claim_parsing(
 
     let js_execute_fn = |function_content: &str, claims: Value| -> Result<Value, anyhow::Error> {
         // Compile the JavaScript function
-        let js_config = transform::js::compile_js_function(function_content, "_meta")
+        let js_config = transform::js::compile_js_function(function_content, org_id)
             .map_err(|e| anyhow::anyhow!("JavaScript compilation failed: {}", e))?;
 
         // Execute JavaScript with claims as input
         let (result, error) =
-            transform::js::apply_js_fn(&js_config, claims, "_meta", &[String::new()]);
+            transform::js::apply_js_fn(&js_config, claims, org_id, &[String::new()]);
 
         if let Some(err) = error {
             return Err(anyhow::anyhow!("JavaScript execution failed: {}", err));
diff --git a/src/api/http/Cargo.toml b/src/api/http/Cargo.toml
index 4291696ccb..4e4f761924 100644
--- a/src/api/http/Cargo.toml
+++ b/src/api/http/Cargo.toml
@@ -42,7 +42,8 @@ vectorscan = [
     "openobserve-core/vectorscan",
     "stream/vectorscan",
 ]
-profiling = ["openobserve-api-management/profiling"]
+cpu-profiling = ["openobserve-api-management/cpu-profiling"]
+profiling = ["cpu-profiling", "openobserve-api-management/profiling"]
 
 [dependencies]
 common.workspace = true
diff --git a/src/api/http/src/handler/http/router/mod.rs b/src/api/http/src/handler/http/router/mod.rs
index b6e203df29..41bfdafb56 100644
--- a/src/api/http/src/handler/http/router/mod.rs
+++ b/src/api/http/src/handler/http/router/mod.rs
@@ -26,7 +26,9 @@ use axum::{
 use config::get_config;
 use openobserve_api_common::{X_O2_ASSISTANT_SESSION_ID, X_O2_ASSISTANT_TURN_ID};
 use openobserve_api_ingest::request::{clusters, logs, metrics, profiles, rum};
-#[cfg(feature = "profiling")]
+#[cfg(feature = "cloud")]
+use openobserve_api_management::request::org_domains;
+#[cfg(feature = "cpu-profiling")]
 use openobserve_api_management::request::profiling;
 use openobserve_api_management::request::{
     alerts, announcements, authz, dashboards, db_monitoring, downtimes, folders, ingest_rejections,
@@ -952,12 +954,14 @@ pub fn basic_routes() -> Router {
     router = router.nest("/node", node_routes);
 
     // Debug/profiling routes with auth
-    #[cfg(feature = "profiling")]
+    #[cfg(feature = "cpu-profiling")]
     {
-        let debug_routes = Router::new()
+        let debug_routes = Router::new().route("/profile/cpu", get(profiling::cpu_profile));
+        #[cfg(feature = "profiling")]
+        let debug_routes = debug_routes
             .route("/profile/memory", get(profiling::memory_profile))
-            .route("/profile/stats", get(profiling::jemalloc_stats))
-            .route("/profile/cpu", get(profiling::cpu_profile))
+            .route("/profile/stats", get(profiling::jemalloc_stats));
+        let debug_routes = debug_routes
             .layer(middleware::from_fn(password_policy_middleware))
             .layer(middleware::from_fn(auth_middleware));
 
@@ -1376,7 +1380,7 @@ pub fn service_routes() -> Router {
         .route("/{org_id}/savedviews", get(search::saved_view::get_views).post(search::saved_view::create_view))
         .route("/{org_id}/savedviews/{view_id}", get(search::saved_view::get_view).put(search::saved_view::update_view).delete(search::saved_view::delete_view))
 
-        .route("/{org_id}/query_history", get(query_history::list).post(query_history::record).layer(DefaultBodyLimit::max(query_history::MAX_BODY_BYTES)))
+        .route("/{org_id}/query_history", get(query_history::list).post(query_history::record).delete(query_history::clear).layer(DefaultBodyLimit::max(query_history::MAX_BODY_BYTES)))
         .route("/{org_id}/query_history/{id}", patch(query_history::star).delete(query_history::delete).layer(DefaultBodyLimit::max(query_history::MAX_BODY_BYTES)))
 
         // Functions
@@ -2171,6 +2175,18 @@ pub fn service_routes() -> Router {
                 get(billing_group::check_membership).delete(billing_group::leave_group),
             )
             .route("/{org_id}/billing_group/members", get(billing_group::check_members))
+            .route(
+                "/{org_id}/settings/domains",
+                get(org_domains::get_linked_domain).post(org_domains::link_domain)
+            )
+            .route("/{org_id}/settings/domains/requests",post(org_domains::raise_request).get(org_domains::list_requests))
+            .route("/{org_id}/settings/domain/request/{id}/approve",post(org_domains::approve_request))
+            .route("/{org_id}/settings/domain/request/{id}/reject",post(org_domains::reject_request))
+            .route("/{org_id}/settings/domains/{domain}",delete(org_domains::delete_linked_domain))
+            .route(
+                "/{org_id}/settings/domains/verify/{domain}",
+                post(org_domains::verify_domain),
+            )
             .route(
                 "/{org_id}/billing_group/members/{member_org_id}",
                 delete(billing_group::remove_member),
@@ -4356,6 +4372,29 @@ mod tests {
         );
     }
 
+    #[test]
+    fn query_history_list_publishes_both_response_shapes() {
+        let spec = serde_json::to_value(super::openapi::ApiDoc::openapi()).unwrap();
+        let ok = &spec["paths"]["/api/{org_id}/query_history"]["get"]["responses"]["200"];
+        assert_eq!(
+            ok["content"]["application/json"]["schema"]["$ref"],
+            "#/components/schemas/QueryHistoryListResponse"
+        );
+        let shapes = spec["components"]["schemas"]["QueryHistoryListResponse"]["oneOf"]
+            .as_array()
+            .expect("the list response is a oneOf");
+        let shapes = serde_json::to_string(shapes).unwrap();
+        assert!(
+            shapes.contains("#/components/schemas/QueryHistoryEntry"),
+            "{shapes}"
+        );
+        assert!(shapes.contains("\"type\":\"array\""), "{shapes}");
+        assert!(
+            shapes.contains("#/components/schemas/QueryHistoryCountResponse"),
+            "{shapes}"
+        );
+    }
+
     #[cfg(feature = "enterprise")]
     #[test]
     fn experiment_lifecycle_actions_are_published_in_the_openapi_surface() {
diff --git a/src/api/http/src/handler/http/router/openapi.rs b/src/api/http/src/handler/http/router/openapi.rs
index 25cdcfed5e..4795c10455 100644
--- a/src/api/http/src/handler/http/router/openapi.rs
+++ b/src/api/http/src/handler/http/router/openapi.rs
@@ -120,6 +120,7 @@ use crate::{
         openobserve_api_search::search::saved_view::update_view,
         openobserve_api_management::request::query_history::record,
         openobserve_api_management::request::query_history::list,
+        openobserve_api_management::request::query_history::clear,
         openobserve_api_management::request::query_history::star,
         openobserve_api_management::request::query_history::delete,
         openobserve_api_management::request::folders::delete_folder,
@@ -698,6 +699,9 @@ use crate::{
             openobserve_api_management::request::query_history::QueryHistoryRequest,
             openobserve_api_management::request::query_history::QueryHistoryStarRequest,
             openobserve_api_management::request::query_history::QueryHistoryEntry,
+            openobserve_api_management::request::query_history::QueryHistoryCountResponse,
+            openobserve_api_management::request::query_history::QueryHistoryListResponse,
+            openobserve_api_management::request::query_history::QueryHistoryClearResponse,
             meta::user::UpdateUser,
             meta::user::UserRoleRequest,
             meta::user::PostUserRequest,
@@ -1618,6 +1622,7 @@ mod tests {
         for (path, method) in [
             ("/api/{org_id}/query_history", "post"),
             ("/api/{org_id}/query_history", "get"),
+            ("/api/{org_id}/query_history", "delete"),
             ("/api/{org_id}/query_history/{id}", "patch"),
             ("/api/{org_id}/query_history/{id}", "delete"),
         ] {
diff --git a/src/api/management/Cargo.toml b/src/api/management/Cargo.toml
index 59729546bf..6f2c87107a 100644
--- a/src/api/management/Cargo.toml
+++ b/src/api/management/Cargo.toml
@@ -42,7 +42,8 @@ vectorscan = [
     "search_service/vectorscan",
     "stream/vectorscan",
 ]
-profiling = ["openobserve-core/profiling"]
+cpu-profiling = ["openobserve-core/cpu-profiling"]
+profiling = ["cpu-profiling", "openobserve-core/profiling"]
 
 [dependencies]
 anyhow.workspace = true
diff --git a/src/api/management/src/models/alerts/mod.rs b/src/api/management/src/models/alerts/mod.rs
index 3dc0c2a989..0895929e88 100644
--- a/src/api/management/src/models/alerts/mod.rs
+++ b/src/api/management/src/models/alerts/mod.rs
@@ -241,6 +241,10 @@ pub struct Alert {
     #[serde(default)]
     #[schema(example = 0)]
     pub keep_firing_for: i64,
+
+    /// Notify once per state change instead of on every firing evaluation. Enterprise only.
+    #[serde(default)]
+    pub suppress_repeats: bool,
 }
 
 /// Configuration for when and how an alert should be triggered.
@@ -638,6 +642,7 @@ impl From<(meta_alerts::alert::Alert, Option<Trigger>)> for Alert {
             pending_period_sec: alert.pending_period_sec,
             notify_on_recovery: alert.notify_on_recovery,
             keep_firing_for: alert.keep_firing_for,
+            suppress_repeats: alert.suppress_repeats,
         }
     }
 }
@@ -847,6 +852,7 @@ impl From<Alert> for meta_alerts::alert::Alert {
         alert.notify_on_recovery = value.notify_on_recovery;
         alert.recovery_destinations = value.recovery_destinations;
         alert.keep_firing_for = value.keep_firing_for.max(0);
+        alert.suppress_repeats = value.suppress_repeats;
         alert.normalize_promql_rule_mode();
 
         alert
diff --git a/src/api/management/src/models/dashboards.rs b/src/api/management/src/models/dashboards.rs
index 5eb6e08c87..402ce77e78 100644
--- a/src/api/management/src/models/dashboards.rs
+++ b/src/api/management/src/models/dashboards.rs
@@ -558,6 +558,14 @@ mod tests {
             "alert_list_folder": "",
             "flame_graph_stack_field": "folded",
             "flame_graph_value_field": "value",
+            "boxplot_whisker": "minmax",
+            "logs_message_field": "log",
+            "logs_level_field": "severity",
+            "logs_time_field": "_timestamp",
+            "logs_wrap": false,
+            "logs_prettify_json": true,
+            "logs_show_time": false,
+            "logs_order": "newest",
             "override_config": [{
                 "field": {"matchBy": "series", "value": "errors"},
                 "config": [
diff --git a/src/api/management/src/request/alerts/history.rs b/src/api/management/src/request/alerts/history.rs
index 284e7e8802..e2c2b5de29 100644
--- a/src/api/management/src/request/alerts/history.rs
+++ b/src/api/management/src/request/alerts/history.rs
@@ -42,12 +42,13 @@ use crate::common::{
 };
 
 /// Columns a stream gains only once a row carried them, so [history_columns] adds each one present.
-const OPTIONAL_HISTORY_COLUMNS: [&str; 5] = [
+const OPTIONAL_HISTORY_COLUMNS: [&str; 6] = [
     "downtime_id",
     "acked_by",
     "ack_action",
     "ack_source",
     "taken_over_from",
+    "repeat_suppressed",
 ];
 
 /// Every column the data query reads but [OPTIONAL_HISTORY_COLUMNS].
@@ -144,6 +145,9 @@ pub struct AlertHistoryEntry {
     pub ack_source: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub taken_over_from: Option<String>,
+    /// `suppress_repeats` withheld this run because it repeated the last delivered state.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub repeat_suppressed: Option<bool>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
@@ -437,6 +441,7 @@ pub async fn get_alert_history(
                     ack_action: None,
                     ack_source: None,
                     taken_over_from: None,
+                    repeat_suppressed: None,
                 }
             })
             .collect();
@@ -845,6 +850,7 @@ pub async fn get_alert_history(
             ack_action: hit_text(&hit, "ack_action"),
             ack_source: hit_text(&hit, "ack_source"),
             taken_over_from: hit_text(&hit, "taken_over_from"),
+            repeat_suppressed: hit.get("repeat_suppressed").and_then(|v| v.as_bool()),
         });
     }
 
@@ -1256,6 +1262,7 @@ mod tests {
             ack_action: None,
             ack_source: None,
             taken_over_from: None,
+            repeat_suppressed: None,
         };
 
         assert_eq!(entry.alert_name, "test_alert");
@@ -1315,6 +1322,7 @@ mod tests {
             ack_action: None,
             ack_source: None,
             taken_over_from: None,
+            repeat_suppressed: None,
         };
 
         let response = AlertHistoryResponse {
@@ -1363,6 +1371,7 @@ mod tests {
             ack_action: None,
             ack_source: None,
             taken_over_from: None,
+            repeat_suppressed: None,
         };
 
         assert_eq!(entry.status, "error");
@@ -1593,6 +1602,7 @@ mod tests {
             ack_action: None,
             ack_source: None,
             taken_over_from: None,
+            repeat_suppressed: None,
         };
 
         let json = serde_json::to_string(&entry).unwrap();
@@ -1637,6 +1647,7 @@ mod tests {
             ack_action: None,
             ack_source: None,
             taken_over_from: None,
+            repeat_suppressed: None,
         };
 
         let response = AlertHistoryResponse {
@@ -1688,6 +1699,7 @@ mod tests {
             ack_action: None,
             ack_source: None,
             taken_over_from: None,
+            repeat_suppressed: None,
         };
         let json = serde_json::to_value(&entry).unwrap();
         let obj = json.as_object().unwrap();
@@ -1729,6 +1741,7 @@ mod tests {
             ack_action: None,
             ack_source: None,
             taken_over_from: None,
+            repeat_suppressed: None,
         };
         let json = serde_json::to_value(&entry).unwrap();
         let obj = json.as_object().unwrap();
@@ -1826,4 +1839,17 @@ mod tests {
         assert_eq!(hit_text(&hit, "acked_by").as_deref(), Some("dana@acme.com"));
         assert_eq!(hit_text(&hit, "ack_action"), None);
     }
+
+    #[test]
+    fn the_repeat_suppressed_column_is_read_once_the_stream_has_it() {
+        use arrow_schema::{DataType, Field};
+
+        let mut fields: Vec<Field> = HISTORY_COLUMNS
+            .split(", ")
+            .map(|name| Field::new(name, DataType::Utf8, true))
+            .collect();
+        assert!(!history_columns(&Schema::new(fields.clone())).contains("repeat_suppressed"));
+        fields.push(Field::new("repeat_suppressed", DataType::Boolean, true));
+        assert!(history_columns(&Schema::new(fields)).ends_with(", repeat_suppressed"));
+    }
 }
diff --git a/src/api/management/src/request/cloud/org_usage.rs b/src/api/management/src/request/cloud/org_usage.rs
index 6640712cc4..49806c8a33 100644
--- a/src/api/management/src/request/cloud/org_usage.rs
+++ b/src/api/management/src/request/cloud/org_usage.rs
@@ -18,15 +18,10 @@ use axum::{
     response::Response,
 };
 use hashbrown::HashMap;
-use o2_enterprise::enterprise::cloud::{
-    billing_group,
-    billings::{self, MeteringProvider},
-};
+use o2_enterprise::enterprise::cloud::billings::MeteringProvider;
 
-use super::IntoHttpResponse;
 use crate::{
-    common::meta::http::HttpResponse as MetaHttpResponse,
-    models::billings::GetOrgUsageResponseBody, service::org_usage,
+    common::meta::http::HttpResponse as MetaHttpResponse, models::billings::GetOrgUsageResponseBody,
 };
 
 /// GetUsageData
diff --git a/src/api/management/src/request/fleet/mod.rs b/src/api/management/src/request/fleet/mod.rs
index 39d9697e27..bfee817f75 100644
--- a/src/api/management/src/request/fleet/mod.rs
+++ b/src/api/management/src/request/fleet/mod.rs
@@ -1609,7 +1609,11 @@ pub async fn list_audit(
         if !allowed_on(FLEET_MANAGEMENT, &org_id, &user_email.user_id, "GET").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        match openobserve_core::fleet::list_audit(&org_id, query).await {
+        let permitted = match permitted_fleets(&org_id, &user_email.user_id).await {
+            Ok(permitted) => permitted,
+            Err(refused) => return refused,
+        };
+        match openobserve_core::fleet::list_audit(&org_id, query, permitted.as_ref()).await {
             Ok(mut list) => {
                 list.total = list.items.len();
                 MetaHttpResponse::json(list)
@@ -1808,7 +1812,7 @@ async fn desired_request(
     }
 }
 
-/// D19c: the fleets whose items an org-wide list or aggregate shows; `None` is unfiltered.
+/// D19c: the fleets an org-wide list or aggregate shows, whatever the list setting; `None` is all.
 #[cfg(feature = "enterprise")]
 async fn permitted_fleets(
     org_id: &str,
@@ -1821,7 +1825,7 @@ async fn permitted_fleets(
     if let Some(objects) = tests::listed_objects(org_id, user_id) {
         return Ok(permitted_from(org_id, key, objects));
     }
-    match db::authz::list_objects_for_user(org_id, user_id, "GET", key).await {
+    match db::authz::list_permitted_objects(org_id, user_id, "GET", key).await {
         Ok(objects) => Ok(permitted_from(org_id, key, objects)),
         Err(e) => Err(MetaHttpResponse::forbidden(e)),
     }
@@ -2272,7 +2276,7 @@ mod tests {
         assert_eq!(
             permitted_fleets(ORG, custom).await.ok(),
             Some(None),
-            "OpenFGA off, or the list flag off: unfiltered"
+            "OpenFGA off: unfiltered"
         );
         for (listed, want) in [
             (None, None),
diff --git a/src/api/management/src/request/mod.rs b/src/api/management/src/request/mod.rs
index f50bb6e105..cd5e8d45be 100644
--- a/src/api/management/src/request/mod.rs
+++ b/src/api/management/src/request/mod.rs
@@ -58,7 +58,7 @@ pub mod organization;
 pub mod password_policy;
 #[cfg(feature = "enterprise")]
 pub mod playground;
-#[cfg(feature = "profiling")]
+#[cfg(feature = "cpu-profiling")]
 pub mod profiling;
 #[cfg(feature = "enterprise")]
 pub mod prompts;
@@ -90,4 +90,7 @@ pub mod users;
 #[cfg(feature = "enterprise")]
 pub mod workflows;
 
+#[cfg(feature = "cloud")]
+pub mod org_domains;
+
 use openobserve_api_common::request::{BulkDeleteRequest, BulkDeleteResponse};
diff --git a/src/api/management/src/request/org_domains/mod.rs b/src/api/management/src/request/org_domains/mod.rs
new file mode 100644
index 0000000000..737b5098c4
--- /dev/null
+++ b/src/api/management/src/request/org_domains/mod.rs
@@ -0,0 +1,341 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use axum::{Json, extract::Path, response::Response};
+use common::meta::http::HttpResponse as MetaHttpResponse;
+use config::{META_ORG_ID, meta::status_pages::CreateDomainRequest, utils::str::is_valid_domain};
+use infra::table::org_domain_requests::Status;
+use openobserve_api_common::extractors::Headers;
+use openobserve_core::{org_domain_ownership, org_domain_requests};
+use serde::Deserialize;
+
+use crate::service::auth::UserEmail;
+
+#[derive(Deserialize)]
+pub struct RequestDecision {
+    reason: String,
+}
+pub async fn get_linked_domain(Path(org_id): Path<String>) -> Response {
+    match org_domain_ownership::get_domains_for_org(&org_id).await {
+        Ok(v) => MetaHttpResponse::json(v),
+        Err(e) => {
+            log::error!("error listing domains for org {org_id} : {e}");
+            MetaHttpResponse::internal_error(format!("error listing domains : {e}"))
+        }
+    }
+}
+
+pub async fn link_domain(
+    Path(org_id): Path<String>,
+    Headers(user): Headers<UserEmail>,
+    Json(body): Json<CreateDomainRequest>,
+) -> Response {
+    let domain = body.domain.trim().to_lowercase();
+
+    if !is_valid_domain(&domain) {
+        return MetaHttpResponse::bad_request(format!(
+            "domain {domain} is not a valid domain to link"
+        ));
+    }
+
+    match org_domain_ownership::get_verified_org_for_domain(&domain).await {
+        Ok(Some(v)) => {
+            log::info!(
+                "org {org_id} tried to link domain {domain} but it is already verified by org {v}"
+            );
+            let org_info = if v == org_id {
+                "to this org"
+            } else {
+                "by some other org"
+            };
+            return MetaHttpResponse::bad_request(format!(
+                "this domain is already linked {org_info}"
+            ));
+        }
+        Err(e) => {
+            return MetaHttpResponse::internal_error(format!(
+                "error getting org domain linking : {e}"
+            ));
+        }
+        _ => {}
+    }
+
+    let existing = match org_domain_requests::get_req_by_org_domain(&org_id, &domain).await {
+        Ok(v) => v,
+        Err(e) => {
+            return MetaHttpResponse::internal_error(format!(
+                "error getting org domain requests : {e}"
+            ));
+        }
+    };
+    if existing.is_some() {
+        return MetaHttpResponse::bad_request(
+            "there is already a request open for this domain by this org",
+        );
+    }
+
+    let attempt = match org_domain_ownership::get_domain_org_record(&org_id, &domain).await {
+        Ok(v) => v,
+        Err(e) => {
+            return MetaHttpResponse::internal_error(format!(
+                "error getting org domain requests : {e}"
+            ));
+        }
+    };
+
+    if attempt.is_some() {
+        return MetaHttpResponse::bad_request(format!(
+            "there is already a linking created for this domain by this org"
+        ));
+    }
+
+    match org_domain_ownership::save_org_domain_mapping(&org_id, &domain).await {
+        Ok(_) => {
+            log::info!(
+                "successfully created org domain ownership entry for {org_id} domain {domain} by user {}",
+                user.user_id
+            );
+            MetaHttpResponse::ok("successfully created mapping request")
+        }
+        Err(e) => {
+            log::error!("error saving domain {domain} link to org {org_id} : {e}",);
+            MetaHttpResponse::internal_error(format!("error saving org domain linking : {e}"))
+        }
+    }
+}
+
+pub async fn raise_request(
+    Path(org_id): Path<String>,
+    Headers(user): Headers<UserEmail>,
+    Json(body): Json<CreateDomainRequest>,
+) -> Response {
+    let domain = body.domain.trim().to_lowercase();
+
+    if !is_valid_domain(&domain) {
+        return MetaHttpResponse::bad_request(format!("domain {domain} is not a valid domain",));
+    }
+
+    match org_domain_ownership::get_verified_org_for_domain(&domain).await {
+        Ok(Some(v)) => {
+            log::info!(
+                "org {org_id} tried to link domain {domain} but it is already verified by org {v}"
+            );
+            return MetaHttpResponse::bad_request("this domain is already linked by some org");
+        }
+        Err(e) => {
+            return MetaHttpResponse::internal_error(format!(
+                "error getting org domain linking : {e}"
+            ));
+        }
+        _ => {}
+    }
+
+    match org_domain_requests::get_req_by_org_domain(&org_id, &domain).await {
+        Err(e) => {
+            log::error!("error getting org domain request for {org_id} domain {domain} : {e}");
+            return MetaHttpResponse::internal_error(e);
+        }
+        Ok(Some(v)) => {
+            return MetaHttpResponse::bad_request(format!(
+                "org {org_id} already has a request for domain {domain} with status {:?}",
+                Status::from(v.status)
+            ));
+        }
+        _ => {}
+    }
+
+    match org_domain_requests::save_org_domain_request(&org_id, &domain, &user.user_id).await {
+        Ok(_) => {
+            log::info!(
+                "successfully created org domain ownership request for {org_id} domain {domain} by user {}",
+                user.user_id
+            );
+            MetaHttpResponse::ok("successfully created ownership request")
+        }
+        Err(e) => {
+            log::error!("error saving domain {domain} link request to org {org_id} : {e}",);
+            MetaHttpResponse::internal_error(format!(
+                "error saving org domain ownership request : {e}"
+            ))
+        }
+    }
+}
+
+pub async fn list_requests(Path(org_id): Path<String>) -> Response {
+    let requests = if org_id == META_ORG_ID {
+        org_domain_requests::list_all_req().await
+    } else {
+        org_domain_requests::list_by_org(&org_id).await
+    };
+
+    match requests {
+        Ok(v) => MetaHttpResponse::json(v),
+        Err(e) => {
+            log::error!("error listing org domain mapping requests for org {org_id} : {e}");
+            MetaHttpResponse::internal_error(e)
+        }
+    }
+}
+
+pub async fn approve_request(
+    Path((org_id, id)): Path<(String, String)>,
+    Headers(user): Headers<UserEmail>,
+    Json(body): Json<RequestDecision>,
+) -> Response {
+    if org_id != META_ORG_ID {
+        return MetaHttpResponse::forbidden("operation not allowed");
+    }
+    let reason = body.reason.trim().to_string();
+
+    let req = match org_domain_requests::get_req_by_id(&id).await {
+        Ok(Some(v)) => v,
+        Ok(None) => {
+            return MetaHttpResponse::not_found("request with given id not found");
+        }
+        Err(e) => {
+            log::error!("error getting org domain request by id {id} for approval : {e}");
+            return MetaHttpResponse::internal_error(e);
+        }
+    };
+
+    if req.status != Status::Pending as i32 {
+        return MetaHttpResponse::bad_request("This request is not pending, cannot be approved");
+    }
+
+    match org_domain_ownership::get_verified_org_for_domain(&req.domain).await {
+        Ok(Some(v)) => {
+            return MetaHttpResponse::bad_request(format!(
+                "this domain is already linked to org {v}, request cannot be processed"
+            ));
+        }
+        Err(e) => {
+            return MetaHttpResponse::internal_error(format!(
+                "error getting org domain linking : {e}"
+            ));
+        }
+        _ => {}
+    }
+
+    if let Err(e) = org_domain_ownership::link_from_meta(&req.org_id, &req.domain).await {
+        log::error!("error linking the domain to org after request approval : {e}");
+
+        return MetaHttpResponse::internal_error(format!(
+            "error linking domain from req {} : {e}",
+            req.id
+        ));
+    }
+
+    match org_domain_requests::update_status(&id, &user.user_id, Status::Approved, reason).await {
+        Ok(_) => MetaHttpResponse::ok("request approved successfully"),
+        Err(e) => {
+            log::error!("error approving domain ownership request {id} : {e}",);
+            MetaHttpResponse::internal_error(e)
+        }
+    }
+}
+
+pub async fn reject_request(
+    Path((org_id, id)): Path<(String, String)>,
+    Headers(user): Headers<UserEmail>,
+    Json(body): Json<RequestDecision>,
+) -> Response {
+    if org_id != META_ORG_ID {
+        return MetaHttpResponse::forbidden("operation not allowed");
+    }
+    let reason = body.reason.trim().to_string();
+
+    let req = match org_domain_requests::get_req_by_id(&id).await {
+        Ok(Some(v)) => v,
+        Ok(None) => {
+            return MetaHttpResponse::not_found("request with given id not found");
+        }
+        Err(e) => {
+            log::error!("error getting org domain request by id {id} for approval : {e}");
+            return MetaHttpResponse::internal_error(e);
+        }
+    };
+
+    if req.status != Status::Pending as i32 {
+        return MetaHttpResponse::bad_request("This request is not pending, cannot be rejected");
+    }
+
+    if let Err(e) =
+        org_domain_requests::update_status(&id, &user.user_id, Status::Rejected, reason).await
+    {
+        log::error!("error rejecting domain ownership request {id} : {e}",);
+        return MetaHttpResponse::internal_error(format!(
+            "error approving org domain ownership request : {e}"
+        ));
+    }
+    log::info!(
+        "org domain request {id} for org {} successfully rejected by user {}",
+        req.org_id,
+        user.user_id
+    );
+    MetaHttpResponse::ok("request rejected successfully")
+}
+
+pub async fn delete_linked_domain(
+    Path((org_id, did)): Path<(String, String)>,
+    Headers(user): Headers<UserEmail>,
+) -> Response {
+    let domain = did.trim().to_lowercase();
+    let record = match org_domain_ownership::get_domain_org_record(&org_id, &domain).await {
+        Ok(v) => v,
+        Err(e) => {
+            return MetaHttpResponse::internal_error(format!(
+                "error getting org domain linking : {e}"
+            ));
+        }
+    };
+
+    let Some(model) = record else {
+        return MetaHttpResponse::bad_request("org domain link not found");
+    };
+
+    match org_domain_ownership::delete_linked_domain(model).await {
+        Ok(_) => {
+            log::info!(
+                "removed domain link of {domain} from org {org_id} by user {}",
+                user.user_id
+            );
+            MetaHttpResponse::ok("successfully deleted mapping")
+        }
+        Err(e) => {
+            log::error!(
+                "error removing domain link of {domain} from org {org_id} by user {} : {e}",
+                user.user_id
+            );
+            MetaHttpResponse::internal_error(format!("error deleting org domain linking : {e}"))
+        }
+    }
+}
+
+pub async fn verify_domain(
+    Path((org_id, did)): Path<(String, String)>,
+    Headers(user): Headers<UserEmail>,
+) -> Response {
+    let domain = did.trim().to_lowercase();
+    match org_domain_ownership::verify_domain_now(&org_id, &domain).await {
+        Ok(record) => MetaHttpResponse::json(record),
+        Err(e) => {
+            log::error!(
+                "error verifying domain {domain} for org {org_id} by user {}: {e}",
+                user.user_id
+            );
+            MetaHttpResponse::bad_request(e)
+        }
+    }
+}
diff --git a/src/api/management/src/request/organization/billing_group.rs b/src/api/management/src/request/organization/billing_group.rs
index c4644a4968..a1f6d532a5 100644
--- a/src/api/management/src/request/organization/billing_group.rs
+++ b/src/api/management/src/request/organization/billing_group.rs
@@ -316,6 +316,23 @@ pub async fn remove_member(
     if let Err(e) = billing_group::remove_billing_member(&org_id, &member_org_id).await {
         return HttpResponse::bad_request(format!("error in removing member: {e}"));
     }
+
+    let org_id_copy = member_org_id.clone();
+
+    if let Err(e) = db::organization::update_org_setting(&org_id, move |settings| {
+        let before = settings.domain_org_mappings.len();
+        settings
+            .domain_org_mappings
+            .retain(|m| m.org_id != member_org_id);
+        settings.domain_org_mappings.len() != before
+    })
+    .await
+    {
+        log::error!(
+            "error updating domain mapping for {org_id_copy} after removing the membership from {org_id} : {e}"
+        );
+    };
+
     HttpResponse::ok("successfully removed")
 }
 
@@ -366,6 +383,23 @@ pub async fn leave_group(
     if let Err(e) = billing_group::remove_billing_member(&membership.payer_org_id, &org_id).await {
         return HttpResponse::bad_request(format!("error in leaving billing group: {e}"));
     }
+
+    let org_id_copy = org_id.clone();
+
+    if let Err(e) =
+        db::organization::update_org_setting(&membership.payer_org_id, move |settings| {
+            let before = settings.domain_org_mappings.len();
+            settings.domain_org_mappings.retain(|m| m.org_id != org_id);
+            settings.domain_org_mappings.len() != before
+        })
+        .await
+    {
+        log::error!(
+            "error updating domain mapping for {} after removing the membership of {org_id_copy} : {e}",
+            &membership.payer_org_id
+        );
+    };
+
     HttpResponse::ok("successfully left")
 }
 
diff --git a/src/api/management/src/request/organization/settings.rs b/src/api/management/src/request/organization/settings.rs
index 9bdedb504f..65bda8e3f9 100644
--- a/src/api/management/src/request/organization/settings.rs
+++ b/src/api/management/src/request/organization/settings.rs
@@ -19,6 +19,8 @@ use axum::{
     http::StatusCode,
     response::{IntoResponse, Response},
 };
+#[cfg(feature = "cloud")]
+use config::utils::str::is_valid_domain;
 use db::organization::{get_org_setting, set_org_setting};
 use infra::errors::{DbError, Error};
 #[cfg(feature = "enterprise")]
@@ -28,7 +30,6 @@ use {
 };
 #[cfg(feature = "cloud")]
 use {
-    config::META_ORG_ID,
     o2_enterprise::enterprise::cloud::{
         billing_group::list_billing_group_members_of, billings::MeteringProvider, customer_billings,
     },
@@ -78,13 +79,19 @@ pub async fn create(
     #[cfg(feature = "cloud")]
     let settings = match check_domain_org_mappings(&org_id, settings).await {
         Ok(settings) => settings,
-        Err(refusal) => return refusal,
+        Err(refusal) => return MetaHttpResponse::bad_request(refusal),
     };
     #[cfg(feature = "cloud")]
     if let Err(response) = check_budget_config(&org_id, &settings).await {
         return response;
     }
 
+    #[cfg(feature = "cloud")]
+    let settings = match check_domain_management_config(settings).await {
+        Ok(settings) => settings,
+        Err(msg) => return MetaHttpResponse::bad_request(msg),
+    };
+
     match db::organization::update_org_setting(&org_id, |data| {
         apply_settings_payload(data, settings)
     })
@@ -262,64 +269,130 @@ fn validate_settings_payload(settings: &OrganizationSettingPayload) -> Result<()
 async fn check_domain_org_mappings(
     org_id: &str,
     mut settings: OrganizationSettingPayload,
-) -> Result<OrganizationSettingPayload, Response> {
+) -> Result<OrganizationSettingPayload, String> {
+    use hashbrown::HashSet;
     let Some(mut mappings) = settings.domain_org_mappings.take() else {
         return Ok(settings);
     };
-    if org_id != META_ORG_ID {
-        return Ok(settings);
-    }
+    let child_orgs =
+        o2_enterprise::enterprise::cloud::billing_group::list_billing_group_members_of(&org_id)
+            .await
+            .unwrap_or_default();
+
+    let mut allowed_orgs: HashSet<_> = child_orgs.into_iter().map(|v| v.member_org_id).collect();
+    allowed_orgs.insert(org_id.to_string());
+
+    let mut seen_domains = HashSet::new();
     for mapping in &mut mappings {
+        use openobserve_core::org_domain_ownership;
+
+        let domain = mapping.domain.trim().to_lowercase();
+
+        if !is_valid_domain(&domain) {
+            return Err(format!("domain {domain} is not a valid domain",));
+        }
+
+        if seen_domains.contains(&(domain.clone(), mapping.org_id.clone())) {
+            return Err(format!(
+                "domain {domain} is linked to {} multiple times",
+                mapping.org_id
+            ));
+        }
+        seen_domains.insert((domain.clone(), mapping.org_id.clone()));
+
+        if !allowed_orgs.contains(&mapping.org_id) {
+            return Err(format!(
+                "Not allowed to setup a mapping for org {}",
+                mapping.org_id
+            ));
+        }
+
+        if openobserve_core::organization::get_org(&mapping.org_id)
+            .await
+            .is_none()
+        {
+            return Err(format!("No org with org id {} found", mapping.org_id));
+        }
+
         // A deleted org keeps its row as a tombstone, so the row alone does not make it a target.
         match db::org_status::read_active(&mapping.org_id).await {
             Ok(true) => {}
             Ok(false) => return Err(inactive_mapping_target(&mapping.org_id).await),
             Err(e) => {
-                return Err(MetaHttpResponse::internal_error(format!(
+                return Err(format!(
                     "cannot read the status of org {}: {e}",
                     mapping.org_id
-                )));
+                ));
             }
         }
 
-        if mapping.domain.is_empty() || mapping.domain.contains(' ') {
-            return Err(MetaHttpResponse::bad_request(format!(
+        if domain.is_empty() || domain.contains(' ') {
+            return Err(format!(
                 "domain cannot have space or be empty, bad domain '{}'",
                 mapping.domain
-            )));
+            ));
         }
 
         if !matches!(
             mapping.base_role.as_str(),
             "admin" | "editor" | "viewer" | "allowed_user"
         ) {
-            return Err(MetaHttpResponse::bad_request(format!(
+            return Err(format!(
                 "base role {} for org {} is not a valid base role - only admin, editor, viewer, allowed_user are supported",
                 mapping.base_role, mapping.org_id
-            )));
+            ));
         }
         if let Some(claim) = mapping.role_claim_name.as_mut() {
             if claim.trim().is_empty() {
-                return Err(MetaHttpResponse::bad_request(
-                    "role claim name must not be empty",
-                ));
+                return Err("role claim name must not be empty".into());
             }
             *claim = claim.trim().to_string();
         }
 
-        mapping.domain = mapping.domain.to_lowercase();
+        match org_domain_ownership::get_domain_org_record(&org_id, &domain).await {
+            Ok(None) => {
+                return Err("This domain is not linked yet".to_string());
+            }
+            Err(e) => {
+                return Err(format!("error getting domain mappings : {e}"));
+            }
+            Ok(Some(v)) => {
+                use infra::table::org_domain_ownership::OwnershipState;
+
+                if v.verification_state != OwnershipState::Verified as i32 {
+                    return Err("This domain is not verified yet".to_string());
+                }
+            }
+        }
+
+        mapping.domain = domain;
     }
     settings.domain_org_mappings = Some(mappings);
     Ok(settings)
 }
 
+#[cfg(feature = "cloud")]
+async fn check_domain_management_config(
+    mut settings: OrganizationSettingPayload,
+) -> Result<OrganizationSettingPayload, String> {
+    if let Some(mut config) = settings.domain_management_config {
+        config.blocked_emails = config
+            .blocked_emails
+            .into_iter()
+            .map(|v| v.trim().to_lowercase())
+            .collect();
+
+        settings.domain_management_config = Some(config);
+    }
+    Ok(settings)
+}
 /// The refusal for a mapping whose target org is not active: missing, blocked, or unreadable.
 #[cfg(feature = "cloud")]
-async fn inactive_mapping_target(org_id: &str) -> Response {
+async fn inactive_mapping_target(org_id: &str) -> String {
     match infra::table::organizations::find(org_id).await {
-        Ok(None) => MetaHttpResponse::bad_request(format!("No org with org id {org_id} found")),
-        Ok(Some(_)) => MetaHttpResponse::bad_request(format!("org {org_id} is not active")),
-        Err(e) => MetaHttpResponse::internal_error(format!("cannot read org {org_id}: {e}")),
+        Ok(None) => format!("No org with org id {org_id} found"),
+        Ok(Some(_)) => format!("org {org_id} is not active"),
+        Err(e) => format!("cannot read org {org_id}: {e}"),
     }
 }
 
@@ -449,6 +522,16 @@ fn apply_settings_payload(
         field_found = true;
         data.budget_config = configs;
     }
+    #[cfg(feature = "cloud")]
+    if let Some(enforce) = settings.enforce_allowed_orgs_only {
+        field_found = true;
+        data.enforce_allowed_orgs_only = enforce;
+    }
+    #[cfg(feature = "cloud")]
+    if let Some(config) = settings.domain_management_config {
+        field_found = true;
+        data.domain_management_config = config;
+    }
     // this will always be taken from orgs table, never from settings
     data.free_trial_expiry = None;
     field_found
diff --git a/src/api/management/src/request/profiling.rs b/src/api/management/src/request/profiling.rs
index c1d791cb6e..14ec5c8c0c 100644
--- a/src/api/management/src/request/profiling.rs
+++ b/src/api/management/src/request/profiling.rs
@@ -15,11 +15,14 @@
 
 //! HTTP handlers for profiling endpoints
 
-use axum::{Json, extract::Query};
+#[cfg(feature = "profiling")]
+use axum::Json;
+use axum::extract::Query;
 use config::get_config;
+use openobserve_core::self_profiles::dump_cpu_profile;
+#[cfg(feature = "profiling")]
 use openobserve_core::self_profiles::{
-    dump_cpu_profile, dump_memory_flamegraph, dump_memory_pprof,
-    jemalloc_stats as read_jemalloc_stats,
+    dump_memory_flamegraph, dump_memory_pprof, jemalloc_stats as read_jemalloc_stats,
 };
 use serde::Deserialize;
 
@@ -29,6 +32,7 @@ use serde::Deserialize;
 /// The profile can be analyzed with jeprof or converted to flamegraph.
 ///
 /// Returns: Binary profile data
+#[cfg(feature = "profiling")]
 pub async fn memory_profile() -> Result<String, String> {
     let pprof_data = dump_memory_pprof().await?;
     let timestamp = chrono::Utc::now().format("%Y%m%d_%H%M%S");
@@ -58,6 +62,7 @@ pub async fn memory_profile() -> Result<String, String> {
 /// - allocated: Current allocated memory (bytes)
 /// - resident: Current resident memory (bytes)
 /// - metadata: Metadata overhead (bytes)
+#[cfg(feature = "profiling")]
 pub async fn jemalloc_stats() -> Result<Json<serde_json::Value>, String> {
     Ok(Json(read_jemalloc_stats()?))
 }
diff --git a/src/api/management/src/request/public_dashboards/public.rs b/src/api/management/src/request/public_dashboards/public.rs
index 71b0354871..3f5f4243a3 100644
--- a/src/api/management/src/request/public_dashboards/public.rs
+++ b/src/api/management/src/request/public_dashboards/public.rs
@@ -19,7 +19,7 @@ use std::{sync::LazyLock, time::Duration};
 
 use axum::{
     Json,
-    extract::{Extension, Path, Query},
+    extract::{Extension, Path, Query, rejection::QueryRejection},
     http::{HeaderMap, HeaderValue, StatusCode, header},
     response::{IntoResponse, Response},
 };
@@ -182,7 +182,7 @@ pub async fn config(ip: Option<Extension<RealIp>>, Path(slug): Path<String>) ->
 pub async fn data(
     ip: Option<Extension<RealIp>>,
     Path(slug): Path<String>,
-    Query(params): Query<DataParams>,
+    query: Result<Query<DataParams>, QueryRejection>,
     headers: HeaderMap,
 ) -> Response {
     let if_none_match = headers
@@ -191,6 +191,9 @@ pub async fn data(
     if rate_limited(ip.map(|e| e.0)) || shed_early(&slug, if_none_match) {
         return with_headers(too_many_requests(READ_WINDOW));
     }
+    let Ok(Query(params)) = query else {
+        return with_headers(invalid_range());
+    };
     with_headers(serve_data(&slug, params.range.as_deref(), if_none_match).await)
 }
 
@@ -430,6 +433,11 @@ fn expired() -> Response {
     (StatusCode::GONE, "expired").into_response()
 }
 
+// The extractor's own text names serde internals, e.g. a repeated `range`.
+fn invalid_range() -> Response {
+    (StatusCode::BAD_REQUEST, "invalid range").into_response()
+}
+
 // A failed read is temporary, so the viewer retries instead of treating the link as gone.
 fn server_error() -> Response {
     (StatusCode::INTERNAL_SERVER_ERROR, "Something went wrong.").into_response()
@@ -833,6 +841,7 @@ mod tests {
             StatusCode::OK.into_response(),
             StatusCode::NOT_FOUND.into_response(),
             expired(),
+            invalid_range(),
             unavailable(),
             too_many_requests(READ_WINDOW),
             server_error(),
@@ -846,6 +855,22 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn a_query_the_extractor_refuses_is_a_plain_invalid_range() {
+        let uri: axum::http::Uri = "/data?range=r3600&range=r60".parse().unwrap();
+        let resp = data(
+            None,
+            Path("Qz8Zt2mR7aB3cD4eF5gH6Q".into()),
+            Query::try_from_uri(&uri),
+            HeaderMap::new(),
+        )
+        .await;
+        assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
+        assert_eq!(resp.headers()[header::CACHE_CONTROL], "no-store");
+        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
+        assert_eq!(&body[..], b"invalid range");
+    }
+
     #[test]
     fn gate12_a_missing_settings_row_means_enabled_and_a_disabled_row_stops_serving() {
         assert_eq!(org_gate(None), (true, 0));
diff --git a/src/api/management/src/request/query_history.rs b/src/api/management/src/request/query_history.rs
index 81be8fcbaf..b48d88d9d0 100644
--- a/src/api/management/src/request/query_history.rs
+++ b/src/api/management/src/request/query_history.rs
@@ -21,7 +21,10 @@ use axum::{
 };
 use infra::table::{
     entity::query_history::Model,
-    query_history::{self, MAX_STARRED_PER_USER, SetStarred},
+    query_history::{
+        self, DEFAULT_SOURCE, ListFilter, MAX_STARRED_PER_USER, NewRun, SOURCES, STATUS_ERROR,
+        STATUS_OK, SetStarred,
+    },
 };
 use openobserve_api_common::extractors::Headers;
 use openobserve_core::auth::UserEmail;
@@ -34,14 +37,27 @@ use crate::common::meta::http::HttpResponse as MetaHttpResponse;
 pub const MAX_BODY_BYTES: usize = 128 * 1024;
 const MAX_QUERY_BYTES: usize = 16 * 1024;
 const MAX_CONTEXT_BYTES: usize = 64 * 1024;
+const MAX_STREAMS: usize = 50;
 const DEFAULT_LIMIT: u64 = 50;
 const MAX_LIMIT: u64 = 200;
 
 #[derive(Deserialize, Serialize, ToSchema)]
 pub struct QueryHistoryRequest {
+    /// `logs`, `traces`, `metrics`, `dbm` or `profiles`; defaults to `metrics`.
+    #[serde(default)]
+    pub source: Option<String>,
     /// The query text, at most 16 KB and not blank.
     pub query: String,
-    /// Time range, step, chart type and the panel data that reopens the query, at most 64 KB.
+    /// Runs with the same source and key merge into one entry; defaults to the query text.
+    #[serde(default)]
+    pub query_key: Option<String>,
+    /// Streams the query ran on, at most 50; each name non-empty and without a comma.
+    #[serde(default)]
+    pub streams: Vec<String>,
+    /// `ok` or `error`; defaults to `ok`.
+    #[serde(default)]
+    pub status: Option<String>,
+    /// What the page needs to restore the run, at most 64 KB; stored as given.
     pub context: serde_json::Value,
 }
 
@@ -55,24 +71,43 @@ pub struct QueryHistoryStarRequest {
 pub struct QueryHistoryEntry {
     /// Entry id.
     pub id: String,
+    /// Page the query ran on.
+    pub source: String,
     /// The query text.
     pub query: String,
-    /// Time range, step, chart type and the panel data that reopens the query.
+    /// Hex sha256 of the merge key; null on entries recorded before keys existed.
+    pub query_key: Option<String>,
+    /// Streams the query ran on.
+    pub streams: Vec<String>,
+    /// What the page needs to restore the run.
     pub context: serde_json::Value,
+    /// `ok` or `error`, from the latest run; `ok` on entries recorded by v1.1.x.
+    pub status: String,
     /// Starred entries are kept until deleted.
     pub starred: bool,
-    /// When the query was last run, in microseconds since the epoch.
+    /// How many runs merged into this entry; 1 on entries recorded by v1.1.x.
+    pub run_count: i64,
+    /// First run, in microseconds since the epoch; the last run on entries recorded by v1.1.x.
     pub created_at: i64,
+    /// Latest run, in microseconds since the epoch.
+    pub updated_at: i64,
 }
 
 impl From<Model> for QueryHistoryEntry {
     fn from(m: Model) -> Self {
         Self {
+            streams: query_history::decode_streams(&m.streams),
             id: m.id,
+            source: m.source,
             query: m.query,
+            query_key: m.query_key,
             context: m.context,
+            status: m.status,
             starred: m.starred,
+            run_count: m.run_count,
             created_at: m.created_at,
+            // A v1.1.x node in a rolling upgrade writes updated_at = 0; only the response is fixed.
+            updated_at: m.updated_at.max(m.created_at),
         }
     }
 }
@@ -80,18 +115,55 @@ impl From<Model> for QueryHistoryEntry {
 #[derive(Deserialize, IntoParams)]
 #[into_params(parameter_in = Query)]
 pub struct QueryHistoryListParams {
+    /// Comma list of sources (logs, traces, metrics, dbm, profiles); omitted means metrics.
+    pub source: Option<String>,
+    /// `ok` or `error`.
+    pub status: Option<String>,
+    /// Exact stream name the entry ran on.
+    pub stream: Option<String>,
+    /// Case-insensitive substring of the query text or the stream names.
+    pub q: Option<String>,
     /// Only starred (`true`) or only unstarred (`false`) entries.
     pub starred: Option<bool>,
-    /// Substring match on the query text.
-    pub q: Option<String>,
+    /// Entries last run at or after this time, in microseconds.
+    pub ran_from: Option<i64>,
+    /// Entries last run at or before this time, in microseconds.
+    pub ran_to: Option<i64>,
     /// Defaults to 50, at most 200.
     pub limit: Option<u64>,
-    /// Entries to skip, for paging. Defaults to 0.
+    /// Entries to skip, for paging. Defaults to 0, at most 9223372036854775807.
     pub offset: Option<u64>,
+    /// Answer `{"count": n}`, the number of entries the filters match, instead of the entries.
+    pub count_only: Option<bool>,
 }
 
-fn list_limit(limit: Option<u64>) -> u64 {
-    limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
+#[derive(Deserialize, IntoParams)]
+#[into_params(parameter_in = Query)]
+pub struct QueryHistoryClearParams {
+    /// One source or a comma-separated list; all sources when omitted.
+    pub source: Option<String>,
+    /// Also delete starred entries. Defaults to false.
+    pub include_starred: Option<bool>,
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct QueryHistoryCountResponse {
+    /// Entries matching the filters, ignoring limit and offset.
+    pub count: u64,
+}
+
+/// The entries, or with `count_only=true` how many entries match.
+#[derive(Serialize, ToSchema)]
+#[serde(untagged)]
+pub enum QueryHistoryListResponse {
+    Entries(Vec<QueryHistoryEntry>),
+    Count(QueryHistoryCountResponse),
+}
+
+#[derive(Deserialize, Serialize, ToSchema)]
+pub struct QueryHistoryClearResponse {
+    /// Number of entries deleted.
+    pub deleted: u64,
 }
 
 /// RecordQueryHistory
@@ -103,7 +175,7 @@ fn list_limit(limit: Option<u64>) -> u64 {
     tag = "Query History",
     operation_id = "RecordQueryHistory",
     summary = "Record a query history entry",
-    description = "Records a query the caller ran. Running the same query as the caller's latest entry refreshes that entry instead of adding one. Stores nothing and answers 204 when ZO_QUERY_HISTORY_ENABLED is false.",
+    description = "Records a query the caller ran. A run with the same source and query_key as an existing entry of the caller merges into it: the run count goes up and the latest run time, context and status replace the old ones. Stores nothing and answers 204 when ZO_QUERY_HISTORY_ENABLED is false.",
     security(
         ("Authorization"= [])
     ),
@@ -114,7 +186,7 @@ fn list_limit(limit: Option<u64>) -> u64 {
     responses(
         (status = 200, description = "Success", content_type = "application/json", body = QueryHistoryEntry),
         (status = 204, description = "Query history is disabled; nothing was stored"),
-        (status = 400, description = "Query empty, or query or context too large", content_type = "application/json", body = ()),
+        (status = 400, description = "Unknown source or status, query empty, query or context too large, too many streams, or an empty stream name or one with a comma (the message lists them)", content_type = "application/json", body = ()),
         (status = 413, description = "Request body larger than 128 KB"),
         (status = 500, description = "Failure", content_type = "application/json", body = ()),
     ),
@@ -146,7 +218,7 @@ pub async fn record(
     tag = "Query History",
     operation_id = "ListQueryHistory",
     summary = "List query history",
-    description = "Lists the caller's query history, newest first. Empty when ZO_QUERY_HISTORY_ENABLED is false.",
+    description = "Lists the caller's query history, most recently run first. With count_only=true it answers {\"count\": n} (QueryHistoryCountResponse), the number of entries the filters match. Empty, or a count of 0, when ZO_QUERY_HISTORY_ENABLED is false.",
     security(
         ("Authorization"= [])
     ),
@@ -155,7 +227,8 @@ pub async fn record(
         QueryHistoryListParams,
     ),
     responses(
-        (status = 200, description = "Success", content_type = "application/json", body = Vec<QueryHistoryEntry>),
+        (status = 200, description = "The entries, or with count_only=true the count", content_type = "application/json", body = QueryHistoryListResponse),
+        (status = 400, description = "Unknown source or status, or an offset above 9223372036854775807", content_type = "application/json", body = ()),
         (status = 500, description = "Failure", content_type = "application/json", body = ()),
     ),
     extensions(
@@ -177,6 +250,49 @@ pub async fn list(
     .await
 }
 
+/// ClearQueryHistory
+
+#[utoipa::path(
+    delete,
+    path = "/{org_id}/query_history",
+    context_path = "/api",
+    tag = "Query History",
+    operation_id = "ClearQueryHistory",
+    summary = "Clear the caller's query history",
+    description = "Deletes the caller's query history entries for the given sources, or all sources. Starred entries are kept unless include_starred is true.",
+    security(
+        ("Authorization"= [])
+    ),
+    params(
+        ("org_id" = String, Path, description = "Organization name"),
+        QueryHistoryClearParams,
+    ),
+    responses(
+        (status = 200, description = "Success", content_type = "application/json", body = QueryHistoryClearResponse),
+        (status = 400, description = "Unknown source", content_type = "application/json", body = ()),
+        (status = 500, description = "Failure", content_type = "application/json", body = ()),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Query History", "operation": "delete"})),
+        ("x-o2-mcp" = json!({"enabled": false}))
+    )
+)]
+pub async fn clear(
+    Path(org_id): Path<String>,
+    Headers(user_email): Headers<UserEmail>,
+    Query(params): Query<QueryHistoryClearParams>,
+) -> Response {
+    let sources = match parse_sources(params.source.as_deref()) {
+        Ok(sources) => sources,
+        Err(e) => return MetaHttpResponse::bad_request(e),
+    };
+    let include_starred = params.include_starred.unwrap_or(false);
+    match query_history::clear(&org_id, &user_email.user_id, &sources, include_starred).await {
+        Ok(deleted) => MetaHttpResponse::json(QueryHistoryClearResponse { deleted }),
+        Err(e) => MetaHttpResponse::internal_error(e),
+    }
+}
+
 /// StarQueryHistory
 
 #[utoipa::path(
@@ -186,7 +302,7 @@ pub async fn list(
     tag = "Query History",
     operation_id = "StarQueryHistory",
     summary = "Star or unstar a query history entry",
-    description = "Starred entries are kept until deleted. A user can star at most 200 entries per organization.",
+    description = "Starred entries are kept until deleted. A user can star at most 200 entries per organization, shared across every source (logs, traces, metrics, dbm, profiles).",
     security(
         ("Authorization"= [])
     ),
@@ -213,10 +329,10 @@ pub async fn star(
     Json(req): Json<QueryHistoryStarRequest>,
 ) -> Response {
     match query_history::set_starred(&org_id, &user_email.user_id, &id, req.starred).await {
-        Ok(SetStarred::Updated(entry)) => MetaHttpResponse::json(QueryHistoryEntry::from(entry)),
+        Ok(SetStarred::Updated(entry)) => MetaHttpResponse::json(QueryHistoryEntry::from(*entry)),
         Ok(SetStarred::NotFound) => MetaHttpResponse::not_found("query history entry not found"),
         Ok(SetStarred::StarredCapReached) => MetaHttpResponse::bad_request(format!(
-            "at most {MAX_STARRED_PER_USER} query history entries can be starred; unstar one first"
+            "at most {MAX_STARRED_PER_USER} query history entries can be starred across all sources; unstar one first"
         )),
         Err(e) => MetaHttpResponse::internal_error(e),
     }
@@ -260,6 +376,81 @@ pub async fn delete(
     }
 }
 
+fn list_limit(limit: Option<u64>) -> u64 {
+    limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
+}
+
+/// The databases bind OFFSET as a signed 64-bit integer.
+fn list_offset(offset: Option<u64>) -> Result<u64, String> {
+    let offset = offset.unwrap_or(0);
+    if offset > i64::MAX as u64 {
+        return Err(format!("offset exceeds {}", i64::MAX));
+    }
+    Ok(offset)
+}
+
+/// Splits a comma list of sources; empty means all, an unknown name is an error.
+fn parse_sources(sources: Option<&str>) -> Result<Vec<String>, String> {
+    let mut parsed = Vec::new();
+    for source in sources.unwrap_or("").split(',').map(str::trim) {
+        if source.is_empty() {
+            continue;
+        }
+        if !SOURCES.contains(&source) {
+            return Err(format!("unknown source: {source}"));
+        }
+        parsed.push(source.to_string());
+    }
+    Ok(parsed)
+}
+
+fn parse_status(status: Option<&str>) -> Result<Option<String>, String> {
+    match status.map(str::trim).filter(|s| !s.is_empty()) {
+        None => Ok(None),
+        Some(s) if s == STATUS_OK || s == STATUS_ERROR => Ok(Some(s.to_string())),
+        Some(s) => Err(format!("unknown status: {s}")),
+    }
+}
+
+/// The source and status a record stores, or why the request is refused.
+fn validate_record(req: &QueryHistoryRequest) -> Result<(String, String), String> {
+    let source = req
+        .source
+        .as_deref()
+        .map(str::trim)
+        .filter(|s| !s.is_empty())
+        .unwrap_or(DEFAULT_SOURCE);
+    if !SOURCES.contains(&source) {
+        return Err(format!("unknown source: {source}"));
+    }
+    let status = parse_status(req.status.as_deref())?.unwrap_or_else(|| STATUS_OK.to_string());
+    if req.query.trim().is_empty() {
+        return Err("query is empty".to_string());
+    }
+    if req.query.len() > MAX_QUERY_BYTES {
+        return Err("query exceeds 16 KB".to_string());
+    }
+    if req.context.to_string().len() > MAX_CONTEXT_BYTES {
+        return Err("context exceeds 64 KB".to_string());
+    }
+    if req.streams.len() > MAX_STREAMS {
+        return Err(format!("at most {MAX_STREAMS} streams"));
+    }
+    let invalid: Vec<String> = req
+        .streams
+        .iter()
+        .filter(|s| s.is_empty() || s.contains(','))
+        .map(|s| format!("{s:?}"))
+        .collect();
+    if !invalid.is_empty() {
+        return Err(format!(
+            "stream names must be non-empty and contain no comma: {}",
+            invalid.join(", ")
+        ));
+    }
+    Ok((source.to_string(), status))
+}
+
 async fn record_entry(
     enabled: bool,
     org_id: &str,
@@ -269,24 +460,22 @@ async fn record_entry(
     if !enabled {
         return StatusCode::NO_CONTENT.into_response();
     }
-    if req.query.trim().is_empty() {
-        return MetaHttpResponse::bad_request("query is empty");
-    }
-    if req.query.len() > MAX_QUERY_BYTES {
-        return MetaHttpResponse::bad_request("query exceeds 16 KB");
-    }
-    if req.context.to_string().len() > MAX_CONTEXT_BYTES {
-        return MetaHttpResponse::bad_request("context exceeds 64 KB");
-    }
-    match query_history::record(
+    let (source, status) = match validate_record(&req) {
+        Ok(valid) => valid,
+        Err(e) => return MetaHttpResponse::bad_request(e),
+    };
+    let run = NewRun {
         org_id,
         user_email,
-        &req.query,
-        req.context,
-        config::utils::time::now_micros(),
-    )
-    .await
-    {
+        source: &source,
+        query: &req.query,
+        query_key: req.query_key.as_deref(),
+        streams: &req.streams,
+        status: &status,
+        context: req.context,
+        now_us: config::utils::time::now_micros(),
+    };
+    match query_history::record(run).await {
         Ok(entry) => MetaHttpResponse::json(QueryHistoryEntry::from(entry)),
         Err(e) => MetaHttpResponse::internal_error(e),
     }
@@ -298,45 +487,81 @@ async fn list_entries(
     user_email: &str,
     params: QueryHistoryListParams,
 ) -> Response {
+    let count_only = params.count_only.unwrap_or(false);
     if !enabled {
-        return MetaHttpResponse::json(Vec::<QueryHistoryEntry>::new());
+        return MetaHttpResponse::json(if count_only {
+            QueryHistoryListResponse::Count(QueryHistoryCountResponse { count: 0 })
+        } else {
+            QueryHistoryListResponse::Entries(Vec::new())
+        });
+    }
+    let (filter, offset) =
+        match list_filter(&params).and_then(|f| Ok((f, list_offset(params.offset)?))) {
+            Ok(valid) => valid,
+            Err(e) => return MetaHttpResponse::bad_request(e),
+        };
+    if count_only {
+        return match query_history::count(org_id, user_email, &filter).await {
+            Ok(count) => {
+                MetaHttpResponse::json(QueryHistoryListResponse::Count(QueryHistoryCountResponse {
+                    count,
+                }))
+            }
+            Err(e) => MetaHttpResponse::internal_error(e),
+        };
     }
     match query_history::list(
         org_id,
         user_email,
-        params.starred,
-        params.q.as_deref(),
+        &filter,
         list_limit(params.limit),
-        params.offset.unwrap_or(0),
+        offset,
     )
     .await
     {
-        Ok(entries) => MetaHttpResponse::json(
-            entries
-                .into_iter()
-                .map(QueryHistoryEntry::from)
-                .collect::<Vec<_>>(),
-        ),
+        Ok(entries) => MetaHttpResponse::json(QueryHistoryListResponse::Entries(
+            entries.into_iter().map(QueryHistoryEntry::from).collect(),
+        )),
         Err(e) => MetaHttpResponse::internal_error(e),
     }
 }
 
+fn list_filter(params: &QueryHistoryListParams) -> Result<ListFilter, String> {
+    // A v1.1.x client sends no source and can only load Metrics entries.
+    let sources = parse_sources(params.source.as_deref())?;
+    let sources = if sources.is_empty() {
+        vec![DEFAULT_SOURCE.to_string()]
+    } else {
+        sources
+    };
+    Ok(ListFilter {
+        sources,
+        status: parse_status(params.status.as_deref())?,
+        stream: params.stream.clone(),
+        q: params.q.clone(),
+        starred: params.starred,
+        ran_from: params.ran_from,
+        ran_to: params.ran_to,
+    })
+}
+
 #[cfg(test)]
 mod tests {
-    use infra::table::entity::query_history::Entity;
-    use sea_orm::{ConnectionTrait, Schema};
     use serde_json::{Value, json};
 
     use super::*;
 
+    const ALL: &str = "source=logs,traces,metrics,dbm,profiles";
+
     async fn setup() {
-        infra::db::create_table().await.unwrap();
-        let conn = infra::db::get_orm_client_rw().await;
-        let backend = conn.get_database_backend();
-        let mut stmt = Schema::new(backend).create_table_from_entity(Entity);
-        conn.execute(backend.build(stmt.if_not_exists()))
-            .await
-            .unwrap();
+        static TABLE: tokio::sync::OnceCell<()> = tokio::sync::OnceCell::const_new();
+        TABLE
+            .get_or_init(|| async {
+                infra::db::create_table().await.unwrap();
+                let conn = infra::db::get_orm_client_rw().await;
+                query_history::create_table_for_tests(conn).await.unwrap();
+            })
+            .await;
     }
 
     fn user() -> String {
@@ -349,6 +574,17 @@ mod tests {
         })
     }
 
+    fn request(query: &str, context: Value) -> QueryHistoryRequest {
+        QueryHistoryRequest {
+            source: None,
+            query: query.to_string(),
+            query_key: None,
+            streams: Vec::new(),
+            status: None,
+            context,
+        }
+    }
+
     async fn parts(resp: Response) -> (StatusCode, Value) {
         let status = resp.status();
         let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
@@ -360,23 +596,26 @@ mod tests {
         )
     }
 
-    async fn post(org: &str, user: &str, query: &str, context: Value) -> (StatusCode, Value) {
-        let req = QueryHistoryRequest {
-            query: query.to_string(),
-            context,
-        };
+    async fn post_req(org: &str, user: &str, req: QueryHistoryRequest) -> (StatusCode, Value) {
         parts(record(Path(org.to_string()), headers(user), Json(req)).await).await
     }
 
+    async fn post(org: &str, user: &str, query: &str, context: Value) -> (StatusCode, Value) {
+        post_req(org, user, request(query, context)).await
+    }
+
     async fn get(org: &str, user: &str, params: &str) -> Vec<Value> {
-        let params: QueryHistoryListParams = parse_params(params);
-        let (status, body) =
-            parts(list(Path(org.to_string()), headers(user), Query(params)).await).await;
-        assert_eq!(status, StatusCode::OK);
+        let (status, body) = get_raw(org, user, params).await;
+        assert_eq!(status, StatusCode::OK, "{body}");
         body.as_array().unwrap().clone()
     }
 
-    fn parse_params(params: &str) -> QueryHistoryListParams {
+    async fn get_raw(org: &str, user: &str, params: &str) -> (StatusCode, Value) {
+        let params: QueryHistoryListParams = parse_params(params);
+        parts(list(Path(org.to_string()), headers(user), Query(params)).await).await
+    }
+
+    fn parse_params<T: serde::de::DeserializeOwned>(params: &str) -> T {
         let uri: axum::http::Uri = format!("/?{params}").parse().unwrap();
         Query::try_from_uri(&uri).unwrap().0
     }
@@ -392,6 +631,17 @@ mod tests {
         parts(delete(path, headers(user)).await).await.0
     }
 
+    async fn clear_all(org: &str, user: &str, params: &str) -> (StatusCode, Value) {
+        let params: QueryHistoryClearParams = parse_params(params);
+        parts(clear(Path(org.to_string()), headers(user), Query(params)).await).await
+    }
+
+    fn queries(rows: Vec<Value>) -> Vec<String> {
+        rows.iter()
+            .map(|e| e["query"].as_str().unwrap().to_string())
+            .collect()
+    }
+
     #[tokio::test]
     async fn test_another_users_entry_is_not_found() {
         setup().await;
@@ -438,73 +688,317 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_rerun_updates_the_latest_entry_context() {
+    async fn test_an_old_client_without_source_or_key_merges_by_query_into_metrics() {
         setup().await;
         let a = user();
         post("default", &a, "up", json!({"chart": "line"})).await;
-        post("default", &a, "up", json!({"chart": "bar"})).await;
+        let (_, entry) = post("default", &a, "up", json!({"chart": "bar"})).await;
+        assert_eq!(entry["source"], "metrics");
+        assert_eq!(entry["status"], "ok");
+        assert_eq!(entry["run_count"], 2);
+        assert_eq!(entry["streams"], json!([]));
+        assert_eq!(entry["query_key"].as_str().unwrap().len(), 64);
         let listed = get("default", &a, "").await;
         assert_eq!(listed.len(), 1);
         assert_eq!(listed[0]["context"]["chart"], "bar");
+        assert!(listed[0]["updated_at"].as_i64() >= listed[0]["created_at"].as_i64());
     }
 
     #[tokio::test]
-    async fn test_oversized_query_or_context_is_rejected() {
+    async fn test_a_v1_1_row_without_updated_at_answers_its_created_at() {
+        use sea_orm::ConnectionTrait;
         setup().await;
         let a = user();
-        let long_query = "x".repeat(MAX_QUERY_BYTES + 1);
+        let id = config::ider::uuid();
+        infra::db::get_orm_client_rw()
+            .await
+            .execute_unprepared(&format!(
+                "INSERT INTO query_history (id, org_id, user_email, query, context, created_at, \
+                 updated_at, source) VALUES ('{id}', 'default', '{a}', 'up', '{{}}', 500, 0, \
+                 'metrics')"
+            ))
+            .await
+            .unwrap();
+
+        let listed = get("default", &a, "").await;
         assert_eq!(
-            post("default", &a, &long_query, json!({})).await.0,
-            StatusCode::BAD_REQUEST
+            (
+                listed[0]["created_at"].as_i64(),
+                listed[0]["updated_at"].as_i64()
+            ),
+            (Some(500), Some(500))
         );
-        let big = json!({"d": "x".repeat(MAX_CONTEXT_BYTES)});
-        assert_eq!(
-            post("default", &a, "up", big).await.0,
-            StatusCode::BAD_REQUEST
-        );
-        let max_query = "x".repeat(MAX_QUERY_BYTES);
-        assert_eq!(
-            post("default", &a, &max_query, json!({})).await.0,
-            StatusCode::OK
-        );
-        assert_eq!(get("default", &a, "").await.len(), 1);
+        let (status, starred) = patch("default", &a, &id, true).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(starred["updated_at"], 500);
+        assert_eq!(starred["created_at"], 500);
     }
 
     #[tokio::test]
-    async fn test_blank_query_is_rejected() {
+    async fn test_repeats_of_one_search_stay_one_entry() {
         setup().await;
         let a = user();
-        for query in ["", "   ", "\n\t "] {
+        for _ in 0..3 {
+            let req = QueryHistoryRequest {
+                source: Some("logs".to_string()),
+                query_key: Some("k8s|sql|up|".to_string()),
+                streams: vec!["k8s".to_string()],
+                ..request("up", json!({}))
+            };
+            assert_eq!(post_req("default", &a, req).await.0, StatusCode::OK);
+        }
+        let rows = get("default", &a, "source=logs").await;
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0]["run_count"], 3);
+        assert_eq!(rows[0]["streams"], json!(["k8s"]));
+    }
+
+    #[tokio::test]
+    async fn test_query_key_is_a_hash_per_user_and_falls_back_to_the_query() {
+        setup().await;
+        let (a, b) = (user(), user());
+        let keyed = |key: Option<&str>| QueryHistoryRequest {
+            source: Some("logs".to_string()),
+            query_key: key.map(str::to_string),
+            ..request("up", json!({}))
+        };
+        let (_, first) = post_req("default", &a, keyed(Some("k8s|sql|up|"))).await;
+        let key = first["query_key"].as_str().unwrap();
+        assert_eq!(key.len(), 64);
+        assert!(key.chars().all(|c| c.is_ascii_hexdigit()), "{key}");
+        assert_ne!(key, "k8s|sql|up|");
+
+        let (_, other_user) = post_req("default", &b, keyed(Some("k8s|sql|up|"))).await;
+        assert_eq!(other_user["query_key"], first["query_key"]);
+        assert_ne!(other_user["id"], first["id"], "user_email is in the key");
+        assert_eq!(other_user["run_count"], 1);
+
+        let (_, no_key) = post_req("default", &a, keyed(None)).await;
+        let (_, query_as_key) = post_req("default", &a, keyed(Some("up"))).await;
+        assert_eq!(query_as_key["id"], no_key["id"], "no key hashes the query");
+        assert_eq!(query_as_key["run_count"], 2);
+        assert_eq!(get("default", &a, "source=logs").await.len(), 2);
+    }
+
+    #[test]
+    fn test_invalid_stream_names_are_listed_in_the_error() {
+        let req = QueryHistoryRequest {
+            streams: vec!["ok".to_string(), "a,b".to_string(), String::new()],
+            ..request("up", json!({}))
+        };
+        assert_eq!(
+            validate_record(&req).unwrap_err(),
+            r#"stream names must be non-empty and contain no comma: "a,b", """#
+        );
+    }
+
+    #[tokio::test]
+    async fn test_record_validation() {
+        setup().await;
+        let a = user();
+        let refused = [
+            QueryHistoryRequest {
+                source: Some("dashboards".to_string()),
+                ..request("up", json!({}))
+            },
+            QueryHistoryRequest {
+                status: Some("timeout".to_string()),
+                ..request("up", json!({}))
+            },
+            QueryHistoryRequest {
+                streams: (0..=MAX_STREAMS).map(|i| format!("s{i}")).collect(),
+                ..request("up", json!({}))
+            },
+            QueryHistoryRequest {
+                streams: vec!["a,b".to_string()],
+                ..request("up", json!({}))
+            },
+            request(&"x".repeat(MAX_QUERY_BYTES + 1), json!({})),
+            request("up", json!({"d": "x".repeat(MAX_CONTEXT_BYTES)})),
+            request("", json!({})),
+            request("  \n\t ", json!({})),
+        ];
+        for req in refused {
             assert_eq!(
-                post("default", &a, query, json!({})).await.0,
-                StatusCode::BAD_REQUEST,
-                "{query:?}"
+                post_req("default", &a, req).await.0,
+                StatusCode::BAD_REQUEST
             );
         }
         assert!(get("default", &a, "").await.is_empty());
+
+        let accepted = QueryHistoryRequest {
+            source: Some("traces".to_string()),
+            status: Some("error".to_string()),
+            streams: (0..MAX_STREAMS).map(|i| format!("s{i}")).collect(),
+            ..request(&"x".repeat(MAX_QUERY_BYTES), json!({}))
+        };
+        let (status, entry) = post_req("default", &a, accepted).await;
+        assert_eq!(status, StatusCode::OK, "{entry}");
+        assert_eq!(entry["status"], "error");
+        assert_eq!(entry["source"], "traces");
     }
 
     #[tokio::test]
     async fn test_list_applies_filters() {
         setup().await;
         let a = user();
-        for query in ["up", "rate(http_total[5m])", "sum(http_total)"] {
-            post("default", &a, query, json!({})).await;
+        for (source, query, stream, status) in [
+            ("metrics", "up", None, "ok"),
+            ("logs", "level = 'error'", Some("k8s_logs"), "error"),
+            ("traces", "service = 'cart'", Some("default"), "ok"),
+            ("metrics", "sum(http_total)", None, "ok"),
+        ] {
+            let req = QueryHistoryRequest {
+                source: Some(source.to_string()),
+                streams: stream.map(|s| vec![s.to_string()]).unwrap_or_default(),
+                status: Some(status.to_string()),
+                ..request(query, json!({}))
+            };
+            post_req("default", &a, req).await;
         }
-        let queries = |rows: Vec<Value>| {
-            rows.iter()
-                .map(|e| e["query"].as_str().unwrap().to_string())
-                .collect::<Vec<_>>()
-        };
         assert_eq!(
-            queries(get("default", &a, "q=http_total&limit=1").await),
+            queries(get("default", &a, "source=logs,traces").await),
+            vec!["service = 'cart'", "level = 'error'"]
+        );
+        assert_eq!(
+            queries(get("default", &a, &format!("{ALL}&status=error")).await),
+            vec!["level = 'error'"]
+        );
+        assert_eq!(
+            queries(get("default", &a, &format!("{ALL}&stream=k8s_logs")).await),
+            vec!["level = 'error'"]
+        );
+        assert_eq!(
+            queries(get("default", &a, &format!("{ALL}&q=K8S")).await),
+            vec!["level = 'error'"]
+        );
+        assert_eq!(
+            queries(get("default", &a, "").await),
+            vec!["sum(http_total)", "up"],
+            "a client that sends no source is a v1.1.x Metrics page"
+        );
+        assert_eq!(
+            queries(get("default", &a, "source=metrics&limit=1").await),
             vec!["sum(http_total)"]
         );
         assert_eq!(
-            queries(get("default", &a, "q=http_total&offset=1").await),
-            vec!["rate(http_total[5m])"]
+            queries(get("default", &a, "source=metrics&offset=1").await),
+            vec!["up"]
+        );
+        assert!(
+            get("default", &a, &format!("{ALL}&ran_from=1&ran_to=2"))
+                .await
+                .is_empty()
+        );
+        assert_eq!(
+            get("default", &a, &format!("{ALL}&ran_from=1")).await.len(),
+            4
+        );
+        assert!(
+            get("default", &a, &format!("{ALL}&starred=true"))
+                .await
+                .is_empty()
+        );
+        assert_eq!(
+            get_raw("default", &a, "source=dashboards").await.0,
+            StatusCode::BAD_REQUEST
+        );
+        assert_eq!(
+            get_raw("default", &a, "status=partial").await.0,
+            StatusCode::BAD_REQUEST
+        );
+    }
+
+    #[tokio::test]
+    async fn test_count_only_answers_the_count_for_the_filters() {
+        setup().await;
+        let a = user();
+        for (source, query) in [
+            ("logs", "a"),
+            ("logs", "b"),
+            ("traces", "c"),
+            ("metrics", "d"),
+        ] {
+            let req = QueryHistoryRequest {
+                source: Some(source.to_string()),
+                ..request(query, json!({}))
+            };
+            post_req("default", &a, req).await;
+        }
+        let starred = get("default", &a, "source=logs").await[0]["id"]
+            .as_str()
+            .unwrap()
+            .to_string();
+        patch("default", &a, &starred, true).await;
+        let count = |params: &str| {
+            let a = a.clone();
+            let params = format!("count_only=true&{params}");
+            async move { get_raw("default", &a, &params).await }
+        };
+        assert_eq!(
+            count("source=logs").await,
+            (StatusCode::OK, json!({"count": 2}))
+        );
+        assert_eq!(
+            count("source=logs&starred=false").await.1,
+            json!({"count": 1})
+        );
+        assert_eq!(
+            count(&format!("{ALL}&starred=true")).await.1,
+            json!({"count": 1})
+        );
+        assert_eq!(count(ALL).await.1, json!({"count": 4}));
+        assert_eq!(count("source=logs&limit=1").await.1, json!({"count": 2}));
+        assert_eq!(count("source=nope").await.0, StatusCode::BAD_REQUEST);
+
+        let disabled = list_entries(
+            false,
+            "default",
+            &a,
+            parse_params("count_only=true&source=logs"),
+        )
+        .await;
+        assert_eq!(parts(disabled).await, (StatusCode::OK, json!({"count": 0})));
+    }
+
+    #[tokio::test]
+    async fn test_clear_my_history() {
+        setup().await;
+        let (a, b) = (user(), user());
+        for (source, query) in [
+            ("logs", "a"),
+            ("logs", "b"),
+            ("traces", "c"),
+            ("metrics", "d"),
+        ] {
+            let req = QueryHistoryRequest {
+                source: Some(source.to_string()),
+                ..request(query, json!({}))
+            };
+            post_req("default", &a, req).await;
+        }
+        post("default", &b, "up", json!({})).await;
+        let starred = get("default", &a, "source=logs").await[0]["id"]
+            .as_str()
+            .unwrap()
+            .to_string();
+        patch("default", &a, &starred, true).await;
+
+        let (status, body) = clear_all("default", &a, "source=logs").await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, json!({"deleted": 1}));
+        assert_eq!(clear_all("default", &a, "").await.1, json!({"deleted": 2}));
+        assert_eq!(queries(get("default", &a, ALL).await), vec!["b"]);
+        assert_eq!(
+            clear_all("default", &a, "include_starred=true").await.1,
+            json!({"deleted": 1})
+        );
+        assert!(get("default", &a, ALL).await.is_empty());
+        assert_eq!(get("default", &b, ALL).await.len(), 1);
+        assert_eq!(
+            clear_all("default", &a, "source=nope").await.0,
+            StatusCode::BAD_REQUEST
         );
-        assert!(get("default", &a, "starred=true").await.is_empty());
     }
 
     #[tokio::test]
@@ -512,10 +1006,7 @@ mod tests {
         setup().await;
         let a = user();
         post("default", &a, "up", json!({})).await;
-        let req = QueryHistoryRequest {
-            query: "rate(x[5m])".to_string(),
-            context: json!({}),
-        };
+        let req = request("rate(x[5m])", json!({}));
         let (status, body) = parts(record_entry(false, "default", &a, req).await).await;
         assert_eq!(status, StatusCode::NO_CONTENT);
         assert_eq!(body, Value::Null, "204 carries no body");
@@ -535,4 +1026,37 @@ mod tests {
         assert_eq!(list_limit(Some(500)), 200);
         assert_eq!(list_limit(Some(0)), 1);
     }
+
+    #[tokio::test]
+    async fn test_an_offset_past_i64_max_is_a_bad_request() {
+        setup().await;
+        let a = user();
+        post("default", &a, "up", json!({})).await;
+        let max = i64::MAX as u64;
+        let (status, _) = get_raw("default", &a, &format!("offset={}", max + 1)).await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        let (status, _) = get_raw(
+            "default",
+            &a,
+            &format!("offset={}&count_only=true", u64::MAX),
+        )
+        .await;
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+        assert!(
+            get("default", &a, &format!("offset={max}"))
+                .await
+                .is_empty()
+        );
+        assert_eq!(list_offset(None), Ok(0));
+    }
+
+    #[test]
+    fn test_sources_parse_as_a_comma_list_of_known_pages() {
+        assert_eq!(parse_sources(None), Ok(vec![]));
+        assert_eq!(
+            parse_sources(Some("logs, traces,")),
+            Ok(vec!["logs".to_string(), "traces".to_string()])
+        );
+        assert!(parse_sources(Some("logs,alerts")).is_err());
+    }
 }
diff --git a/src/api/management/src/request/status/mod.rs b/src/api/management/src/request/status/mod.rs
index c96ae67ab5..5431120d60 100644
--- a/src/api/management/src/request/status/mod.rs
+++ b/src/api/management/src/request/status/mod.rs
@@ -249,6 +249,10 @@ struct ConfigResponse<'a> {
     synthetics_recorder_extension_url: String,
     /// The only DBM flag (`ZO_DB_MONITORING_ENABLED`): one OSS switch for every signal.
     database_monitoring_enabled: bool,
+    /// Off hides recent searches in the UI; the server then records nothing.
+    query_history_enabled: bool,
+    /// Days unstarred recent searches are kept; 0 or less keeps them until the per-page cap.
+    query_history_retention_days: i64,
     enable_cross_linking: bool,
     show_fts_field_values: bool,
     search_inspector_enabled: bool,
@@ -668,6 +672,8 @@ pub async fn zo_config(
         synthetics_browser_max_steps,
         synthetics_recorder_extension_url: synthetics_recorder_extension_url.to_string(),
         database_monitoring_enabled: cfg.db_monitoring.enabled,
+        query_history_enabled: cfg.limit.query_history_enabled,
+        query_history_retention_days: cfg.limit.query_history_retention_days,
         enable_cross_linking: cfg.common.enable_cross_linking,
         show_fts_field_values: cfg.common.show_fts_field_values,
         search_inspector_enabled,
@@ -1286,11 +1292,11 @@ pub async fn redirect(
                         Ok(v) => v.map(|(new_user, pending_invites)| {
                             format!("&new_user_login={new_user}&pending_invites={pending_invites}")
                         }),
-                        Err(_) => {
+                        Err(e) => {
                             return Response::builder()
                                 .status(StatusCode::UNAUTHORIZED)
                                 .header(header::CONTENT_TYPE, "application/json")
-                                .body(Body::from("\"Email Domain not allowed\""))
+                                .body(Body::from(e.to_string()))
                                 .unwrap();
                         }
                     };
@@ -2563,6 +2569,20 @@ mod tests {
         assert_eq!(json["public_dashboards_enabled"], true);
     }
 
+    #[tokio::test]
+    async fn test_zo_config_serves_query_history_settings() {
+        let cfg = get_config();
+        let json = zo_config_json().await;
+        assert_eq!(
+            json["query_history_enabled"],
+            cfg.limit.query_history_enabled
+        );
+        assert_eq!(
+            json["query_history_retention_days"],
+            cfg.limit.query_history_retention_days
+        );
+    }
+
     #[tokio::test]
     async fn test_zo_config_reports_slack_per_org() {
         let reason = if cfg!(feature = "enterprise") {
diff --git a/src/common/src/meta/organization.rs b/src/common/src/meta/organization.rs
index 6413cbcfde..04c11f4b97 100644
--- a/src/common/src/meta/organization.rs
+++ b/src/common/src/meta/organization.rs
@@ -14,6 +14,8 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 use config::{meta::user::UserRole, stats::MemorySize};
+#[cfg(feature = "cloud")]
+use o2_enterprise::enterprise::domain_management::meta::DomainManagementConfig;
 use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
 
@@ -539,8 +541,16 @@ pub struct OrganizationSettingPayload {
     pub claim_parser_function: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub cross_links: Option<Vec<config::meta::stream::CrossLink>>,
+    #[cfg(feature = "cloud")]
     #[serde(skip_serializing_if = "Option::is_none")]
     pub domain_org_mappings: Option<Vec<DomainOrgMapping>>,
+    #[cfg(feature = "cloud")]
+    #[serde(default)]
+    pub domain_management_config: Option<DomainManagementConfig>,
+    #[cfg(feature = "cloud")]
+    #[serde(default)]
+    pub enforce_allowed_orgs_only: Option<bool>,
+    #[cfg(feature = "cloud")]
     #[serde(skip_serializing_if = "Option::is_none")]
     pub budget_config: Option<Vec<BudgetNotificationConfiguration>>,
 }
@@ -592,6 +602,12 @@ pub struct OrganizationSetting {
     pub domain_org_mappings: Vec<DomainOrgMapping>,
     #[cfg(feature = "cloud")]
     #[serde(default)]
+    pub enforce_allowed_orgs_only: bool,
+    #[cfg(feature = "cloud")]
+    #[serde(default)]
+    pub domain_management_config: DomainManagementConfig,
+    #[cfg(feature = "cloud")]
+    #[serde(default)]
     pub budget_config: Vec<BudgetNotificationConfiguration>,
 }
 
@@ -631,6 +647,10 @@ impl Default for OrganizationSetting {
             #[cfg(feature = "cloud")]
             domain_org_mappings: Vec::new(),
             #[cfg(feature = "cloud")]
+            domain_management_config: Default::default(),
+            #[cfg(feature = "cloud")]
+            enforce_allowed_orgs_only: false,
+            #[cfg(feature = "cloud")]
             budget_config: Vec::new(),
         }
     }
@@ -1474,7 +1494,13 @@ mod tests {
             #[cfg(feature = "enterprise")]
             claim_parser_function: None,
             cross_links: None,
+            #[cfg(feature = "cloud")]
             domain_org_mappings: None,
+            #[cfg(feature = "cloud")]
+            domain_management_config: None,
+            #[cfg(feature = "cloud")]
+            enforce_allowed_orgs_only: None,
+            #[cfg(feature = "cloud")]
             budget_config: None,
         };
         let json = serde_json::to_value(&payload).unwrap();
@@ -1558,6 +1584,10 @@ mod tests {
             #[cfg(feature = "cloud")]
             domain_org_mappings: vec![],
             #[cfg(feature = "cloud")]
+            domain_management_config: Default::default(),
+            #[cfg(feature = "cloud")]
+            enforce_allowed_orgs_only: false,
+            #[cfg(feature = "cloud")]
             budget_config: vec![],
         };
         let json = serde_json::to_value(&setting).unwrap();
@@ -1592,6 +1622,10 @@ mod tests {
             #[cfg(feature = "cloud")]
             domain_org_mappings: vec![],
             #[cfg(feature = "cloud")]
+            domain_management_config: Default::default(),
+            #[cfg(feature = "cloud")]
+            enforce_allowed_orgs_only: false,
+            #[cfg(feature = "cloud")]
             budget_config: vec![],
         };
         let json = serde_json::to_value(&setting).unwrap();
diff --git a/src/config/src/config.rs b/src/config/src/config.rs
index 5a8a766c06..7c3f9ad8df 100644
--- a/src/config/src/config.rs
+++ b/src/config/src/config.rs
@@ -126,7 +126,10 @@ pub type RwBTreeMap<K, V> = tokio::sync::RwLock<BTreeMap<K, V>>;
 // 126: add held_action to slack_link_requests.
 // 127: add group_label_set to alert_states.
 // 128: widen alert_dedup_state.fingerprint to varchar(256).
-pub const DB_SCHEMA_VERSION: u64 = 128;
+// 129: add source, query_key, streams, run_count, updated_at and status to query_history.
+// 130: add suppress_repeats to alerts.
+// 131: org domain mapping migrations
+pub const DB_SCHEMA_VERSION: u64 = 131;
 pub const DB_SCHEMA_KEY: &str = "/db_schema_version/";
 
 // global version variables
@@ -526,6 +529,11 @@ pub const SYNTHETICS_RELOAD_CLASSES: &[(&str, SyntheticsReloadClass)] = &[
         "ZO_SYNTHETICS_ORPHAN_DETECTION_ENABLED",
         SyntheticsReloadClass::Hot,
     ),
+    ("ZO_SYNTHETICS_LEASE_BATCH_SIZE", SyntheticsReloadClass::Hot),
+    (
+        "ZO_SYNTHETICS_MAX_INFLIGHT_PER_TICK",
+        SyntheticsReloadClass::Hot,
+    ),
     // Were `HotViaLimits` while these lived in `o2_enterprise` and had to be
     // pushed across a seam into this crate. They are declared here now, so the
     // seam and its class are both gone and they are plainly `Hot`.
@@ -580,6 +588,8 @@ pub(crate) fn synthetics_restart_required_changes(
         devices: _,
         scheduler_jitter_enabled: _,
         orphan_detection_enabled: _,
+        lease_batch_size: _,
+        max_inflight_per_tick: _,
     } = new;
 
     let mut changed = Vec::new();
@@ -1126,14 +1136,14 @@ impl PublicAiChat {
     }
 }
 
-/// Background self CPU/memory profile ingest into `_meta.self_profiles`.
-/// Gated at runtime by `enabled`; sampling code is compile-gated on `profiling`.
+/// Background self CPU/memory profile ingest into the `default` profiles stream.
+/// Gated at runtime by `enabled`; CPU needs `cpu-profiling`, memory needs `profiling`.
 #[derive(Debug, Serialize, EnvConfig, Default)]
 pub struct SelfProfiles {
     #[env_config(
         name = "ZO_SELF_PROFILES_ENABLED",
         default = false,
-        help = "Enable background self CPU/memory profile sampling into _meta.self_profiles"
+        help = "Enable background self CPU/memory profile sampling into the default profiles stream"
     )]
     pub enabled: bool,
     #[env_config(
@@ -1493,6 +1503,23 @@ pub struct Synthetics {
         help = "Kill switch for orphan detection, which reports enabled checks no scheduler is claiming."
     )]
     pub orphan_detection_enabled: bool,
+    /// Jobs leased per pool in one dispatcher lease call. Must be > 0; a
+    /// non-positive value falls back to the default. Read per tick.
+    #[env_config(
+        name = "ZO_SYNTHETICS_LEASE_BATCH_SIZE",
+        default = 10,
+        help = "Jobs the dispatcher leases per pool per lease call. Must be greater than 0."
+    )]
+    pub lease_batch_size: i64,
+    /// Upper bound on jobs the dispatcher leases across all pools in one tick.
+    /// While a pool's batch comes back full the dispatcher keeps leasing, up to
+    /// this cap. Must be > 0; a non-positive value falls back to the default.
+    #[env_config(
+        name = "ZO_SYNTHETICS_MAX_INFLIGHT_PER_TICK",
+        default = 100,
+        help = "Cap on jobs the dispatcher leases across all pools in one 2s tick. Must be greater than 0."
+    )]
+    pub max_inflight_per_tick: i64,
 }
 
 /// Feature 5 — SLO measurement (`alerts_2.md` §6b).
@@ -2911,7 +2938,7 @@ pub struct Limit {
     #[env_config(
         name = "ZO_QUERY_HISTORY_RETENTION_DAYS",
         default = 14,
-        help = "How long unstarred query history entries are kept, in days. Starred entries are kept until deleted. 0 or less keeps every entry forever; it does not stop collection, ZO_QUERY_HISTORY_ENABLED=false does."
+        help = "How long unstarred query history entries are kept, in days. Starred entries are kept until deleted. 0 or less removes the age limit; each user still keeps at most 500 unstarred entries per source (logs, traces, metrics, dbm, profiles), the oldest of that source pruned first. It does not stop collection, ZO_QUERY_HISTORY_ENABLED=false does."
     )]
     pub query_history_retention_days: i64,
     #[env_config(name = "ZO_ALERT_SCHEDULE_TIMEOUT", default = 90)] // seconds
@@ -5270,6 +5297,21 @@ fn check_synthetics_config(cfg: &mut Config) {
         cfg.synthetics.max_net_timeout_ms = crate::meta::synthetics::DEFAULT_MAX_NET_TIMEOUT_MS;
     }
 
+    if cfg.synthetics.lease_batch_size <= 0 {
+        log::error!(
+            "ZO_SYNTHETICS_LEASE_BATCH_SIZE ({}) must be greater than 0, using 10",
+            cfg.synthetics.lease_batch_size
+        );
+        cfg.synthetics.lease_batch_size = 10;
+    }
+    if cfg.synthetics.max_inflight_per_tick <= 0 {
+        log::error!(
+            "ZO_SYNTHETICS_MAX_INFLIGHT_PER_TICK ({}) must be greater than 0, using 100",
+            cfg.synthetics.max_inflight_per_tick
+        );
+        cfg.synthetics.max_inflight_per_tick = 100;
+    }
+
     // Every synthetics var now has exactly one name, in every build — which
     // means an OSS user can set a private-agent var and get silence back. One
     // line per var is the difference between "configured and ignored" and
@@ -5450,6 +5492,8 @@ mod tests {
         "ZO_SYNTHETICS_DEVICES",
         "ZO_SYNTHETICS_SCHEDULER_JITTER_ENABLED",
         "ZO_SYNTHETICS_ORPHAN_DETECTION_ENABLED",
+        "ZO_SYNTHETICS_LEASE_BATCH_SIZE",
+        "ZO_SYNTHETICS_MAX_INFLIGHT_PER_TICK",
     ];
 
     fn synthetics_names_in_class(class: SyntheticsReloadClass) -> Vec<&'static str> {
@@ -5469,8 +5513,8 @@ mod tests {
     fn synthetics_reload_classification_is_pinned() {
         assert_eq!(
             SYNTHETICS_RELOAD_CLASSES.len(),
-            16,
-            "Synthetics has 16 keys; every one needs a reload class"
+            18,
+            "Synthetics has 18 keys; every one needs a reload class"
         );
 
         let mut classified: Vec<&str> = SYNTHETICS_RELOAD_CLASSES
@@ -5502,7 +5546,9 @@ mod tests {
                 "ZO_SYNTHETICS_JOB_LEASE_SECS",
                 "ZO_SYNTHETICS_LAMBDA_BROWSER",
                 "ZO_SYNTHETICS_LAMBDA_NET",
+                "ZO_SYNTHETICS_LEASE_BATCH_SIZE",
                 "ZO_SYNTHETICS_MAX_CHECK_BUDGET_SECS",
+                "ZO_SYNTHETICS_MAX_INFLIGHT_PER_TICK",
                 "ZO_SYNTHETICS_MAX_NET_TIMEOUT_MS",
                 "ZO_SYNTHETICS_ORPHAN_DETECTION_ENABLED",
                 "ZO_SYNTHETICS_RECORDER_EXTENSION_URL",
@@ -5565,6 +5611,8 @@ mod tests {
         cfg.devices = "desktop:800:600".to_string();
         cfg.scheduler_jitter_enabled = !cfg.scheduler_jitter_enabled;
         cfg.orphan_detection_enabled = !cfg.orphan_detection_enabled;
+        cfg.lease_batch_size += 1;
+        cfg.max_inflight_per_tick += 1;
     }
 
     #[test]
diff --git a/src/config/src/meta/alerts/alert.rs b/src/config/src/meta/alerts/alert.rs
index 5e247c2ea2..44bef5ab8d 100644
--- a/src/config/src/meta/alerts/alert.rs
+++ b/src/config/src/meta/alerts/alert.rs
@@ -165,6 +165,10 @@ pub struct Alert {
     /// today. Named after Prometheus' `keep_firing_for`, with the same meaning.
     #[serde(default)]
     pub keep_firing_for: i64,
+
+    /// Notify once per state change; enterprise only, other builds ignore it.
+    #[serde(default)]
+    pub suppress_repeats: bool,
 }
 
 /// Accept a runbook link, or say why not.
@@ -266,11 +270,17 @@ impl Default for Alert {
             notify_on_recovery: false,
             recovery_destinations: vec![],
             keep_firing_for: 0,
+            suppress_repeats: false,
         }
     }
 }
 
 impl Alert {
+    /// Whether repeat notifications are withheld; other builds than enterprise ignore the switch.
+    pub fn suppresses_repeats(&self) -> bool {
+        cfg!(feature = "enterprise") && self.suppress_repeats
+    }
+
     /// Pending rule mode needs per-series state; the default count gate means any series.
     pub fn normalize_promql_rule_mode(&mut self) {
         if self.query_condition.query_type != super::QueryType::PromQL
@@ -1233,4 +1243,22 @@ mod tests {
         let json = serde_json::to_value(&alert).unwrap();
         assert!(json.get("runbook_url").is_none());
     }
+
+    #[cfg(not(feature = "enterprise"))]
+    #[test]
+    fn repeat_suppression_is_ignored_outside_enterprise() {
+        let alert = Alert {
+            suppress_repeats: true,
+            ..Default::default()
+        };
+        assert!(!alert.suppresses_repeats());
+    }
+
+    #[test]
+    fn an_alert_saved_before_repeat_suppression_reads_with_it_off() {
+        let mut stored = serde_json::to_value(Alert::default()).unwrap();
+        stored.as_object_mut().unwrap().remove("suppress_repeats");
+        let alert: Alert = serde_json::from_value(stored).unwrap();
+        assert!(!alert.suppress_repeats);
+    }
 }
diff --git a/src/config/src/meta/alerts/dispatch.rs b/src/config/src/meta/alerts/dispatch.rs
index e4194bb629..e7ad7f4e5d 100644
--- a/src/config/src/meta/alerts/dispatch.rs
+++ b/src/config/src/meta/alerts/dispatch.rs
@@ -112,6 +112,8 @@ pub struct DispatchPlan {
     pub inconsistent: Vec<String>,
     /// Groups that would deliver but a downtime mutes; also counted in `suppressed`.
     pub muted: Vec<String>,
+    /// Groups withheld because they repeat their last delivery; also counted in `suppressed`.
+    pub repeats: usize,
 }
 
 /// Decide which groups this evaluation notifies (MN-1, MN-8).
@@ -135,6 +137,7 @@ pub struct DispatchPlan {
 /// * `max_sends` is the MN-8 knob: `0` = unlimited; otherwise it counts **qualifying** sends
 ///   (applied after `delivery_decision`), worst-first.
 /// * A deliverable group `muted(key, decision, last_notified_level)` holds goes to `muted`, first.
+#[allow(clippy::too_many_arguments)]
 pub fn plan_dispatch(
     classification: &GroupClassification,
     states: &HashMap<String, AlertState>,
@@ -142,6 +145,7 @@ pub fn plan_dispatch(
     tc: &TriggerCondition,
     now: i64,
     max_sends: usize,
+    suppress_repeats: bool,
     muted: impl Fn(&str, &DeliveryDecision, Option<AlertLevel>) -> bool,
 ) -> DispatchPlan {
     let mut items = Vec::new();
@@ -150,6 +154,7 @@ pub fn plan_dispatch(
     let mut dropped_by_knob = Vec::new();
     let mut inconsistent = Vec::new();
     let mut muted_keys = Vec::new();
+    let mut repeats = 0usize;
 
     // A key appearing twice in one classification is an invariant violation
     // (validation rejects the known source, MN-12). Counting first means both
@@ -218,6 +223,17 @@ pub fn plan_dispatch(
                     muted_keys.push(key.clone());
                     continue;
                 }
+                if suppress_repeats
+                    && repeats_last_notification(
+                        level,
+                        state.episode_id.is_some(),
+                        state.last_notified_level,
+                    )
+                {
+                    suppressed += 1;
+                    repeats += 1;
+                    continue;
+                }
                 // The knob counts QUALIFYING sends, so a silenced group never
                 // spends budget a deliverable one could have used.
                 if max_sends > 0 && items.len() >= max_sends {
@@ -237,7 +253,8 @@ pub fn plan_dispatch(
             DeliveryDecision::SuppressedBySilence
             | DeliveryDecision::SuppressedByWarningPolicy
             | DeliveryDecision::SuppressedByDowntime(_)
-            | DeliveryDecision::SuppressedByAck(_) => suppressed += 1,
+            | DeliveryDecision::SuppressedByAck(_)
+            | DeliveryDecision::SuppressedAsRepeat => suppressed += 1,
             DeliveryDecision::SuppressedByPending => pending += 1,
             DeliveryDecision::NotFiring => {}
         }
@@ -250,9 +267,19 @@ pub fn plan_dispatch(
         dropped_by_knob,
         inconsistent,
         muted: muted_keys,
+        repeats,
     }
 }
 
+/// The open recovery episode was already notified at `level`, so this firing tells nothing new.
+pub fn repeats_last_notification(
+    level: AlertLevel,
+    episode_open: bool,
+    last_notified: Option<AlertLevel>,
+) -> bool {
+    episode_open && last_notified == Some(level)
+}
+
 /// The write that records one group's **successful** delivery (MN-6).
 ///
 /// Returns the full replacement row, or `None` when the carried **level-episode
@@ -744,6 +771,7 @@ mod tests {
             &tc(None),
             1_000 * SEC,
             0,
+            false,
             |_, _, _| false,
         );
 
@@ -769,9 +797,16 @@ mod tests {
         let c = classified(&[("crit", 150.0), ("ok1", 1.0), ("ok2", 2.0)], 500);
         let states = states_for(&c, now, None, None);
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert_eq!(plan.items.len(), 1);
         assert_eq!(
@@ -791,9 +826,16 @@ mod tests {
         let c = classified(&[("a", 150.0)], 500);
         let states = states_for(&c, now, None, None);
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert!(
             plan.items[0].escalation,
@@ -816,6 +858,7 @@ mod tests {
             &tc(None),
             1_000 * SEC,
             0,
+            false,
             |_, _, _| false,
         );
         let b = plan
@@ -841,6 +884,7 @@ mod tests {
             &tc(None),
             1_000 * SEC,
             0,
+            false,
             |_, _, _| false,
         );
         let keys: Vec<_> = plan.items.iter().map(|i| i.group_key.clone()).collect();
@@ -863,9 +907,16 @@ mod tests {
         let c = classified(&[("a", 150.0)], 500);
         let states = states_for(&c, now, Some(AlertLevel::Critical), Some(now + 10 * MIN));
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert!(plan.items.is_empty());
         assert_eq!(plan.suppressed, 1);
@@ -879,9 +930,16 @@ mod tests {
         let c = classified(&[("a", 150.0)], 500);
         let states = states_for(&c, now, Some(AlertLevel::Critical), Some(now - 1));
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert_eq!(plan.items.len(), 1);
         assert!(
@@ -898,9 +956,16 @@ mod tests {
         let c = classified(&[("a", 150.0)], 500);
         let states = states_for(&c, now, Some(AlertLevel::Warning), Some(now + 10 * MIN));
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert_eq!(plan.items.len(), 1);
         assert!(plan.items[0].escalation);
@@ -933,9 +998,16 @@ mod tests {
         assert!(row.is_firing(), "NotifyFailed is still a firing state");
 
         let states = HashMap::from([(key.clone(), row)]);
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert_eq!(
             plan.items.len(),
@@ -958,6 +1030,7 @@ mod tests {
             &tc(Some(false)),
             1_000 * SEC,
             0,
+            false,
             |_, _, _| false,
         );
 
@@ -999,7 +1072,9 @@ mod tests {
             ]),
         );
 
-        let plan = plan_dispatch(&c, &states, &rows, &tc(None), now, 0, |_, _, _| false);
+        let plan = plan_dispatch(&c, &states, &rows, &tc(None), now, 0, false, |_, _, _| {
+            false
+        });
 
         assert_eq!(plan.items.len(), 2, "only retained groups dispatch");
         assert!(
@@ -1030,9 +1105,16 @@ mod tests {
             state(ROLLUP_GROUP_KEY, AlertLevel::Critical, now, None, None),
         );
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert_eq!(plan.items.len(), 1, "one group fired, so one page");
         assert_eq!(plan.items[0].group_key, key_of("a"));
@@ -1060,9 +1142,16 @@ mod tests {
             state(&gone, AlertLevel::Critical, now - 5 * MIN, None, None),
         );
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert!(!plan.items.iter().any(|i| i.group_key == gone));
     }
@@ -1084,6 +1173,7 @@ mod tests {
             &tc(None),
             now,
             0,
+            false,
             |_, _, _| false,
         );
 
@@ -1111,6 +1201,7 @@ mod tests {
             &tc(None),
             now,
             0,
+            false,
             |_, _, _| false,
         );
 
@@ -1139,9 +1230,16 @@ mod tests {
         assert_eq!(c.groups.len(), 3, "fixture: `a` is observed twice");
 
         let states = states_for(&c, now, None, None);
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert!(
             !plan.items.iter().any(|i| i.group_key == key_of("a")),
@@ -1170,9 +1268,16 @@ mod tests {
         assert_eq!(c.groups.len(), 3, "fixture: `a` observed at two levels");
 
         let states = states_for(&c, now, None, None);
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         for item in &plan.items {
             assert_ne!(
@@ -1202,9 +1307,16 @@ mod tests {
         );
         let states = states_for(&c, now, None, None);
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 2, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            2,
+            false,
+            |_, _, _| false,
+        );
 
         assert_eq!(plan.items.len(), 2, "`b` and `c` both page");
         assert!(plan.dropped_by_knob.is_empty());
@@ -1219,7 +1331,9 @@ mod tests {
         let states = states_for(&c, now, None, None);
         let rows = rows_for(&c);
 
-        let plan = plan_dispatch(&c, &states, &rows, &tc(None), now, 0, |_, _, _| false);
+        let plan = plan_dispatch(&c, &states, &rows, &tc(None), now, 0, false, |_, _, _| {
+            false
+        });
 
         assert_eq!(
             &plan.items[0].row,
@@ -1243,9 +1357,16 @@ mod tests {
         row.level_at = Some(now); // freshness advanced by a later same-level run
         let states = HashMap::from([(key.clone(), row)]);
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |_, _, _| false,
+        );
 
         assert_eq!(
             plan.items[0].episode,
@@ -1270,6 +1391,7 @@ mod tests {
             &tc(None),
             1_000 * SEC,
             0,
+            false,
             |_, _, _| false,
         );
         assert_eq!(plan.items.len(), 3);
@@ -1290,6 +1412,7 @@ mod tests {
             &tc(None),
             1_000 * SEC,
             2,
+            false,
             |_, _, _| false,
         );
 
@@ -1324,9 +1447,16 @@ mod tests {
         let c = build();
         let states = states_for(&c, now, None, None);
 
-        let first = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 2, |_, _, _| {
-            false
-        });
+        let first = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            2,
+            false,
+            |_, _, _| false,
+        );
         let second = plan_dispatch(
             &build(),
             &states,
@@ -1334,6 +1464,7 @@ mod tests {
             &tc(None),
             now,
             2,
+            false,
             |_, _, _| false,
         );
 
@@ -1367,9 +1498,16 @@ mod tests {
             ),
         ]);
 
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 1, |_, _, _| {
-            false
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            1,
+            false,
+            |_, _, _| false,
+        );
 
         assert_eq!(plan.items.len(), 1);
         assert_eq!(plan.items[0].group_key, key_b);
@@ -1387,9 +1525,16 @@ mod tests {
         let (key_a, key_b) = (key_of("a"), key_of("b"));
         let states = states_for(&c, now, None, None);
         for _ in 0..2 {
-            let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 1, |k, _, _| {
-                k == key_a
-            });
+            let plan = plan_dispatch(
+                &c,
+                &states,
+                &rows_for(&c),
+                &tc(None),
+                now,
+                1,
+                false,
+                |k, _, _| k == key_a,
+            );
             assert_eq!(plan.items.len(), 1);
             assert_eq!(plan.items[0].group_key, key_b);
             assert_eq!(plan.suppressed, 1);
@@ -1408,7 +1553,7 @@ mod tests {
         let acked = |k: &str, d: &DeliveryDecision, last: Option<AlertLevel>| {
             (k == key_a || k == key_b) && d.ack_withholds(last)
         };
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, acked);
+        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, false, acked);
         assert_eq!(
             plan.muted,
             vec![key_a],
@@ -1428,9 +1573,16 @@ mod tests {
         let c = classified(&[("a", 150.0), ("b", 75.0)], 500);
         let (key_a, key_b) = (key_of("a"), key_of("b"));
         let states = states_for(&c, now, None, None);
-        let plan = plan_dispatch(&c, &states, &rows_for(&c), &tc(None), now, 0, |k, _, _| {
-            k == key_a
-        });
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            now,
+            0,
+            false,
+            |k, _, _| k == key_a,
+        );
         assert_eq!(plan.items.len(), 1);
         assert_eq!(plan.items[0].group_key, key_b);
         assert_eq!(plan.muted, vec![key_a]);
@@ -2185,4 +2337,109 @@ mod tests {
         assert_eq!(back, episode);
         assert_eq!(back.notified_at_enqueue, (None, None));
     }
+
+    // ═════════════════════════════════════════════════════════════════════
+    // suppress_repeats — notify once per state change
+    // ═════════════════════════════════════════════════════════════════════
+
+    #[test]
+    fn only_the_notified_level_inside_an_open_episode_is_a_repeat() {
+        use AlertLevel::{Critical, Warning};
+        // Still firing at the delivered level, or back at it inside a keep_firing_for hold.
+        assert!(repeats_last_notification(Critical, true, Some(Critical)));
+        // Escalated or de-escalated since the last delivery.
+        assert!(!repeats_last_notification(Critical, true, Some(Warning)));
+        assert!(!repeats_last_notification(Warning, true, Some(Critical)));
+        // The episode closed on a recovery: a new incident.
+        assert!(!repeats_last_notification(Critical, false, Some(Critical)));
+        // Nothing was ever delivered.
+        assert!(!repeats_last_notification(Critical, false, None));
+    }
+
+    #[test]
+    fn a_repeat_is_withheld_like_a_downtime_or_an_ack() {
+        assert!(DeliveryDecision::SuppressedAsRepeat.withheld());
+        assert!(DeliveryDecision::SuppressedByAck("u".into()).withheld());
+        assert!(!DeliveryDecision::SuppressedBySilence.withheld());
+        assert!(!DeliveryDecision::Deliver.withheld());
+    }
+
+    /// Every group of `c` delivered at Critical, inside an open recovery episode.
+    fn notified_states(c: &GroupClassification) -> HashMap<String, AlertState> {
+        let mut states = states_for(c, MIN, Some(AlertLevel::Critical), None);
+        for row in states.values_mut() {
+            row.episode_id = Some("ep-1".to_string());
+        }
+        states
+    }
+
+    #[test]
+    fn plan_dispatch_withholds_a_repeat_only_when_the_switch_is_on() {
+        let c = classified(&[("a", 150.0)], 500);
+        let states = notified_states(&c);
+        let plan = |on| {
+            plan_dispatch(
+                &c,
+                &states,
+                &rows_for(&c),
+                &tc(None),
+                10 * MIN,
+                0,
+                on,
+                |_, _, _| false,
+            )
+        };
+
+        assert_eq!(
+            plan(false).items.len(),
+            1,
+            "silence 0 and the switch off page again"
+        );
+        let on = plan(true);
+        assert!(on.items.is_empty());
+        assert_eq!((on.suppressed, on.repeats), (1, 1));
+    }
+
+    #[test]
+    fn a_repeat_does_not_spend_the_send_budget() {
+        // `a` repeats; `b` fires for the first time and must get the single slot.
+        let c = classified(&[("a", 150.0), ("b", 150.0)], 500);
+        let mut states = states_for(&c, MIN, None, None);
+        let a = states.get_mut(&key_of("a")).unwrap();
+        a.last_notified_level = Some(AlertLevel::Critical);
+        a.episode_id = Some("ep-1".to_string());
+
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            10 * MIN,
+            1,
+            true,
+            |_, _, _| false,
+        );
+        assert_eq!(plan.items.len(), 1);
+        assert_eq!(plan.items[0].group_key, key_of("b"));
+        assert!(plan.dropped_by_knob.is_empty());
+        assert_eq!(plan.repeats, 1);
+    }
+
+    #[test]
+    fn a_muted_group_is_reported_muted_not_repeated() {
+        let c = classified(&[("a", 150.0)], 500);
+        let states = notified_states(&c);
+        let plan = plan_dispatch(
+            &c,
+            &states,
+            &rows_for(&c),
+            &tc(None),
+            10 * MIN,
+            0,
+            true,
+            |_, _, _| true,
+        );
+        assert_eq!(plan.muted, vec![key_of("a")]);
+        assert_eq!(plan.repeats, 0);
+    }
 }
diff --git a/src/config/src/meta/alerts/level.rs b/src/config/src/meta/alerts/level.rs
index a77d64fa97..0b981e99a4 100644
--- a/src/config/src/meta/alerts/level.rs
+++ b/src/config/src/meta/alerts/level.rs
@@ -366,6 +366,8 @@ pub enum DeliveryDecision {
     SuppressedByDowntime(String),
     /// The current firing is acknowledged by this user; repeats are withheld.
     SuppressedByAck(String),
+    /// `suppress_repeats` is on and nothing changed since the last delivered notification.
+    SuppressedAsRepeat,
 }
 
 impl DeliveryDecision {
@@ -385,6 +387,14 @@ impl DeliveryDecision {
         }
     }
 
+    /// Withheld by a downtime, an ack or as a repeat, rather than by the level decision.
+    pub fn withheld(&self) -> bool {
+        matches!(
+            self,
+            Self::SuppressedByDowntime(_) | Self::SuppressedByAck(_) | Self::SuppressedAsRepeat
+        )
+    }
+
     pub fn acked_by(&self) -> Option<&str> {
         match self {
             Self::SuppressedByAck(by) => Some(by),
diff --git a/src/config/src/meta/dashboards/v8/mod.rs b/src/config/src/meta/dashboards/v8/mod.rs
index 57384779c8..8abb67ea34 100644
--- a/src/config/src/meta/dashboards/v8/mod.rs
+++ b/src/config/src/meta/dashboards/v8/mod.rs
@@ -480,6 +480,10 @@ pub struct FilterCondition {
     pub value: Option<String>,
     pub logical_operator: String,
     pub filter_type: String,
+    /// Set when `value` is an explicit `''` from SQL, so the builder keeps `x <> ''`
+    /// instead of treating the empty value as "not entered yet".
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub empty_literal: Option<bool>,
 }
 
 #[derive(Debug, Clone, PartialEq, Hash, Serialize, Deserialize, ToSchema)]
@@ -810,6 +814,22 @@ pub struct PanelConfig {
     #[serde(skip_serializing_if = "Option::is_none")]
     flame_graph_value_field: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    boxplot_whisker: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    logs_message_field: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    logs_level_field: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    logs_time_field: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    logs_wrap: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    logs_prettify_json: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    logs_show_time: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    logs_order: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     hostmap_entity_label: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     hostmap_group_by: Option<Vec<String>>,
@@ -1556,6 +1576,39 @@ mod tests {
         assert_eq!(again, d);
     }
 
+    #[test]
+    fn test_filter_condition_empty_literal_roundtrip() {
+        let kept = serde_json::json!({
+            "type": "condition",
+            "values": [],
+            "column": { "field": "service_name", "streamAlias": null },
+            "operator": "<>",
+            "value": "",
+            "logicalOperator": "AND",
+            "filterType": "condition",
+            "emptyLiteral": true
+        });
+        let filter: PanelFilter = serde_json::from_value(kept).unwrap();
+        match &filter {
+            PanelFilter::Condition(c) => assert_eq!(c.empty_literal, Some(true)),
+            PanelFilter::Group(_) => panic!("expected a condition"),
+        }
+        assert_eq!(serde_json::to_value(&filter).unwrap()["emptyLiteral"], true);
+
+        let plain = serde_json::json!({
+            "type": "condition",
+            "values": [],
+            "column": { "field": "service_name", "streamAlias": null },
+            "operator": "=",
+            "value": "",
+            "logicalOperator": "AND",
+            "filterType": "condition"
+        });
+        let filter: PanelFilter = serde_json::from_value(plain).unwrap();
+        let back = serde_json::to_value(&filter).unwrap();
+        assert!(!back.as_object().unwrap().contains_key("emptyLiteral"));
+    }
+
     #[test]
     fn test_annotation_sources_change_the_hash() {
         let plain: super::super::Dashboard = make_dashboard().into();
@@ -3022,7 +3075,15 @@ mod tests {
         });
         let rest4 = serde_json::json!({
             "flame_graph_stack_field": "stack",
-            "flame_graph_value_field": "samples"
+            "flame_graph_value_field": "samples",
+            "boxplot_whisker": "iqr",
+            "logs_message_field": "message",
+            "logs_level_field": "level",
+            "logs_time_field": "_timestamp",
+            "logs_wrap": true,
+            "logs_prettify_json": false,
+            "logs_show_time": true,
+            "logs_order": "oldest"
         });
         for part in [rest, rest2, rest3, rest4] {
             fields
diff --git a/src/config/src/meta/fleet.rs b/src/config/src/meta/fleet.rs
index 2b96feff45..1909e1670b 100644
--- a/src/config/src/meta/fleet.rs
+++ b/src/config/src/meta/fleet.rs
@@ -69,7 +69,7 @@ pub struct Collector {
     pub version: Option<String>,
     pub outdated: bool,
     pub status: CollectorStatus,
-    /// The connection's peer address, honouring `X-Forwarded-For`.
+    /// The connection's client address, as `ZO_HTTP_REAL_IP_SOURCE` resolves it.
     pub last_connected_from: Option<String>,
     pub fleet: CollectorFleet,
     pub token_id: Option<String>,
diff --git a/src/config/src/meta/public_dashboards.rs b/src/config/src/meta/public_dashboards.rs
index 1ab0d08b46..ee428e750c 100644
--- a/src/config/src/meta/public_dashboards.rs
+++ b/src/config/src/meta/public_dashboards.rs
@@ -413,9 +413,12 @@ pub struct KeyedRange {
     pub refresh_secs: i64,
 }
 
-/// A dashboard variable as the public viewer sees it: display label and frozen value only.
+/// A dashboard variable as the public viewer sees it: name, display label and frozen value only.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct PublicVariable {
+    /// The name panel titles reference as `$name`; empty in a result stored before it was added.
+    #[serde(default)]
+    pub name: String,
     pub label: String,
     pub value: serde_json::Value,
     /// Set for a tab-scoped variable: the tab this value belongs to.
@@ -472,6 +475,7 @@ impl PublicVariable {
                     .into_iter()
                     .map(|(key, tab_id, panel_id)| {
                         let entry = Self {
+                            name: v.name.clone(),
                             label: label.clone(),
                             value: values.get(&key).cloned().unwrap_or(serde_json::Value::Null),
                             tab_id,
@@ -750,6 +754,34 @@ mod tests {
         assert_eq!(cfg.refresh_secs, 300);
     }
 
+    #[test]
+    fn public_variables_carry_the_name_panel_titles_reference() {
+        let dash = Dashboard {
+            v8: Some(
+                serde_json::from_value(serde_json::json!({
+                    "variables": { "list": [
+                        { "type": "custom", "name": "level", "label": "Level" },
+                        { "type": "custom", "name": "svc", "scope": "tabs", "tabs": ["t1"] }
+                    ] }
+                }))
+                .unwrap(),
+            ),
+            ..Default::default()
+        };
+        let values = BTreeMap::from([("level".to_string(), serde_json::json!("error"))]);
+        let list = PublicVariable::list(&dash, &values);
+        let names: Vec<(&str, &str)> = list
+            .iter()
+            .map(|v| (v.name.as_str(), v.label.as_str()))
+            .collect();
+        assert_eq!(names, [("level", "Level"), ("svc", "svc")]);
+        assert_eq!(serde_json::to_value(&list[0]).unwrap()["name"], "level");
+        let stored: PublicVariable =
+            serde_json::from_value(serde_json::json!({ "label": "Level", "value": "error" }))
+                .unwrap();
+        assert_eq!(stored.name, "");
+    }
+
     #[test]
     fn identity_names_the_org() {
         assert_eq!(
diff --git a/src/config/src/meta/self_reporting/mod.rs b/src/config/src/meta/self_reporting/mod.rs
index 187de9df48..d202fdb155 100644
--- a/src/config/src/meta/self_reporting/mod.rs
+++ b/src/config/src/meta/self_reporting/mod.rs
@@ -405,6 +405,7 @@ mod tests {
             ack_source: None,
             taken_over_from: None,
             delivery_attempted: None,
+            repeat_suppressed: None,
             trigger_source: None,
             triggered_by: None,
             recipient_count: None,
@@ -965,6 +966,7 @@ mod tests {
             ack_source: None,
             taken_over_from: None,
             delivery_attempted: None,
+            repeat_suppressed: None,
             trigger_source: None,
             triggered_by: None,
             recipient_count: None,
@@ -1057,6 +1059,7 @@ mod tests {
             ack_source: None,
             taken_over_from: None,
             delivery_attempted: None,
+            repeat_suppressed: None,
             trigger_source: None,
             triggered_by: None,
             recipient_count: None,
@@ -1133,6 +1136,7 @@ mod tests {
             ack_source: None,
             taken_over_from: None,
             delivery_attempted: None,
+            repeat_suppressed: None,
             trigger_source: None,
             triggered_by: None,
             recipient_count: None,
diff --git a/src/config/src/meta/self_reporting/usage.rs b/src/config/src/meta/self_reporting/usage.rs
index 703e85cc2f..8724dbf3e9 100644
--- a/src/config/src/meta/self_reporting/usage.rs
+++ b/src/config/src/meta/self_reporting/usage.rs
@@ -354,6 +354,9 @@ pub struct TriggerData {
     /// Whether a firing tried a destination, workflow or incident notification; None on old rows.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub delivery_attempted: Option<bool>,
+    /// Set when `suppress_repeats` withheld a notification that repeated the last delivered state.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub repeat_suppressed: Option<bool>,
     /// "scheduled" or "manual"; None on older rows, which read as scheduled.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub trigger_source: Option<String>,
@@ -413,6 +416,7 @@ impl Default for TriggerData {
             ack_source: None,
             taken_over_from: None,
             delivery_attempted: None,
+            repeat_suppressed: None,
             trigger_source: None,
             triggered_by: None,
             recipient_count: None,
@@ -473,6 +477,7 @@ impl TriggerData {
             ack_source: Some(AckSource::Api),
             taken_over_from: Some(String::new()),
             delivery_attempted: Some(true),
+            repeat_suppressed: None,
             trigger_source: Some(String::new()),
             triggered_by: Some(String::new()),
             recipient_count: Some(0),
@@ -1915,6 +1920,7 @@ mod tests {
             ack_source: None,
             taken_over_from: None,
             delivery_attempted: None,
+            repeat_suppressed: None,
             trigger_source: None,
             triggered_by: None,
             recipient_count: None,
diff --git a/src/config/src/meta/status_pages.rs b/src/config/src/meta/status_pages.rs
index 944f9128c8..d426f41e74 100644
--- a/src/config/src/meta/status_pages.rs
+++ b/src/config/src/meta/status_pages.rs
@@ -46,6 +46,10 @@ pub const CHECK_STATUS_UNKNOWN: i32 = 0;
 pub const CHECK_STATUS_UP: i32 = 1;
 pub const CHECK_STATUS_WARNING: i32 = 2;
 pub const CHECK_STATUS_DOWN: i32 = 3;
+/// The probe could not produce a verdict (dispatch dead-letter, expired lease,
+/// infra fault). Says nothing about the target: it never opens an incident and
+/// never counts toward recovery. Written by the dispatcher and the reaper.
+pub const CHECK_STATUS_ERROR: i32 = 4;
 
 const MICROS_PER_MIN: i64 = 60 * 1_000_000;
 const MICROS_PER_DAY: i64 = 86_400 * 1_000_000;
@@ -120,6 +124,10 @@ pub struct EngineCheck {
     pub first_fail_at: Option<i64>,
     /// When the streak started failing, for time-based confirmation.
     pub failing_since: Option<i64>,
+    /// True only when this tick sees a run result it has not seen before.
+    /// Recovery advances on distinct results, never on rebuild ticks, so the
+    /// same UP observed over ten ticks counts once.
+    pub fresh_result: bool,
 }
 
 /// An auto-incident notice currently open (or just resolved, for the merge
@@ -535,12 +543,33 @@ pub fn incident_actions(
     snoozed: &HashSet<String>,
     th: &Thresholds,
     now: i64,
+) -> Vec<EngineAction> {
+    incident_actions_with(
+        checks,
+        open_by_check,
+        recently_resolved,
+        snoozed,
+        |_| *th,
+        now,
+    )
+}
+
+/// [`incident_actions`] with per-check thresholds (each check is judged by the
+/// confirmation settings of the page(s) it is mapped to).
+pub fn incident_actions_with(
+    checks: &[EngineCheck],
+    open_by_check: &HashMap<String, OpenAutoIncident>,
+    recently_resolved: &HashMap<String, (String, i64)>,
+    snoozed: &HashSet<String>,
+    th_for: impl Fn(&str) -> Thresholds,
+    now: i64,
 ) -> Vec<EngineAction> {
     let mut actions = Vec::new();
     for check in checks {
+        let th = th_for(&check.id);
         match open_by_check.get(&check.id) {
-            Some(open) => handle_open(check, open, th, now, &mut actions),
-            None => handle_closed(check, recently_resolved, snoozed, th, now, &mut actions),
+            Some(open) => handle_open(check, open, &th, now, &mut actions),
+            None => handle_closed(check, recently_resolved, snoozed, &th, now, &mut actions),
         }
     }
     actions
@@ -568,7 +597,16 @@ fn handle_open(
     now: i64,
     actions: &mut Vec<EngineAction>,
 ) {
-    if check.last_check_status == CHECK_STATUS_UP {
+    // UP and WARNING both mean the target answered: they advance recovery, but
+    // only on a result this loop has not counted yet.
+    let healthy = matches!(
+        check.last_check_status,
+        CHECK_STATUS_UP | CHECK_STATUS_WARNING
+    );
+    if healthy {
+        if !check.fresh_result {
+            return;
+        }
         let streak = open.recovery_streak + 1;
         if streak >= th.confirm_recovery {
             actions.push(EngineAction::Resolve {
@@ -581,8 +619,14 @@ fn handle_open(
                 streak,
             });
         }
-    } else if check.last_check_status == CHECK_STATUS_DOWN && open.recovery_streak > 0 {
-        // Failed again mid-recovery: the streak restarts from zero.
+    } else if matches!(
+        check.last_check_status,
+        CHECK_STATUS_DOWN | CHECK_STATUS_ERROR
+    ) && open.recovery_streak > 0
+    {
+        // Failed again mid-recovery: the streak restarts from zero. ERROR does
+        // the same: an unknown verdict cannot prove recovery, so UP, ERROR, UP
+        // is not two consecutive good results. The incident stays open.
         actions.push(EngineAction::RecoveryProgress {
             notice_id: open.notice_id.clone(),
             streak: 0,
@@ -761,9 +805,119 @@ mod tests {
             consecutive_failures: streak,
             first_fail_at: None,
             failing_since: None,
+            fresh_result: true,
         }
     }
 
+    fn open_inc(streak: i32) -> HashMap<String, OpenAutoIncident> {
+        [(
+            "c1".to_string(),
+            OpenAutoIncident {
+                notice_id: "n1".into(),
+                check_id: "c1".into(),
+                recovery_streak: streak,
+            },
+        )]
+        .into()
+    }
+
+    /// Replays results against an open incident, applying RecoveryProgress
+    /// back into the streak; returns whether it resolved.
+    fn replay(statuses: &[(i32, bool)], th: Thresholds) -> bool {
+        let mut streak = 0;
+        for &(status, fresh) in statuses {
+            let mut c = check("c1", status, 0);
+            c.fresh_result = fresh;
+            let acts = incident_actions(
+                &[c],
+                &open_inc(streak),
+                &HashMap::new(),
+                &HashSet::new(),
+                &th,
+                0,
+            );
+            for a in acts {
+                match a {
+                    EngineAction::Resolve { .. } => return true,
+                    EngineAction::RecoveryProgress { streak: s, .. } => streak = s,
+                    _ => panic!("unexpected {a:?}"),
+                }
+            }
+        }
+        false
+    }
+
+    fn th(failures: i32, recovery: i32) -> Thresholds {
+        Thresholds {
+            confirm_failures: failures,
+            confirm_recovery: recovery,
+            confirm_after_micros: None,
+        }
+    }
+
+    #[test]
+    fn up_error_up_does_not_resolve_with_recovery_two() {
+        let s = CHECK_STATUS_UP;
+        let e = CHECK_STATUS_ERROR;
+        assert!(!replay(&[(s, true), (e, true), (s, true)], th(3, 2)));
+        assert!(replay(
+            &[(s, true), (e, true), (s, true), (s, true)],
+            th(3, 2)
+        ));
+    }
+
+    #[test]
+    fn error_never_opens_an_incident() {
+        let c = check("c1", CHECK_STATUS_ERROR, 50);
+        let acts = incident_actions(
+            &[c],
+            &HashMap::new(),
+            &HashMap::new(),
+            &HashSet::new(),
+            &th(1, 1),
+            0,
+        );
+        assert!(acts.is_empty());
+    }
+
+    #[test]
+    fn error_keeps_an_open_incident_open() {
+        let e = CHECK_STATUS_ERROR;
+        assert!(!replay(&[(e, true); 10], th(3, 1)));
+    }
+
+    #[test]
+    fn warning_advances_recovery() {
+        let w = CHECK_STATUS_WARNING;
+        assert!(replay(&[(w, true), (w, true)], th(3, 2)));
+    }
+
+    #[test]
+    fn the_same_result_over_many_ticks_counts_once() {
+        let mut ticks = vec![(CHECK_STATUS_UP, true)];
+        ticks.extend(std::iter::repeat_n((CHECK_STATUS_UP, false), 20));
+        assert!(!replay(&ticks, th(3, 2)));
+        ticks.push((CHECK_STATUS_UP, true));
+        assert!(replay(&ticks, th(3, 2)));
+    }
+
+    #[test]
+    fn seven_failures_four_recoveries() {
+        let t = th(7, 4);
+        let none = HashMap::new();
+        let quiet = HashSet::new();
+        let six = [check("c1", CHECK_STATUS_DOWN, 6)];
+        assert!(incident_actions(&six, &none, &HashMap::new(), &quiet, &t, 0).is_empty());
+        let seven = [check("c1", CHECK_STATUS_DOWN, 7)];
+        assert_eq!(
+            incident_actions(&seven, &none, &HashMap::new(), &quiet, &t, 0).len(),
+            1
+        );
+        let up = CHECK_STATUS_UP;
+        assert!(!replay(&[(up, true); 3], t));
+        assert!(replay(&[(up, true); 4], t));
+    }
+
     #[test]
     fn union_counts_overlaps_once() {
         // Two checks confirm the same outage: 10:00-10:30 and 10:10-10:40.
diff --git a/src/config/src/meta/user.rs b/src/config/src/meta/user.rs
index 6454a1dc80..5869dfb25e 100644
--- a/src/config/src/meta/user.rs
+++ b/src/config/src/meta/user.rs
@@ -153,7 +153,10 @@ impl FromStr for UserRole {
             "user" | "allowed_user" => Ok(UserRole::User),
             "service_account" => Ok(UserRole::ServiceAccount),
             "sre_agent" => Ok(UserRole::SreAgent),
+            #[cfg(not(feature = "enterprise"))]
             _ => Ok(UserRole::Admin),
+            #[cfg(feature = "enterprise")]
+            _ => Ok(UserRole::User),
         }
     }
 }
@@ -413,9 +416,18 @@ mod tests {
 
         #[test]
         fn test_invalid_string_defaults_to_admin() {
+            #[cfg(feature = "enterprise")]
+            assert_eq!(UserRole::from_str("invalid").unwrap(), UserRole::User);
+            #[cfg(not(feature = "enterprise"))]
             assert_eq!(UserRole::from_str("invalid").unwrap(), UserRole::Admin);
+            #[cfg(feature = "enterprise")]
+            assert_eq!(UserRole::from_str("").unwrap(), UserRole::User);
+            #[cfg(not(feature = "enterprise"))]
             assert_eq!(UserRole::from_str("").unwrap(), UserRole::Admin);
+            #[cfg(not(feature = "enterprise"))]
             assert_eq!(UserRole::from_str("Admin").unwrap(), UserRole::Admin); // case sensitive
+            #[cfg(feature = "enterprise")]
+            assert_eq!(UserRole::from_str("Admin").unwrap(), UserRole::User); // case sensitive
         }
     }
 
diff --git a/src/config/src/utils/str.rs b/src/config/src/utils/str.rs
index 60f5cca90a..46d5142756 100644
--- a/src/config/src/utils/str.rs
+++ b/src/config/src/utils/str.rs
@@ -34,11 +34,19 @@ pub static EMAIL_REGEX: LazyLock<Regex> = LazyLock::new(|| {
     .unwrap()
 });
 
+pub static DOMAIN_REGEX: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r"^([a-zA-Z0-9]+([\-\.][a-zA-Z0-9]+)*\.[a-zA-Z]{2,63})$").unwrap());
+
 /// Returns true if `email` is syntactically valid per [`EMAIL_REGEX`].
 pub fn is_valid_email(email: &str) -> bool {
     EMAIL_REGEX.is_match(email)
 }
 
+/// Returns true if `domain` is syntactically valid per [`DOMAIN_REGEX`].
+pub fn is_valid_domain(domain: &str) -> bool {
+    DOMAIN_REGEX.is_match(domain)
+}
+
 /// Characters an OpenFGA object id cannot represent. Detection
 /// ([`is_ofga_unsupported`]) and sanitization ([`into_ofga_supported_format`])
 /// share this pattern so they always agree on what is unsafe.
diff --git a/src/core/Cargo.toml b/src/core/Cargo.toml
index 2bd451861a..816cd6f0bd 100644
--- a/src/core/Cargo.toml
+++ b/src/core/Cargo.toml
@@ -48,9 +48,10 @@ vectorscan = [
 ]
 # Lets dependants' tests install a fake stream access checker; never enabled outside dev-dependencies.
 test-utils = []
+cpu-profiling = ["dep:pprof"]
 profiling = [
+    "cpu-profiling",
     "dep:jemalloc_pprof",
-    "dep:pprof",
     "dep:tikv-jemalloc-ctl",
 ]
 
diff --git a/src/core/src/alerts/alert.rs b/src/core/src/alerts/alert.rs
index ac197dd8df..796a150157 100644
--- a/src/core/src/alerts/alert.rs
+++ b/src/core/src/alerts/alert.rs
@@ -327,6 +327,8 @@ pub enum AlertError {
     CronHasNoFutureOccurrence { cron: String },
     #[error("Realtime alerts cannot notify on recovery or keep firing")]
     RecoveryOnRealtimeAlert,
+    #[error("Realtime alerts cannot suppress repeat notifications")]
+    RepeatSuppressionOnRealtimeAlert,
     #[error("recovery destinations were set without notify_on_recovery, so nothing would use them")]
     RecoveryDestinationsWithoutRecovery,
     #[error(
@@ -895,6 +897,10 @@ async fn prepare_alert(
     if alert.is_real_time && (alert.notify_on_recovery || alert.keep_firing_for != 0) {
         return Err(AlertError::RecoveryOnRealtimeAlert);
     }
+    // A realtime alert keeps no state row, so it has no last delivered state to compare against.
+    if alert.is_real_time && alert.suppress_repeats {
+        return Err(AlertError::RepeatSuppressionOnRealtimeAlert);
+    }
 
     // Multi-level thresholds (alerts_2.md Feature 1). Rejected at write time so
     // an unreachable warning level can never reach the evaluator.
@@ -8853,6 +8859,33 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn prepare_alert_refuses_repeat_suppression_on_a_realtime_alert() {
+        use infra::schema::{STREAM_SCHEMAS_LATEST, SchemaCache};
+
+        let org_id = "test_org_alert_save_repeat_realtime";
+        let key = format!("{org_id}/{}/app", StreamType::Logs);
+        STREAM_SCHEMAS_LATEST.write().await.insert(
+            key.clone(),
+            SchemaCache::new(arrow_schema::Schema::new(vec![arrow_schema::Field::new(
+                "id",
+                DataType::Utf8,
+                true,
+            )])),
+        );
+        let mut alert = Alert::default();
+        alert.trigger_condition.frequency = 60;
+        alert.is_real_time = true;
+        alert.suppress_repeats = true;
+        let res = prepare_alert(org_id, "app", "realtime", &mut alert, true, false).await;
+        STREAM_SCHEMAS_LATEST.write().await.remove(&key);
+
+        assert!(
+            matches!(res, Err(AlertError::RepeatSuppressionOnRealtimeAlert)),
+            "{res:?}"
+        );
+    }
+
     #[tokio::test]
     async fn prepare_alert_rejects_a_cron_with_no_future_occurrence() {
         let err = prepare_schedule(|a| {
diff --git a/src/core/src/alerts/prom_rule.rs b/src/core/src/alerts/prom_rule.rs
index 166957f33d..5aa028977b 100644
--- a/src/core/src/alerts/prom_rule.rs
+++ b/src/core/src/alerts/prom_rule.rs
@@ -446,6 +446,7 @@ mod tests {
                 &TriggerCondition::default(),
                 600,
                 0,
+                false,
                 |_, _, _| false,
             );
             assert!(dispatch.inconsistent.is_empty());
diff --git a/src/core/src/alerts/scheduler/handlers.rs b/src/core/src/alerts/scheduler/handlers.rs
index 43d68b3bff..5b278ad2d7 100644
--- a/src/core/src/alerts/scheduler/handlers.rs
+++ b/src/core/src/alerts/scheduler/handlers.rs
@@ -515,6 +515,8 @@ struct GroupDispatchOutcome {
     downtime_id: Option<String>,
     /// Who acked the first group an ack kept silent.
     acked_by: Option<String>,
+    /// Some group was withheld because it repeated its last delivery.
+    repeated: bool,
 }
 
 impl GroupDispatchOutcome {
@@ -629,6 +631,7 @@ async fn dispatch_per_group(
             state_failed: true,
             downtime_id: None,
             acked_by: None,
+            repeated: false,
         });
     };
 
@@ -647,6 +650,7 @@ async fn dispatch_per_group(
                 state_failed: true,
                 downtime_id: None,
                 acked_by: None,
+                repeated: false,
             });
         }
     };
@@ -684,6 +688,7 @@ async fn dispatch_per_group(
         &alert.trigger_condition,
         now_micros(),
         cfg.limit.alert_max_group_notifications_per_eval,
+        alert.suppresses_repeats(),
         |key, decision, last_notified| {
             muted_groups.contains_key(key)
                 || (acked_groups.contains_key(key) && decision.ack_withholds(last_notified))
@@ -749,7 +754,7 @@ async fn dispatch_per_group(
             continue;
         }
         // Chosen before the send: a resolve only closes a ticket opened under the key it quotes.
-        let episode_key = alert.notify_on_recovery.then(|| {
+        let episode_key = (alert.notify_on_recovery || alert.suppresses_repeats()).then(|| {
             states
                 .get(&item.group_key)
                 .and_then(|state| state.episode_id.clone())
@@ -771,7 +776,7 @@ async fn dispatch_per_group(
                 // last so a label value containing `{...}` cannot expand.
                 Some(&item.labels),
                 &[],
-                episode_key.clone(),
+                episode_key.clone().filter(|_| alert.notify_on_recovery),
             )
             .await;
 
@@ -835,9 +840,11 @@ async fn dispatch_per_group(
 
     log::info!(
         "[SCHEDULER trace_id {trace_id}] alert {alert_id}: per-group dispatch delivered={delivered} \
-         pending={} failed={failed} suppressed={} downtime={downtime_suppressed} candidates={}",
+         pending={} failed={failed} suppressed={} repeats={} downtime={downtime_suppressed} \
+         candidates={}",
         plan.pending,
         plan.suppressed,
+        plan.repeats,
         plan.items.len()
     );
     Some(GroupDispatchOutcome {
@@ -849,6 +856,7 @@ async fn dispatch_per_group(
         state_failed: false,
         downtime_id,
         acked_by,
+        repeated: plan.repeats > 0,
     })
 }
 
@@ -3053,6 +3061,45 @@ pub(crate) async fn correlate_muted_incident(
     }
 }
 
+/// A repeat still correlates, or a continuous firing lets its incident go stale and auto-resolve.
+#[cfg(feature = "enterprise")]
+async fn correlate_repeated_incident(
+    trace_id: &str,
+    alert: &config::meta::alerts::alert::Alert,
+    rows: &[config::utils::json::Map<String, config::utils::json::Value>],
+    triggered_at: i64,
+    eval_level: Option<config::meta::alerts::level::AlertLevel>,
+    actual_value: Option<f64>,
+) {
+    let Some(first_row) = rows.first() else {
+        return;
+    };
+    let incidents_enabled = o2_enterprise::enterprise::common::config::get_config()
+        .incidents
+        .enabled;
+    if !correlates_repeated_firing(alert.creates_incident, incidents_enabled) {
+        return;
+    }
+    // Correlation itself stays silent on a repeat and only notifies a new or escalated incident.
+    if let Err(e) = crate::alerts::incidents::correlate_alert_to_incident(
+        alert,
+        first_row,
+        rows,
+        triggered_at,
+        eval_level,
+        actual_value,
+        None,
+    )
+    .await
+    {
+        log::error!(
+            "[SCHEDULER trace_id {trace_id}] repeat incident correlation failed for {}/{}: {e}",
+            alert.org_id,
+            alert.name
+        );
+    }
+}
+
 /// Whether a matched single-series run is still inside its pending period.
 fn holds_pending(
     alert: &config::meta::alerts::alert::Alert,
@@ -3134,6 +3181,12 @@ fn correlates_muted_firing(
     creates_incident && incidents_enabled && downtime.incident_mode.is_muted()
 }
 
+/// Whether a firing withheld as a repeat still feeds its incident.
+#[cfg(feature = "enterprise")]
+fn correlates_repeated_firing(creates_incident: bool, incidents_enabled: bool) -> bool {
+    creates_incident && incidents_enabled
+}
+
 /// Who acked a single-row alert's current firing, when that ack withholds this run's send.
 async fn single_row_ack(
     alert: &config::meta::alerts::alert::Alert,
@@ -3191,6 +3244,32 @@ fn records_delivery_state(alert_level_delivery: bool, delivery: &DeliveryDecisio
     alert_level_delivery && delivery.resets_silence()
 }
 
+/// Whether a single-row firing at `level` repeats what its open recovery episode already sent.
+fn single_row_repeats(
+    alert: &config::meta::alerts::alert::Alert,
+    level: Option<config::meta::alerts::level::AlertLevel>,
+    rollup: Option<&config::meta::alerts::state::AlertState>,
+    recorded_level: Option<i32>,
+    alert_level_delivery: bool,
+) -> bool {
+    let (Some(level), Some(rollup)) = (level.filter(|l| l.is_firing()), rollup) else {
+        return false;
+    };
+    // Only the multi-level path records the delivered level; a single-level alert fires at one.
+    let last_notified = if alert_level_delivery {
+        recorded_level.and_then(config::meta::alerts::level::AlertLevel::from_i32)
+    } else {
+        Some(level)
+    };
+    alert.suppresses_repeats()
+        && !alert.query_condition.multi_alert_enabled()
+        && config::meta::alerts::dispatch::repeats_last_notification(
+            level,
+            rollup.episode_id.is_some(),
+            last_notified,
+        )
+}
+
 /// A delivered firing ends the Muted chip; a pending run persists before the downtime decision.
 #[cfg(feature = "enterprise")]
 fn clears_recorded_mute(outcome: &RunOutcome) -> bool {
@@ -3594,7 +3673,7 @@ async fn handle_alert_triggers(
                 .unwrap();
 
     let last_states = if !alert.query_condition.multi_alert_enabled()
-        && alert.pending_period_sec > 0
+        && (alert.pending_period_sec > 0 || alert.suppresses_repeats())
     {
         load_tracked_group_states(&alert.get_unique_key()).await.inspect_err(|e|{
             log::error!("[SCHEDULER trace_id {scheduler_trace_id}] alert {}/{} error in getting alert state: {e}",trigger.org,trigger.module_key);
@@ -3927,10 +4006,27 @@ async fn handle_alert_triggers(
     } else {
         None
     };
+    let delivery = match (downtime.as_ref(), acked_by) {
+        (Some(downtime), _) => DeliveryDecision::SuppressedByDowntime(downtime.id.clone()),
+        (None, Some(by)) => DeliveryDecision::SuppressedByAck(by),
+        (None, None)
+            if level_delivery.should_deliver()
+                && single_row_repeats(
+                    &alert,
+                    eval_level,
+                    last_states.get(config::meta::alerts::state::ROLLUP_GROUP_KEY),
+                    trigger_data.last_notified_level,
+                    alert_level_delivery,
+                ) =>
+        {
+            DeliveryDecision::SuppressedAsRepeat
+        }
+        (None, None) => level_delivery,
+    };
     // D6: a suppressed run starts no silence window, so the first run after the window delivers.
     if starts_silence_window(
         trigger_results.data.is_some(),
-        downtime.is_some() || acked_by.is_some(),
+        delivery.withheld(),
         alert.trigger_condition.silence,
         evaluates_through_silence,
     ) {
@@ -3952,14 +4048,7 @@ async fn handle_alert_triggers(
     // send notification
     // Nowhere to send means no delivery to record: no silence window or episode.
     let has_target = has_delivery_target(&alert);
-    let delivery = match (downtime.as_ref(), acked_by) {
-        (Some(downtime), _) => DeliveryDecision::SuppressedByDowntime(downtime.id.clone()),
-        (None, Some(by)) => DeliveryDecision::SuppressedByAck(by),
-        (None, None) => level_delivery,
-    };
-    if !delivery.should_deliver()
-        && (alert_level_delivery || downtime.is_some() || delivery.acked_by().is_some())
-    {
+    if !delivery.should_deliver() && (alert_level_delivery || delivery.withheld()) {
         log::info!(
             "[SCHEDULER trace_id {scheduler_trace_id}] delivery suppressed ({delivery:?}) for {}/{}",
             new_trigger.org,
@@ -4016,6 +4105,20 @@ async fn handle_alert_triggers(
         )
         .await;
     }
+    #[cfg(feature = "enterprise")]
+    if delivery == DeliveryDecision::SuppressedAsRepeat
+        && let Some(rows) = trigger_results.data.as_deref()
+    {
+        correlate_repeated_incident(
+            &scheduler_trace_id,
+            &alert,
+            rows,
+            triggered_at,
+            eval_level,
+            trigger_results.actual_value,
+        )
+        .await;
+    }
 
     // What this evaluation DELIVERED, not what it decided to: the episode opens on a landed send.
     let mut episode_delivered = false;
@@ -4213,6 +4316,9 @@ async fn handle_alert_triggers(
             }
 
             dispatch.record_downtime(&mut trigger_data_stream);
+            if dispatch.repeated {
+                trigger_data_stream.repeat_suppressed = Some(true);
+            }
             // The rollup row was committed before anything was sent.
             if let Some(outcome) = dispatch.rollup_rewrite()
                 && let Some(alert_id) = alert.id.as_ref()
@@ -4486,6 +4592,8 @@ async fn handle_alert_triggers(
                     "alerts",
                     by.to_string(),
                 );
+            } else if delivery == DeliveryDecision::SuppressedAsRepeat {
+                trigger_data_stream.repeat_suppressed = Some(true);
             }
         } else if trigger_results.frozen {
             // Frozen is not Normal: nothing was measured (§7.6). `Skipped` is
@@ -7384,6 +7492,7 @@ mod tests {
             state_failed: false,
             downtime_id: None,
             acked_by: None,
+            repeated: false,
         }
     }
 
@@ -8944,6 +9053,14 @@ mod tests {
         );
     }
 
+    #[cfg(feature = "enterprise")]
+    #[test]
+    fn a_repeat_still_feeds_its_incident_only_when_incidents_apply() {
+        assert!(correlates_repeated_firing(true, true));
+        assert!(!correlates_repeated_firing(false, true));
+        assert!(!correlates_repeated_firing(true, false));
+    }
+
     #[cfg(feature = "enterprise")]
     #[test]
     fn only_an_unsuppressed_matched_run_clears_the_recorded_mute() {
diff --git a/src/core/src/fleet.rs b/src/core/src/fleet.rs
index 65cada0036..ec93d431f1 100644
--- a/src/core/src/fleet.rs
+++ b/src/core/src/fleet.rs
@@ -58,9 +58,19 @@ pub async fn get_pipelines(
 }
 
 /// The handler has already checked the caller's org-wide fleet access, so this runs as the server.
-pub async fn list_audit(org_id: &str, query: AuditQuery) -> Result<AuditList, anyhow::Error> {
-    o2_enterprise::enterprise::fleet::audit::list_audit(org_id, query, now_micros(), search_audit)
-        .await
+pub async fn list_audit(
+    org_id: &str,
+    query: AuditQuery,
+    fleets: Option<&HashSet<String>>,
+) -> Result<AuditList, anyhow::Error> {
+    o2_enterprise::enterprise::fleet::audit::list_audit(
+        org_id,
+        query,
+        fleets,
+        now_micros(),
+        search_audit,
+    )
+    .await
 }
 
 /// The check `/prometheus/api/v1/query` makes per metric stream; a refused query is `None`.
diff --git a/src/core/src/http.rs b/src/core/src/http.rs
index 0db066b3c1..06cc541502 100644
--- a/src/core/src/http.rs
+++ b/src/core/src/http.rs
@@ -99,6 +99,7 @@ impl From<AlertError> for Response {
             | AlertError::TzOffsetOutOfRange
             | AlertError::CronHasNoFutureOccurrence { .. }
             | AlertError::RecoveryOnRealtimeAlert
+            | AlertError::RepeatSuppressionOnRealtimeAlert
             | AlertError::RecoveryDestinationsWithoutRecovery
             | AlertError::RecoveryDestinationIsPlatform { .. }
             | AlertError::RecoveryNeedsJsonPayload { .. }
diff --git a/src/core/src/lib.rs b/src/core/src/lib.rs
index 39a82c671e..02ada8c213 100644
--- a/src/core/src/lib.rs
+++ b/src/core/src/lib.rs
@@ -67,7 +67,7 @@ pub mod public_dashboards;
 pub mod ratelimit;
 pub mod rum_pa;
 use search_service as search;
-#[cfg(feature = "profiling")]
+#[cfg(feature = "cpu-profiling")]
 pub mod self_profiles;
 pub mod self_reporting;
 pub mod service;
@@ -88,6 +88,10 @@ pub mod users;
 #[cfg(feature = "enterprise")]
 pub mod workflows;
 
+#[cfg(feature = "cloud")]
+pub mod org_domain_ownership;
+#[cfg(feature = "cloud")]
+pub mod org_domain_requests;
 /// One authorized AI operation, or `()` in builds without the quota module, so
 /// the RCA signature keeps one shape instead of being cfg-gated at every caller.
 #[cfg(feature = "cloud")]
diff --git a/src/core/src/logs/bulk.rs b/src/core/src/logs/bulk.rs
index f8f282e5df..645a12f0e1 100644
--- a/src/core/src/logs/bulk.rs
+++ b/src/core/src/logs/bulk.rs
@@ -288,6 +288,12 @@ pub async fn ingest(
                     written_any = true;
                 }
                 for status in v.status {
+                    // the stream status keeps the items but not the write's errors flag
+                    bulk_res.errors |= status
+                        .items
+                        .iter()
+                        .flat_map(|item| item.values())
+                        .any(|item| item.error.is_some());
                     bulk_res.items.extend(status.items);
                 }
             }
@@ -621,8 +627,7 @@ mod tests {
         } else {
             assert!(rejected.is_empty());
         }
-        // not set: Fluent Bit retries a whole chunk on it, duplicating the other streams' rows
-        assert!(!resp.errors);
+        assert_eq!(resp.errors, bounded);
         assert!(
             infra::schema::exists("test_org_id", StreamType::Logs, "test_bulk_key_len_ok").await
         );
diff --git a/src/core/src/logs/mod.rs b/src/core/src/logs/mod.rs
index ab38955c0d..02c9792e41 100644
--- a/src/core/src/logs/mod.rs
+++ b/src/core/src/logs/mod.rs
@@ -396,6 +396,7 @@ fn reject_stream_rows(
                 .map(|(_, record)| record.get("_id").and_then(Value::as_str).map(String::from))
                 .chain(columnar.into_iter().flat_map(|mut c| c.take_bulk_ids()));
             for doc_id in doc_ids {
+                bulk_res.errors = true;
                 bulk::add_record_status(
                     stream_name.to_string(),
                     doc_id,
@@ -798,7 +799,7 @@ mod tests {
         let IngestionStatus::Bulk(bulk) = bulk else {
             unreachable!()
         };
-        assert!(!bulk.errors);
+        assert!(bulk.errors);
         let ids: Vec<&str> = bulk
             .items
             .iter()
diff --git a/src/core/src/metrics/ingest.rs b/src/core/src/metrics/ingest.rs
index cb44c233f8..f3bf2fd2d5 100644
--- a/src/core/src/metrics/ingest.rs
+++ b/src/core/src/metrics/ingest.rs
@@ -105,10 +105,10 @@ impl StreamKeyChecks {
     }
 
     /// Removes the records bound for streams that cannot be stored, as (stream, reason, records).
-    pub(super) fn drop_unstorable<T>(
+    pub(super) fn drop_unstorable<R>(
         &mut self,
         org_id: &str,
-        records_by_stream: &mut RecordsByStream<T>,
+        records_by_stream: &mut HashMap<String, Vec<R>>,
     ) -> Vec<(String, String, usize)> {
         let mut dropped = Vec::new();
         records_by_stream.retain(|stream_name, records| {
diff --git a/src/core/src/metrics/prom.rs b/src/core/src/metrics/prom.rs
index c5d4294a25..59a701ea68 100644
--- a/src/core/src/metrics/prom.rs
+++ b/src/core/src/metrics/prom.rs
@@ -143,10 +143,15 @@ pub async fn remote_write(
     // check if stream is deleting from cache
     let mut stream_delete_status: HashMap<String, bool> = HashMap::new();
     let mut skipped_records: u32 = 0;
+    // remote write has no partial success: a 4xx drops the whole batch, a 5xx retries it forever
+    let mut stream_key_checks = ingest::StreamKeyChecks::default();
 
     // parse metadata
     for item in request.metadata {
         let metric_name = format_stream_name(item.metric_family_name.to_string());
+        if stream_key_checks.violation(org_id, &metric_name).is_some() {
+            continue;
+        }
         let schema = infra::schema::get(org_id, &metric_name, StreamType::Metrics)
             .await
             .unwrap_or_else(|_| Schema::empty());
@@ -218,6 +223,8 @@ pub async fn remote_write(
         }
     }
 
+    unique_metrics.retain(|name| stream_key_checks.violation(org_id, name).is_none());
+
     let mut preload_pipeline_time = 0u128;
     let mut preload_uds_time = 0u128;
     let mut preload_schema_time = 0u128;
@@ -379,6 +386,10 @@ pub async fn remote_write(
             continue;
         }
 
+        if stream_key_checks.violation(org_id, &metric_name).is_some() {
+            continue;
+        }
+
         // Note: All configurations (pipeline, UDS, schema, partition, alerts) are now pre-loaded
         // before the loop to avoid repeated async queries
 
@@ -552,6 +563,8 @@ pub async fn remote_write(
                 .map(|(record, timestamp)| (record, timestamp, None)),
         );
     }
+    // histogram bucket, exemplar and pipeline output streams can be too long when the metric fits
+    stream_key_checks.drop_unstorable(org_id, &mut json_data_by_stream);
 
     let step_start = std::time::Instant::now();
     for (stream_name, mut json_data) in json_data_by_stream {
@@ -2309,6 +2322,87 @@ mod tests {
         assert!(matchers.iter().all(|m| m.is_match("http_requests")));
     }
 
+    // cloud builds reject the unknown test org at the trial check
+    #[cfg(not(feature = "cloud"))]
+    #[tokio::test]
+    async fn remote_write_drops_only_the_streams_whose_key_is_too_long() {
+        use infra::file_list::STREAM_KEY_MAX_LEN;
+        use prost::Message;
+        use proto::prometheus_rpc;
+
+        let org_id = "test_org_id";
+        let now = Utc::now().timestamp_millis();
+        let series = |name: &str| prometheus_rpc::TimeSeries {
+            labels: vec![prometheus_rpc::Label {
+                name: NAME_LABEL.to_string(),
+                value: name.to_string(),
+            }],
+            samples: vec![prometheus_rpc::Sample {
+                value: 1.0,
+                timestamp: now,
+            }],
+            ..Default::default()
+        };
+        let long_name = "m".repeat(STREAM_KEY_MAX_LEN);
+        // `_sum` fills the key exactly; `_count`, `_bucket` and `_exemplars` overflow it
+        let histogram_name =
+            "h".repeat(STREAM_KEY_MAX_LEN - format!("{org_id}/metrics/_sum").len());
+        let histogram = prometheus_rpc::TimeSeries {
+            samples: vec![],
+            exemplars: vec![prometheus_rpc::Exemplar {
+                labels: vec![],
+                value: 1.0,
+                timestamp: now,
+            }],
+            histograms: vec![prometheus_rpc::Histogram {
+                sum: 1.0,
+                count: Some(prometheus_rpc::histogram::Count::CountInt(1)),
+                zero_count: Some(prometheus_rpc::histogram::ZeroCount::ZeroCountInt(1)),
+                timestamp: now,
+                ..Default::default()
+            }],
+            ..series(&histogram_name)
+        };
+        let request = prometheus_rpc::WriteRequest {
+            timeseries: vec![
+                series("test_prom_key_len_ok"),
+                series(&long_name),
+                histogram,
+            ],
+            metadata: vec![prometheus_rpc::MetricMetadata {
+                r#type: prometheus_rpc::metric_metadata::MetricType::Gauge as i32,
+                metric_family_name: long_name.clone(),
+                ..Default::default()
+            }],
+        };
+        let body = snap::raw::Encoder::new()
+            .compress_vec(&request.encode_to_vec())
+            .unwrap();
+        remote_write(
+            org_id,
+            Bytes::from(body),
+            IngestUser::User("root@example.com".to_string()),
+        )
+        .await
+        .unwrap();
+
+        let bounded =
+            infra::file_list::stream_key_violation(org_id, StreamType::Metrics, &long_name)
+                .is_some();
+        let expected = [
+            ("test_prom_key_len_ok".to_string(), true),
+            (format!("{histogram_name}_sum"), true),
+            (long_name, !bounded),
+            (format!("{histogram_name}_count"), !bounded),
+            (format!("{histogram_name}_bucket"), !bounded),
+            (exemplars_stream_name(&histogram_name), !bounded),
+        ];
+        for (name, created) in expected {
+            let exists = infra::schema::exists(org_id, StreamType::Metrics, &name).await;
+            assert_eq!(exists, created, "{name}");
+        }
+    }
+
     #[tokio::test]
     async fn remote_write_rejects_a_snappy_header_declaring_more_than_the_limit() {
         let mut n = get_config().limit.req_payload_limit as u64 + 1;
diff --git a/src/core/src/org_cleanup/coverage.rs b/src/core/src/org_cleanup/coverage.rs
index d51dd436dc..c0f6a89d71 100644
--- a/src/core/src/org_cleanup/coverage.rs
+++ b/src/core/src/org_cleanup/coverage.rs
@@ -230,6 +230,8 @@ pub const COVERAGE: &[Coverage] = &[
     table("workflow_errors", DB),
     table("workflow_run_data", DB),
     table("workflows", DB),
+    table("org_domain_ownership", DB),
+    table("org_domain_requests", DB),
     covered(Kind::KvPrefix, "/cipher_keys/{org}/", DB),
     covered(Kind::KvPrefix, "/compact/downsampling/{org}/", DB),
     covered(Kind::KvPrefix, "/compact/files/{org}/", DB),
diff --git a/src/core/src/org_cleanup/mod.rs b/src/core/src/org_cleanup/mod.rs
index 2636dd1d8b..345a799722 100644
--- a/src/core/src/org_cleanup/mod.rs
+++ b/src/core/src/org_cleanup/mod.rs
@@ -32,6 +32,9 @@ use infra::{
 };
 use sea_orm::TransactionTrait;
 
+#[cfg(feature = "cloud")]
+use crate::{org_domain_ownership, org_domain_requests};
+
 const LOCK_KEY: &str = "/org_cleanup/worker_lock";
 const MAX_ATTEMPTS: i32 = 10;
 
@@ -1034,17 +1037,11 @@ async fn delete_org_offsets_and_caches(org_id: &str) -> Result<(), anyhow::Error
     Ok(())
 }
 
-// The mappings live in the `_meta` org's settings, so the org's own settings delete misses them.
 #[cfg(feature = "cloud")]
 async fn delete_org_domain_mappings(org_id: &str) -> Result<(), anyhow::Error> {
-    // The shared writer serializes this with the settings API and other orgs' cleanups.
     let org_id = org_id.to_string();
-    crate::db::organization::update_org_setting(config::META_ORG_ID, move |settings| {
-        let before = settings.domain_org_mappings.len();
-        settings.domain_org_mappings.retain(|m| m.org_id != org_id);
-        settings.domain_org_mappings.len() != before
-    })
-    .await?;
+    org_domain_requests::delete_by_org(&org_id).await?;
+    org_domain_ownership::delete_by_org(&org_id).await?;
     Ok(())
 }
 
diff --git a/src/core/src/org_domain_ownership.rs b/src/core/src/org_domain_ownership.rs
new file mode 100644
index 0000000000..05b91f2822
--- /dev/null
+++ b/src/core/src/org_domain_ownership.rs
@@ -0,0 +1,288 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::sync::{Arc, LazyLock};
+
+use hashbrown::HashMap;
+use infra::{
+    coordinator::get_coordinator,
+    db::Event,
+    table::{
+        entity::{org_domain_ownership::Model, status_page_custom_domains},
+        org_domain_ownership::{OwnershipRecord, OwnershipState},
+    },
+};
+
+static CACHE: LazyLock<config::RwAHashMap<String, String>> =
+    LazyLock::new(|| tokio::sync::RwLock::new(HashMap::new()));
+
+pub const ODO_PREFIX: &str = "/org_domain_ownership/";
+const DOMAIN_EXPIRY_BUFFER_SEC: i64 = 60 * 30;
+
+pub async fn init() {
+    let items = match infra::table::org_domain_ownership::list_active_domain_org_map().await {
+        Ok(v) => v,
+        Err(e) => {
+            log::error!("error in listing active domain mapping for init caching : {e}");
+            return;
+        }
+    };
+    let mut lock = CACHE.write().await;
+    for (domain, org) in items {
+        lock.insert(domain, org);
+    }
+}
+
+pub async fn get_cached_org_for_domain(domain: &str) -> Option<String> {
+    let lock = CACHE.read().await;
+    let org = lock.get(domain);
+    org.map(ToOwned::to_owned)
+}
+
+pub async fn remove_domain_from_cache(domain: &str) {
+    let mut lock = CACHE.write().await;
+    lock.remove(domain);
+}
+
+pub async fn add_domain_to_cache(domain: &str, org: &str) {
+    let mut lock = CACHE.write().await;
+    lock.insert(domain.to_string(), org.to_string());
+}
+
+pub async fn get_verified_org_for_domain(domain: &str) -> Result<Option<String>, anyhow::Error> {
+    let lock = CACHE.read().await;
+    let org = lock.get(domain);
+    if let Some(org) = org {
+        return Ok(Some(org.to_owned()));
+    }
+    drop(lock);
+    infra::table::org_domain_ownership::get_verified_org_for_domain(domain).await
+}
+
+pub async fn save_org_domain_mapping(org_id: &str, domain: &str) -> Result<(), anyhow::Error> {
+    let record = OwnershipRecord {
+        org_id: org_id.to_owned(),
+        domain: domain.to_owned(),
+        state: OwnershipState::Pending,
+    };
+    infra::table::org_domain_ownership::save_org_domain_mapping(record, false).await
+}
+
+pub async fn delete_linked_domain(record: Model) -> Result<(), anyhow::Error> {
+    infra::table::org_domain_ownership::delete_linked_domain(&record.org_id, &record.domain)
+        .await?;
+    // only sync cache for domain which is verified
+    // non verified domain is not going to be in cache
+    if record.verification_state == OwnershipState::Verified as i32 {
+        let mut lock = CACHE.write().await;
+        let cached = lock.get(&record.domain);
+        if cached.is_some_and(|v| v == &record.org_id) {
+            lock.remove(&record.domain);
+        }
+        drop(lock);
+        emit_sync_event(&record.org_id, &record.domain).await;
+    }
+    Ok(())
+}
+
+pub async fn get_domain_org_record(
+    org_id: &str,
+    domain: &str,
+) -> Result<Option<Model>, anyhow::Error> {
+    let res = infra::table::org_domain_ownership::get_domain_org_record(org_id, domain).await?;
+    Ok(res)
+}
+
+pub async fn verify(mut record: Model) -> Result<Model, anyhow::Error> {
+    if record.meta_mapped {
+        return Ok(record);
+    }
+    let res = o2_enterprise::enterprise::status_pages::domain_verifier::check_domain_ownership(
+        status_page_custom_domains::Model {
+            domain: record.domain.clone(),
+            verification_token: record.verification_token.clone(),
+            last_checked_at: record.last_checked_at,
+            updated_at: record.updated_at,
+            verification_state: record.verification_state,
+            verification_failure_reason: record.verification_failure_reason,
+            verified_at: record.verified_at,
+            ..Default::default()
+        },
+        Some(DOMAIN_EXPIRY_BUFFER_SEC),
+    )
+    .await?;
+    record.last_checked_at = res.last_checked_at;
+    record.updated_at = res.updated_at;
+    record.verification_state = res.verification_state;
+    record.verification_failure_reason = res.verification_failure_reason;
+    record.verified_at = res.verified_at;
+
+    infra::table::org_domain_ownership::save_domain_org_record(record.clone()).await?;
+
+    Ok(record)
+}
+
+pub async fn verify_domain_now(org_id: &str, domain: &str) -> Result<Model, anyhow::Error> {
+    let record = infra::table::org_domain_ownership::get_domain_org_record(org_id, domain).await?;
+    let Some(record) = record else {
+        return Err(anyhow::anyhow!(
+            "no mapping for domain {domain} found for org {org_id}"
+        ));
+    };
+    if record.meta_mapped {
+        return Ok(record);
+    }
+    let updated_record = verify(record).await?;
+    if updated_record.verification_state == OwnershipState::Verified as i32 {
+        let mut lock = CACHE.write().await;
+        lock.insert(domain.to_owned(), org_id.to_owned());
+    }
+    emit_sync_event(org_id, domain).await;
+    Ok(updated_record)
+}
+
+pub async fn update_state(org_id: &str, domain: &str, new_state: i32) -> Result<(), anyhow::Error> {
+    let mut lock = CACHE.write().await;
+    let existing = lock.get(domain);
+    if new_state == OwnershipState::Verified as i32 {
+        lock.insert(domain.to_owned(), org_id.to_owned());
+    } else if existing.is_some_and(|v| org_id == v) {
+        lock.remove(domain);
+    }
+    drop(lock);
+    emit_sync_event(org_id, domain).await;
+    Ok(())
+}
+
+pub async fn get_domains_for_org(org_id: &str) -> Result<Vec<Model>, anyhow::Error> {
+    let records = infra::table::org_domain_ownership::get_domains_for_org(org_id).await?;
+    Ok(records)
+}
+
+pub async fn link_from_meta(org_id: &str, domain: &str) -> Result<(), anyhow::Error> {
+    let domains = get_domains_for_org(org_id).await?;
+    let mapped = domains
+        .into_iter()
+        .filter(|v| v.domain == domain)
+        .next()
+        .is_some();
+    if mapped {
+        infra::table::org_domain_ownership::mark_meta_mapped(org_id, domain).await?;
+    } else {
+        let record = OwnershipRecord {
+            org_id: org_id.to_owned(),
+            domain: domain.to_owned(),
+            state: OwnershipState::Verified,
+        };
+        infra::table::org_domain_ownership::save_org_domain_mapping(record, true).await?;
+    }
+    emit_sync_event(org_id, domain).await;
+    Ok(())
+}
+
+pub async fn delete_by_org(org_id: &str) -> Result<(), anyhow::Error> {
+    let domains = infra::table::org_domain_ownership::get_domains_for_org(org_id).await?;
+    for domain in domains {
+        delete_linked_domain(domain).await?;
+    }
+    Ok(())
+}
+
+async fn emit_sync_event(org_id: &str, domain: &str) {
+    let cluster_coordinator = get_coordinator().await;
+    if let Err(e) = cluster_coordinator
+        .put(
+            &format!("{ODO_PREFIX}{org_id}/{domain}"),
+            "".into(),
+            true,
+            None,
+        )
+        .await
+    {
+        log::error!(
+            "error sending cluster sync message for org domain ownership sync for org {org_id} : {e}"
+        );
+    }
+}
+
+pub async fn watch() -> Result<(), anyhow::Error> {
+    let cluster_coordinator = ::infra::db::get_coordinator().await;
+    let mut events = cluster_coordinator.watch(ODO_PREFIX).await?;
+    let events = Arc::get_mut(&mut events).unwrap();
+    log::info!("Start watching org_domain_ownership");
+
+    loop {
+        let ev = match events.recv().await {
+            Some(ev) => ev,
+            None => {
+                log::error!("watch_org_domain_ownership: event channel closed");
+                return Ok(());
+            }
+        };
+
+        if let Event::Put(ev) = ev {
+            let Some(key) = ev.key.strip_prefix(ODO_PREFIX) else {
+                log::error!("unexpected key for org domain prefix watch : {}", ev.key);
+                continue;
+            };
+            let Some((org, domain)) = key.split_once("/") else {
+                log::error!(
+                    "invalid key received for org domain ownership sync : {}",
+                    ev.key
+                );
+                continue;
+            };
+            log::info!("received sync event for org domain ownership for org {org}");
+            let record = match infra::table::org_domain_ownership::get_domain_org_record(
+                org, domain,
+            )
+            .await
+            {
+                Ok(v) => v,
+                Err(e) => {
+                    log::error!(
+                        "error in retrieving org domain ownership record from db for {org} domain {domain} : {e}"
+                    );
+                    continue;
+                }
+            };
+            let cached = get_cached_org_for_domain(domain).await;
+            let mut lock = CACHE.write().await;
+            match record {
+                None => {
+                    if cached.is_some_and(|v| v == org) {
+                        log::info!(
+                            "removing org {org} domain {domain} from memory cache as record not found in db"
+                        );
+                        lock.remove(domain);
+                    }
+                }
+                Some(v) => {
+                    if v.verification_state == OwnershipState::Verified as i32 {
+                        log::info!(
+                            "added org {org} domain {domain} from memory cache as verified in db"
+                        );
+                        lock.insert(domain.to_owned(), org.to_owned());
+                    } else if cached.is_some_and(|v| v == org) {
+                        log::info!(
+                            "removed org {org} domain {domain} from memory cache as not verified in db"
+                        );
+                        lock.remove(domain);
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/src/core/src/org_domain_requests.rs b/src/core/src/org_domain_requests.rs
new file mode 100644
index 0000000000..c8b3d7d337
--- /dev/null
+++ b/src/core/src/org_domain_requests.rs
@@ -0,0 +1,72 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use config::utils::time::now_micros;
+use infra::table::{
+    entity::org_domain_requests::Model,
+    org_domain_requests::{self, Status},
+};
+
+pub async fn save_org_domain_request(
+    org_id: &str,
+    domain: &str,
+    req_by: &str,
+) -> Result<(), anyhow::Error> {
+    let now = now_micros();
+    let req = Model {
+        id: config::ider::generate(),
+        org_id: org_id.to_string(),
+        domain: domain.trim().to_lowercase(),
+        created_at: now,
+        updated_at: now,
+        requested_by: req_by.to_string(),
+        answered_by: None,
+        status: Status::Pending as i32,
+        reason: None,
+    };
+    org_domain_requests::save_org_domain_request(req).await?;
+    Ok(())
+}
+
+pub async fn list_all_req() -> Result<Vec<Model>, anyhow::Error> {
+    Ok(org_domain_requests::list_all().await?)
+}
+
+pub async fn list_by_org(org_id: &str) -> Result<Vec<Model>, anyhow::Error> {
+    Ok(org_domain_requests::list_by_org(org_id).await?)
+}
+pub async fn get_req_by_id(id: &str) -> Result<Option<Model>, anyhow::Error> {
+    Ok(org_domain_requests::get_by_id(id).await?)
+}
+
+pub async fn get_req_by_org_domain(
+    org_id: &str,
+    domain: &str,
+) -> Result<Option<Model>, anyhow::Error> {
+    Ok(org_domain_requests::get_by_org_domain(org_id, domain).await?)
+}
+
+pub async fn update_status(
+    id: &str,
+    user: &str,
+    new_status: Status,
+    reason: String,
+) -> Result<(), anyhow::Error> {
+    Ok(org_domain_requests::update_status(id, user, new_status, reason).await?)
+}
+
+pub async fn delete_by_org(org_id: &str) -> Result<(), anyhow::Error> {
+    org_domain_requests::delete_by_org(org_id).await
+}
diff --git a/src/core/src/organization.rs b/src/core/src/organization.rs
index 5762f683fd..831b06acb8 100644
--- a/src/core/src/organization.rs
+++ b/src/core/src/organization.rs
@@ -25,6 +25,8 @@ use config::{
     },
     utils::{json, rand::generate_random_string, time},
 };
+#[cfg(feature = "cloud")]
+use db::organization::get_org_setting;
 use db::{self, org_users, user::is_root_user};
 use infra::table::{self, org_users::UserOrgExpandedRecord};
 #[cfg(feature = "enterprise")]
@@ -46,6 +48,8 @@ use {
 
 #[cfg(feature = "cloud")]
 use super::self_reporting::cloud_events::{CloudEvent, EventType, enqueue_cloud_event};
+#[cfg(feature = "cloud")]
+use crate::org_domain_ownership::get_cached_org_for_domain;
 use crate::{
     auth::{delete_org_tuples, save_org_tuples},
     common::{
@@ -1103,6 +1107,21 @@ pub async fn generate_invitation(
             return Err(anyhow::anyhow!("Email Domain not allowed for {invitee}"));
         }
 
+        let Some((_, domain)) = invitee.split_once('@') else {
+            return Err(anyhow::anyhow!("invalid email id {invitee}"));
+        };
+
+        if let Some(linked_org) = get_cached_org_for_domain(domain).await {
+            let settings = get_org_setting(&linked_org).await?;
+            for mapping in settings.domain_org_mappings {
+                if mapping.domain == domain && mapping.org_id == org_id {
+                    return Err(anyhow::anyhow!(
+                        "invitee '{invitee}' domain is already mapped to org {org_id} so cannot send invite"
+                    ));
+                }
+            }
+        }
+
         if get_billing_by_org_id(org_id).await?.is_none() {
             // If the org we are inviting to is paid, its fine to send invitations
             // irrespective of what other orgs invitees are part of.
diff --git a/src/core/src/public_dashboards/defaults.rs b/src/core/src/public_dashboards/defaults.rs
index 73466de1c1..a52dd85e17 100644
--- a/src/core/src/public_dashboards/defaults.rs
+++ b/src/core/src/public_dashboards/defaults.rs
@@ -113,6 +113,12 @@ impl<'a> Defaults<'a> {
         self.values
     }
 
+    /// Whether any value waits for a values query.
+    #[cfg(feature = "enterprise")]
+    pub fn has_pending(&self) -> bool {
+        !self.pending.is_empty()
+    }
+
     /// The values queries `from` reaches through their stream, field and filter references.
     #[cfg_attr(not(feature = "enterprise"), allow(dead_code))]
     pub fn reachable_queries(
diff --git a/src/core/src/public_dashboards/mask.rs b/src/core/src/public_dashboards/mask.rs
index 734a0eeae0..8f02ecfe7f 100644
--- a/src/core/src/public_dashboards/mask.rs
+++ b/src/core/src/public_dashboards/mask.rs
@@ -236,6 +236,7 @@ mod tests {
     #[test]
     fn gate02_a_variable_from_a_lost_values_stream_is_nulled() {
         let var = |label: &str, value| PublicVariable {
+            name: label.into(),
             label: label.into(),
             value,
             tab_id: None,
diff --git a/src/core/src/public_dashboards/materialize.rs b/src/core/src/public_dashboards/materialize.rs
index 575ed1bd7e..af1c283f7c 100644
--- a/src/core/src/public_dashboards/materialize.rs
+++ b/src/core/src/public_dashboards/materialize.rs
@@ -1457,6 +1457,7 @@ pub(super) mod tests {
             Run {
                 panels,
                 variables: vec![PublicVariable {
+                    name: "svc".into(),
                     label: "svc".into(),
                     value: json!("checkout"),
                     tab_id: None,
diff --git a/src/core/src/public_dashboards/mod.rs b/src/core/src/public_dashboards/mod.rs
index 5583e0fab5..fbf79a2c61 100644
--- a/src/core/src/public_dashboards/mod.rs
+++ b/src/core/src/public_dashboards/mod.rs
@@ -352,9 +352,7 @@ pub struct LinkValues {
 impl LinkValues {
     pub fn new(dash: &Dashboard, frozen: Option<&str>) -> Self {
         let values = Defaults::new(dash, parse_frozen_vars(frozen)).into_values();
-        Self {
-            vars: QueryVars::new(dash, values, None),
-        }
+        Self::from_values(dash, values)
     }
 
     /// The panel's query text as its build substitutes it; the window only sizes `$__interval`.
@@ -376,6 +374,12 @@ impl LinkValues {
         let vars = self.vars.for_panel(tab_id, &panel.id);
         plan_promql(panel, &vars, now - 3_600_000_000, now)
     }
+
+    fn from_values(dash: &Dashboard, values: BTreeMap<String, serde_json::Value>) -> Self {
+        Self {
+            vars: QueryVars::new(dash, values, None),
+        }
+    }
 }
 
 /// One authorizer health answer per build or deadline check, asked only when a check denies.
@@ -808,7 +812,14 @@ pub async fn update_link(
     let now = now_micros();
     validate_dashboard(&dash, &cfg.frozen_variables, now).map_err(Invalid)?;
     #[cfg(feature = "enterprise")]
-    authorize_variable_edit(&link, &dash, &cfg.frozen_variables, user_id).await?;
+    authorize_variable_edit(
+        &link,
+        &dash,
+        &cfg.frozen_variables,
+        range_changed(&link, &cfg.time_range).then_some(cfg.time_range.ranges.as_slice()),
+        user_id,
+    )
+    .await?;
     let ranges = serde_json::to_string(&cfg.time_range.ranges)?;
     let frozen = serde_json::to_string(&cfg.frozen_variables)?;
     edit(&link.org_id, &link.id, |l| {
@@ -1508,15 +1519,29 @@ where
     paused
 }
 
-/// Enterprise: the editor must read every stream a changed frozen value makes a panel read.
+/// Whether an edit changes the set of ranges a link serves or its default range.
+#[cfg(feature = "enterprise")]
+fn range_changed(link: &PublicDashboard, policy: &TimeRangePolicy) -> bool {
+    let keys = |ranges: &[TimeRange]| ranges.iter().map(TimeRange::key).collect::<BTreeSet<_>>();
+    let stored = time_ranges(link);
+    keys(&stored.ranges) != keys(&policy.ranges) || stored.default.key() != policy.default.key()
+}
+
+/// Enterprise: the editor must read what a changed frozen value or range makes the link read.
 #[cfg(feature = "enterprise")]
 async fn authorize_variable_edit(
     link: &PublicDashboard,
     dash: &Dashboard,
     frozen: &BTreeMap<String, serde_json::Value>,
+    changed_ranges: Option<&[TimeRange]>,
     user_id: &str,
 ) -> Result<(), anyhow::Error> {
-    let sources = variable_edit_sources(link, dash, frozen);
+    let sources = match changed_ranges {
+        Some(ranges) => {
+            range_edit_sources(&ENGINE, link, dash, frozen, ranges, user_id, now_micros()).await?
+        }
+        None => variable_edit_sources(link, dash, frozen),
+    };
     if sources.is_empty() {
         return Ok(());
     }
@@ -1560,57 +1585,190 @@ fn variable_edit_sources(
     let values = LinkValues::new(dash, new_json.as_deref());
     for tab in &v8.tabs {
         for panel in &tab.panels {
-            let texts = template_texts(panel);
-            let texts: Vec<&str> = texts.iter().map(String::as_str).collect();
-            let reads_changed = values
-                .vars
-                .referenced(&tab.tab_id, &panel.id, &texts)
-                .iter()
-                .any(|(_, key)| reached.contains(key));
-            if !reads_changed {
-                continue;
-            }
-            let promql = panel.query_type == "promql";
-            let planned = promql
-                .then(|| values.plan_promql(&tab.tab_id, panel).ok())
-                .flatten();
-            for (qi, q) in panel.queries.iter().enumerate() {
-                let lang = if promql { "promql" } else { "sql" };
-                // A sent PromQL query is checked as the build sends it, a formula as its expansion.
-                let text = match planned.as_ref().and_then(|p| p[qi].clone()) {
-                    Some(expr) => expr,
-                    None => {
-                        let Some(text) = query_text(q) else {
-                            continue;
-                        };
-                        values.substitute(&tab.tab_id, &panel.id, text, lang)
-                    }
-                };
-                sources.push(if promql {
-                    QuerySource::PromQl {
-                        org_id: link.org_id.clone(),
-                        query: text,
-                    }
-                } else {
-                    QuerySource::Sql {
-                        org_id: link.org_id.clone(),
-                        sql: text,
-                        default_type: q.fields.stream_type,
-                    }
-                });
-                let vrl = q.vrl_function_query.as_deref().map(str::trim);
-                if let Some(vrl) = vrl.filter(|f| !promql && !f.is_empty()) {
-                    sources.push(QuerySource::Vrl {
-                        org_id: link.org_id.clone(),
-                        source: vrl.to_string(),
-                    });
-                }
+            if panel_keys(&values, tab, panel).any(|key| reached.contains(&key)) {
+                sources.extend(panel_sources(&link.org_id, &values, tab, panel));
             }
         }
     }
+    dedup(sources)
+}
+
+/// Every query the link runs in each range, with its values queries run as the editor.
+#[cfg(feature = "enterprise")]
+async fn range_edit_sources(
+    search: &dyn PanelSearch,
+    link: &PublicDashboard,
+    dash: &Dashboard,
+    frozen: &BTreeMap<String, serde_json::Value>,
+    ranges: &[TimeRange],
+    user_id: &str,
+    now: i64,
+) -> Result<Vec<crate::authz::QuerySource>, anyhow::Error> {
+    use crate::authz::QuerySource;
+
+    let Some(v8) = dash.v8.as_ref() else {
+        return Ok(vec![]);
+    };
+    let editor = PublicDashboard {
+        published_by: user_id.to_string(),
+        ..link.clone()
+    };
+    let probe = AuthorizerProbe::default();
+    let family = TraceFamily::new(&link.org_id);
+    let mut sources = Vec::new();
+    // Values depend on the window only when a values query picks them.
+    let windows: Vec<&TimeRange> = if Defaults::new(dash, frozen.clone()).has_pending() {
+        ranges.iter().collect()
+    } else {
+        ranges.iter().take(1).collect()
+    };
+    for range in windows {
+        let range_key = range.key();
+        let (start, end) = materialize::window(range, now);
+        let ctx = Ctx {
+            search,
+            probe: &probe,
+            link: &editor,
+            dash,
+            identity: public_dashboard_identity(&link.org_id),
+            range_key: &range_key,
+            start,
+            end,
+            now,
+            family: &family,
+        };
+        let filled = fill_defaults(&ctx, frozen.clone()).await;
+        sources.extend(filled.deps.values().flat_map(|dep| {
+            dep.sources
+                .iter()
+                .map(|(stream_type, name)| QuerySource::Stream {
+                    org_id: link.org_id.clone(),
+                    stream_type: *stream_type,
+                    name: name.clone(),
+                })
+        }));
+        if let Some(key) = filled.denied.first() {
+            return Err(Forbidden(format!(
+                "Unauthorized Access: no read permission for the values of variable {key}"
+            ))
+            .into());
+        }
+        // A later build may resolve the value, so an unchecked panel must not be saved.
+        if let Some(key) = filled.failed.first() {
+            return Err(Invalid(format!(
+                "The values of variable {key} could not be loaded to check stream access for this range. Try again."
+            ))
+            .into());
+        }
+        let values = LinkValues::from_values(dash, filled.values);
+        for tab in &v8.tabs {
+            for panel in &tab.panels {
+                sources.extend(panel_sources(&link.org_id, &values, tab, panel));
+            }
+        }
+    }
+    Ok(dedup(sources))
+}
+
+/// Keys of the scoped values the panel's queries read.
+#[cfg(feature = "enterprise")]
+fn panel_keys<'a>(
+    values: &'a LinkValues,
+    tab: &'a Tab,
+    panel: &'a Panel,
+) -> impl Iterator<Item = String> + 'a {
+    let texts = template_texts(panel);
+    let texts: Vec<&str> = texts.iter().map(String::as_str).collect();
+    values
+        .vars
+        .referenced(&tab.tab_id, &panel.id, &texts)
+        .into_iter()
+        .map(|(_, key)| key)
+}
+
+/// The queries and VRL functions a panel's build sends; a custom chart never runs.
+#[cfg(feature = "enterprise")]
+fn panel_sources(
+    org_id: &str,
+    values: &LinkValues,
+    tab: &Tab,
+    panel: &Panel,
+) -> Vec<crate::authz::QuerySource> {
+    use crate::authz::QuerySource;
+
+    let mut sources = Vec::new();
+    if panel.typ == "custom_chart" || withholds_vrl(org_id, panel) {
+        return sources;
+    }
+    let promql = panel.query_type == "promql";
+    let planned = promql
+        .then(|| values.plan_promql(&tab.tab_id, panel).ok())
+        .flatten();
+    for (qi, q) in panel.queries.iter().enumerate() {
+        let lang = if promql { "promql" } else { "sql" };
+        // A sent PromQL query is checked as the build sends it, a formula as its expansion.
+        let text = match planned.as_ref().map(|p| p[qi].clone()) {
+            Some(Some(expr)) => expr,
+            // A hidden or empty query is never sent; formulas carry their inputs.
+            Some(None) => continue,
+            None => {
+                let Some(text) = query_text(q) else {
+                    continue;
+                };
+                values.substitute(&tab.tab_id, &panel.id, text, lang)
+            }
+        };
+        sources.push(if promql {
+            QuerySource::PromQl {
+                org_id: org_id.to_string(),
+                query: text,
+            }
+        } else {
+            QuerySource::Sql {
+                org_id: org_id.to_string(),
+                sql: text,
+                default_type: q.fields.stream_type,
+            }
+        });
+        let vrl = q.vrl_function_query.as_deref().map(str::trim);
+        if let Some(vrl) = vrl.filter(|f| !promql && !f.is_empty()) {
+            sources.push(QuerySource::Vrl {
+                org_id: org_id.to_string(),
+                source: vrl.to_string(),
+            });
+        }
+    }
     sources
 }
 
+/// Whether the build withholds the panel for a VRL whose reads it cannot prove, as `run_sql_panel`
+/// does.
+#[cfg(feature = "enterprise")]
+fn withholds_vrl(org_id: &str, panel: &Panel) -> bool {
+    panel.query_type != "promql"
+        && panel.queries.iter().any(|q| {
+            q.vrl_function_query
+                .as_deref()
+                .map(str::trim)
+                .filter(|f| !f.is_empty())
+                .is_some_and(|vrl| {
+                    transform::enrichment_tables_read(vrl, org_id).is_err()
+                        || skips_vrl_in_search(vrl)
+                })
+        })
+}
+
+#[cfg(feature = "enterprise")]
+fn dedup(sources: Vec<crate::authz::QuerySource>) -> Vec<crate::authz::QuerySource> {
+    let mut unique = Vec::with_capacity(sources.len());
+    for source in sources {
+        if !unique.contains(&source) {
+            unique.push(source);
+        }
+    }
+    unique
+}
+
 /// The outermost explicit LIMIT of a SQL query; None without one or when it does not parse.
 fn explicit_limit(sql: &str) -> Option<i64> {
     use sqlparser::{
@@ -4208,6 +4366,113 @@ mod tests {
         );
     }
 
+    #[cfg(feature = "enterprise")]
+    #[test]
+    fn only_a_new_range_set_or_default_is_a_range_change() {
+        let (mut link, ..) = ctx_parts();
+        link.time_ranges = Some(
+            json!([{ "type": "relative", "secs": 86400 }, { "type": "relative", "secs": 3600 }])
+                .to_string(),
+        );
+        link.default_range_key = Some("r86400".into());
+        let policy = |ranges: serde_json::Value, default: usize| -> TimeRangePolicy {
+            let ranges: Vec<TimeRange> = serde_json::from_value(ranges).unwrap();
+            TimeRangePolicy {
+                default: ranges[default],
+                ranges,
+            }
+        };
+        let sorted =
+            json!([{ "type": "relative", "secs": 3600 }, { "type": "relative", "secs": 86400 }]);
+        assert!(
+            !range_changed(&link, &policy(sorted.clone(), 1)),
+            "a reorder"
+        );
+        assert!(range_changed(&link, &policy(sorted, 0)), "a new default");
+        assert!(range_changed(
+            &link,
+            &policy(json!([{ "type": "relative", "secs": 2592000 }]), 0)
+        ));
+    }
+
+    #[cfg(feature = "enterprise")]
+    #[tokio::test]
+    async fn a_range_edit_checks_every_panel_with_the_values_its_build_picks() {
+        let (link, ..) = ctx_parts();
+        let dash = Dashboard {
+            version: 8,
+            v8: Some(
+                serde_json::from_value(json!({
+                    "tabs": [{ "tabId": "t1", "name": "", "panels": [
+                        panel("b", Some("SELECT * FROM fixed WHERE env = '$env'")),
+                        panel("d", Some("SELECT * FROM \"$pick\"")),
+                        panel("e", Some("SELECT * FROM \"$sub\"")),
+                        panel("f", Some("SELECT * FROM \"$sub\"")),
+                        typed_panel("g", "custom_chart", "sql", "SELECT * FROM never_run", None),
+                    ]}],
+                    "variables": { "list": [
+                        { "type": "custom", "name": "env", "label": "E", "value": "prod" },
+                        { "type": "query_values", "name": "pick", "label": "P",
+                          "query_data": { "stream_type": "logs", "stream": "names", "field": "n" } },
+                        { "type": "query_values", "name": "sub", "label": "U",
+                          "query_data": { "stream_type": "logs", "stream": "$pick", "field": "n" } }
+                    ]}
+                }))
+                .unwrap(),
+            ),
+            ..Default::default()
+        };
+        let frozen: BTreeMap<String, serde_json::Value> =
+            serde_json::from_value(json!({ "env": "prod" })).unwrap();
+        let ranges: Vec<TimeRange> =
+            serde_json::from_value(json!([{ "type": "relative", "secs": 3600 }])).unwrap();
+        let search = FakeSearch {
+            hits: 1,
+            ..Default::default()
+        };
+        let sources = range_edit_sources(&search, &link, &dash, &frozen, &ranges, "editor@x", 0)
+            .await
+            .unwrap();
+        let mut texts: Vec<String> = sources
+            .into_iter()
+            .map(|s| match s {
+                crate::authz::QuerySource::Sql { sql, .. } => sql,
+                crate::authz::QuerySource::Stream { name, .. } => format!("stream {name}"),
+                other => panic!("{other:?}"),
+            })
+            .collect();
+        texts.sort();
+        assert_eq!(
+            texts,
+            [
+                "SELECT * FROM \"v0\"",
+                "SELECT * FROM fixed WHERE env = 'prod'",
+                "stream names",
+                "stream v0",
+            ],
+            "the dependent values query reads the stream its parent picks"
+        );
+        let denied = FakeSearch {
+            hits: 1,
+            refuse: Some((NotAvailableReason::Unauthorized, "FROM \"names\"")),
+            ..Default::default()
+        };
+        let err = range_edit_sources(&denied, &link, &dash, &frozen, &ranges, "editor@x", 0)
+            .await
+            .unwrap_err();
+        assert!(err.downcast_ref::<Forbidden>().is_some(), "{err}");
+        // A failed lookup leaves the dependent panels unchecked, so the edit cannot be saved.
+        let failed = FakeSearch {
+            hits: 1,
+            fail_sql: Some("FROM \"names\""),
+            ..Default::default()
+        };
+        let err = range_edit_sources(&failed, &link, &dash, &frozen, &ranges, "editor@x", 0)
+            .await
+            .unwrap_err();
+        assert!(err.downcast_ref::<Invalid>().is_some(), "{err}");
+    }
+
     #[cfg(all(feature = "enterprise", feature = "test-utils"))]
     #[tokio::test]
     async fn gate04_a_link_variable_edit_selecting_an_unreadable_stream_is_refused() {
@@ -4226,7 +4491,7 @@ mod tests {
         let to = |value: &str| -> BTreeMap<String, serde_json::Value> {
             BTreeMap::from([("src.p.c".to_string(), json!(value))])
         };
-        let err = authorize_variable_edit(&link, &dash, &to("secret"), &editor)
+        let err = authorize_variable_edit(&link, &dash, &to("secret"), None, &editor)
             .await
             .unwrap_err();
         assert!(err.downcast_ref::<Forbidden>().is_some());
@@ -4235,7 +4500,7 @@ mod tests {
             "Unauthorized Access: no read permission on logs/secret"
         );
         assert!(
-            authorize_variable_edit(&link, &dash, &to("safe"), &editor)
+            authorize_variable_edit(&link, &dash, &to("safe"), None, &editor)
                 .await
                 .is_ok()
         );
diff --git a/src/core/src/self_profiles/job.rs b/src/core/src/self_profiles/job.rs
index e393098aaa..589125cb63 100644
--- a/src/core/src/self_profiles/job.rs
+++ b/src/core/src/self_profiles/job.rs
@@ -48,9 +48,10 @@ pub async fn run() {
     let cpu_secs = cfg.self_profiles.cpu_secs;
     let lock = Arc::new(Mutex::new(()));
     log::info!(
-        "[SELF-PROFILES] starting background loop: interval={}s cpu={}s url={}",
+        "[SELF-PROFILES] starting background loop: interval={}s cpu={}s memory={} url={}",
         cfg.self_profiles.interval_secs,
         cpu_secs,
+        cfg!(feature = "profiling"),
         if cfg.self_profiles.url.is_empty() {
             "local"
         } else {
@@ -73,32 +74,38 @@ pub async fn run() {
 }
 
 async fn run_cycle(cpu_secs: u64) -> Result<(), String> {
-    let host = config::get_config().common.instance_name.clone();
-    let extra = [("host.name", host.as_str())];
+    let cfg = config::get_config();
+    let extra = [
+        ("host.name", cfg.common.instance_name.as_str()),
+        ("cluster.name", cfg.common.cluster_name.as_str()),
+    ];
 
-    match sample::dump_cpu_profile(cpu_secs, CPU_FREQUENCY_HZ).await {
-        Ok(bytes) => match convert::pprof_bytes_to_otlp(&bytes, &extra) {
-            Ok(req) => {
-                if let Err(e) = sink::ingest(req).await {
-                    log::error!("[SELF-PROFILES] CPU ingest failed: {e}");
-                }
-            }
-            Err(e) => log::error!("[SELF-PROFILES] CPU convert failed: {e}"),
-        },
-        Err(e) => log::error!("[SELF-PROFILES] CPU sample failed: {e}"),
-    }
+    let cpu = sample::dump_cpu_profile(cpu_secs, CPU_FREQUENCY_HZ).await;
+    ingest_sample("CPU", cpu, &extra).await;
 
-    match sample::dump_memory_pprof().await {
-        Ok(bytes) => match convert::pprof_bytes_to_otlp(&bytes, &extra) {
-            Ok(req) => {
-                if let Err(e) = sink::ingest(req).await {
-                    log::error!("[SELF-PROFILES] memory ingest failed: {e}");
-                }
-            }
-            Err(e) => log::error!("[SELF-PROFILES] memory convert failed: {e}"),
-        },
-        Err(e) => log::error!("[SELF-PROFILES] memory sample failed: {e}"),
+    #[cfg(feature = "profiling")]
+    {
+        let memory = sample::dump_memory_pprof().await;
+        ingest_sample("memory", memory, &extra).await;
     }
 
     Ok(())
 }
+
+async fn ingest_sample(kind: &str, sampled: Result<Vec<u8>, String>, extra: &[(&str, &str)]) {
+    let bytes = match sampled {
+        Ok(bytes) => bytes,
+        Err(e) => {
+            log::error!("[SELF-PROFILES] {kind} sample failed: {e}");
+            return;
+        }
+    };
+    match convert::pprof_bytes_to_otlp(&bytes, extra) {
+        Ok(req) => {
+            if let Err(e) = sink::ingest(req).await {
+                log::error!("[SELF-PROFILES] {kind} ingest failed: {e}");
+            }
+        }
+        Err(e) => log::error!("[SELF-PROFILES] {kind} convert failed: {e}"),
+    }
+}
diff --git a/src/core/src/self_profiles/mod.rs b/src/core/src/self_profiles/mod.rs
index 2d3e782cc4..090248efed 100644
--- a/src/core/src/self_profiles/mod.rs
+++ b/src/core/src/self_profiles/mod.rs
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-//! Self CPU/memory profiling into `_meta.self_profiles` (feature `profiling`).
+//! Self CPU (feature `cpu-profiling`) and memory (feature `profiling`) profiling.
 
 mod convert;
 mod job;
@@ -21,8 +21,9 @@ mod sample;
 mod sink;
 
 pub use job::run;
-pub use sample::{dump_cpu_profile, dump_memory_flamegraph, dump_memory_pprof, jemalloc_stats};
+pub use sample::dump_cpu_profile;
+#[cfg(feature = "profiling")]
+pub use sample::{dump_memory_flamegraph, dump_memory_pprof, jemalloc_stats};
 
-pub(crate) const STREAM_NAME: &str = "self_profiles";
 pub(crate) const SERVICE_NAME: &str = "openobserve";
 pub(crate) const CPU_FREQUENCY_HZ: i32 = 100;
diff --git a/src/core/src/self_profiles/sample.rs b/src/core/src/self_profiles/sample.rs
index 76cdc86588..0d1c1af677 100644
--- a/src/core/src/self_profiles/sample.rs
+++ b/src/core/src/self_profiles/sample.rs
@@ -33,6 +33,7 @@ pub async fn dump_cpu_profile(duration_secs: u64, frequency: i32) -> Result<Vec<
 }
 
 /// Dump jemalloc heap profile as pprof protobuf bytes.
+#[cfg(feature = "profiling")]
 pub async fn dump_memory_pprof() -> Result<Vec<u8>, String> {
     let prof_ctl = jemalloc_pprof::PROF_CTL
         .as_ref()
@@ -52,6 +53,7 @@ pub async fn dump_memory_pprof() -> Result<Vec<u8>, String> {
 }
 
 /// Dump jemalloc heap flamegraph SVG bytes (for `/debug/profile/memory`).
+#[cfg(feature = "profiling")]
 pub async fn dump_memory_flamegraph() -> Result<Vec<u8>, String> {
     let prof_ctl = jemalloc_pprof::PROF_CTL
         .as_ref()
@@ -71,6 +73,7 @@ pub async fn dump_memory_flamegraph() -> Result<Vec<u8>, String> {
 }
 
 /// Read current jemalloc stats (for `/debug/profile/stats`).
+#[cfg(feature = "profiling")]
 pub fn jemalloc_stats() -> Result<serde_json::Value, String> {
     tikv_jemalloc_ctl::epoch::mib()
         .map_err(|e| format!("Failed to get jemalloc epoch mib: {e}"))?
diff --git a/src/core/src/self_profiles/sink.rs b/src/core/src/self_profiles/sink.rs
index 92b6d81d3f..d31bd64b42 100644
--- a/src/core/src/self_profiles/sink.rs
+++ b/src/core/src/self_profiles/sink.rs
@@ -15,11 +15,11 @@
 
 use std::time::Duration;
 
-use config::{META_ORG_ID, get_config, meta::otlp::OtlpRequestType};
+use config::{DEFAULT_STREAM_NAME, META_ORG_ID, get_config, meta::otlp::OtlpRequestType};
 use ingestion_common::{IngestUser, SystemJobType};
 use opentelemetry_proto::tonic::collector::profiles::v1development::ExportProfilesServiceRequest;
 
-use super::{STREAM_NAME, convert};
+use super::convert;
 
 const REMOTE_REQUEST_TIMEOUT: Duration = Duration::from_secs(10);
 const REMOTE_CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
@@ -40,7 +40,7 @@ async fn ingest_local(request: ExportProfilesServiceRequest) -> Result<(), Strin
         META_ORG_ID,
         request,
         OtlpRequestType::HttpProtobuf,
-        Some(STREAM_NAME),
+        Some(DEFAULT_STREAM_NAME),
         IngestUser::SystemJob(SystemJobType::SelfReporting),
     )
     .await
diff --git a/src/core/src/traces/service_graph/api.rs b/src/core/src/traces/service_graph/api.rs
index ce39ce0b0d..ac4ab8a9c5 100644
--- a/src/core/src/traces/service_graph/api.rs
+++ b/src/core/src/traces/service_graph/api.rs
@@ -21,6 +21,17 @@ use axum::response::Response as HttpResponse;
 use common::meta::http::HttpResponse as MetaHttpResponse;
 use serde::Deserialize;
 
+#[cfg(feature = "enterprise")]
+const EDGE_HISTORY_WINDOW_MICROS: i64 = 24 * 60 * 60 * 1_000_000;
+// Allows clock skew while keeping every bound far from i64 overflow in the step alignment.
+#[cfg(any(feature = "enterprise", test))]
+const MAX_FUTURE_MICROS: i64 = 24 * 60 * 60 * 1_000_000;
+// A stream's own retention can outlast the global one, so the cap never drops below the default.
+#[cfg(any(feature = "enterprise", test))]
+const MIN_MAX_WINDOW_DAYS: i64 = 3650;
+#[cfg(any(feature = "enterprise", test))]
+const DAY_MICROS: i64 = 24 * 60 * 60 * 1_000_000;
+
 /// Query parameters for service graph API
 #[derive(Debug, Deserialize)]
 pub struct ServiceGraphQuery {
@@ -53,6 +64,7 @@ pub struct ServiceGraphQuery {
     ),
     responses(
         (status = 200, description = "Success", content_type = "application/json", body = Object),
+        (status = 400, description = "Invalid time window (negative start_time, end_time not after start_time, end_time more than a day ahead, or longer than the data retention, at least 3650 days) or a stream name the metrics query cannot quote", content_type = "application/json", body = String),
         (status = 403, description = "Forbidden - Enterprise feature", content_type = "application/json", body = String),
         (status = 500, description = "Internal Server Error", content_type = "application/json", body = ()),
     ),
@@ -65,15 +77,16 @@ pub async fn get_current_topology(
     axum::extract::Path(org_id): axum::extract::Path<String>,
     axum::extract::Query(query): axum::extract::Query<ServiceGraphQuery>,
 ) -> HttpResponse {
-    // Resolve the current window boundaries
-    let (start_time, end_time) =
-        if let (Some(start), Some(end)) = (query.start_time, query.end_time) {
-            (start, end)
-        } else {
-            let now = chrono::Utc::now().timestamp_micros();
-            let window_micros = super::DEFAULT_QUERY_WINDOW_MINUTES * 60 * 1_000_000;
-            (now - window_micros, now)
-        };
+    let (start_time, end_time) = match resolve_window(
+        query.start_time,
+        query.end_time,
+        chrono::Utc::now().timestamp_micros(),
+        super::DEFAULT_QUERY_WINDOW_MINUTES * 60 * 1_000_000,
+        max_window_days(config::get_config().compact.data_retention_days),
+    ) {
+        Ok(window) => window,
+        Err(e) => return MetaHttpResponse::bad_request(e),
+    };
 
     let filter = v4_read_filter(&query);
     if let Err(e) = filter.validate() {
@@ -152,7 +165,7 @@ pub struct EdgeHistoryQuery {
     ),
     responses(
         (status = 200, description = "Success", content_type = "application/json", body = Object),
-        (status = 400, description = "A service or stream name the metrics query cannot quote", content_type = "application/json", body = String),
+        (status = 400, description = "Invalid time window (negative start_time, end_time not after start_time, end_time more than a day ahead, or longer than the data retention, at least 3650 days), or a service or stream name the metrics query cannot quote", content_type = "application/json", body = String),
         (status = 403, description = "Forbidden - Enterprise feature"),
         (status = 500, description = "Internal Server Error", content_type = "application/json", body = ()),
     ),
@@ -166,13 +179,16 @@ pub async fn get_edge_history(
 
     use super::v4::history::{EdgeFilter, fetch_edge_history};
 
-    let (start_time, end_time) =
-        if let (Some(start), Some(end)) = (query.start_time, query.end_time) {
-            (start, end)
-        } else {
-            let now = chrono::Utc::now().timestamp_micros();
-            (now - 24 * 60 * 60 * 1_000_000, now)
-        };
+    let (start_time, end_time) = match resolve_window(
+        query.start_time,
+        query.end_time,
+        chrono::Utc::now().timestamp_micros(),
+        EDGE_HISTORY_WINDOW_MICROS,
+        max_window_days(config::get_config().compact.data_retention_days),
+    ) {
+        Ok(window) => window,
+        Err(e) => return MetaHttpResponse::bad_request(e),
+    };
     let non_empty = |v: Option<String>| v.filter(|s| !s.is_empty());
     let filter = EdgeFilter {
         client: non_empty(query.client_service),
@@ -228,10 +244,137 @@ pub async fn get_current_topology(
     MetaHttpResponse::forbidden("Not Supported")
 }
 
-#[cfg(all(test, feature = "enterprise"))]
+/// The longest window a request may ask for: the global data retention, at least 3650 days.
+#[cfg(any(feature = "enterprise", test))]
+fn max_window_days(retention_days: i64) -> i64 {
+    retention_days.max(MIN_MAX_WINDOW_DAYS)
+}
+
+#[cfg(any(feature = "enterprise", test))]
+fn resolve_window(
+    start: Option<i64>,
+    end: Option<i64>,
+    now: i64,
+    default_span_micros: i64,
+    max_days: i64,
+) -> Result<(i64, i64), String> {
+    let (Some(start), Some(end)) = (start, end) else {
+        return Ok((now - default_span_micros, now));
+    };
+    if start < 0 {
+        return Err("start_time must not be negative".to_string());
+    }
+    if end <= start {
+        return Err("end_time must be after start_time".to_string());
+    }
+    if end > now.saturating_add(MAX_FUTURE_MICROS) {
+        return Err("end_time must be at most one day after the current time".to_string());
+    }
+    if end - start > max_days.saturating_mul(DAY_MICROS) {
+        return Err(format!(
+            "the window from start_time to end_time must not exceed {max_days} days"
+        ));
+    }
+    Ok((start, end))
+}
+
+#[cfg(test)]
 mod tests {
     use super::*;
 
+    const NOW: i64 = 1_800_000_000_000_000;
+    const SPAN: i64 = 3_600_000_000;
+    const MAX_DAYS: i64 = 3650;
+
+    #[test]
+    fn test_resolve_window_uses_an_explicit_window() {
+        assert_eq!(
+            resolve_window(Some(1_000), Some(2_000), NOW, SPAN, MAX_DAYS),
+            Ok((1_000, 2_000))
+        );
+        assert_eq!(
+            resolve_window(Some(0), Some(1), NOW, SPAN, MAX_DAYS),
+            Ok((0, 1))
+        );
+    }
+
+    #[test]
+    fn test_resolve_window_rejects_a_negative_start() {
+        assert!(resolve_window(Some(-1), Some(2_000), NOW, SPAN, MAX_DAYS).is_err());
+        assert!(resolve_window(Some(i64::MIN), Some(i64::MAX), NOW, SPAN, MAX_DAYS).is_err());
+    }
+
+    #[test]
+    fn test_resolve_window_rejects_an_end_not_after_the_start() {
+        assert!(resolve_window(Some(2_189_567), Some(-1_358), NOW, SPAN, MAX_DAYS).is_err());
+        assert!(resolve_window(Some(2_000), Some(2_000), NOW, SPAN, MAX_DAYS).is_err());
+        assert!(resolve_window(Some(2_000), Some(1_999), NOW, SPAN, MAX_DAYS).is_err());
+    }
+
+    #[test]
+    fn test_resolve_window_rejects_an_end_beyond_tomorrow_and_near_i64_max() {
+        assert_eq!(
+            resolve_window(
+                Some(NOW),
+                Some(NOW + MAX_FUTURE_MICROS),
+                NOW,
+                SPAN,
+                MAX_DAYS
+            ),
+            Ok((NOW, NOW + MAX_FUTURE_MICROS))
+        );
+        assert!(
+            resolve_window(
+                Some(NOW),
+                Some(NOW + MAX_FUTURE_MICROS + 1),
+                NOW,
+                SPAN,
+                MAX_DAYS
+            )
+            .is_err()
+        );
+        assert!(resolve_window(Some(i64::MAX - 1), Some(i64::MAX), NOW, SPAN, MAX_DAYS).is_err());
+        assert!(resolve_window(Some(0), Some(i64::MAX), NOW, SPAN, MAX_DAYS).is_err());
+        assert!(resolve_window(Some(0), Some(1), i64::MAX, SPAN, MAX_DAYS).is_ok());
+    }
+
+    #[test]
+    fn test_resolve_window_caps_the_span_at_the_given_days() {
+        let max_span = MAX_DAYS * DAY_MICROS;
+        assert_eq!(
+            resolve_window(Some(NOW - max_span), Some(NOW), NOW, SPAN, MAX_DAYS),
+            Ok((NOW - max_span, NOW))
+        );
+        let err =
+            resolve_window(Some(NOW - max_span - 1), Some(NOW), NOW, SPAN, MAX_DAYS).unwrap_err();
+        assert!(err.contains("3650 days"), "{err}");
+        let longer = 7300 * DAY_MICROS;
+        assert!(resolve_window(Some(NOW - longer), Some(NOW), NOW, SPAN, 7300).is_ok());
+        assert!(resolve_window(Some(0), Some(NOW), NOW, SPAN, i64::MAX).is_ok());
+    }
+
+    #[test]
+    fn test_max_window_days_follows_a_longer_retention() {
+        assert_eq!(max_window_days(7300), 7300);
+        assert_eq!(max_window_days(3650), 3650);
+        assert_eq!(
+            max_window_days(30),
+            3650,
+            "a stream may keep data longer than the default"
+        );
+        assert_eq!(max_window_days(0), 3650, "0 means unbounded retention");
+        assert_eq!(max_window_days(-1), 3650);
+    }
+
+    #[test]
+    fn test_resolve_window_defaults_when_a_bound_is_missing() {
+        let default = Ok((NOW - SPAN, NOW));
+        assert_eq!(resolve_window(None, None, NOW, SPAN, MAX_DAYS), default);
+        assert_eq!(resolve_window(Some(-5), None, NOW, SPAN, MAX_DAYS), default);
+        assert_eq!(resolve_window(None, Some(-5), NOW, SPAN, MAX_DAYS), default);
+    }
+
+    #[cfg(feature = "enterprise")]
     #[test]
     fn test_v4_read_filter_maps_stream_and_env_only() {
         let query = |stream: Option<&str>, env: Option<&str>| ServiceGraphQuery {
@@ -253,4 +396,69 @@ mod tests {
         assert_eq!(f.trace_stream.as_deref(), Some("default"));
         assert_eq!(f.agent_env.as_deref(), Some("prod"));
     }
+
+    #[cfg(feature = "enterprise")]
+    #[tokio::test]
+    async fn test_handlers_reject_an_invalid_window_with_400() {
+        use axum::extract::{Path, Query};
+
+        let topology = get_current_topology(
+            Path("default".to_string()),
+            Query(ServiceGraphQuery {
+                start_time: Some(2_189_567),
+                end_time: Some(-1_358),
+                filter: None,
+                stream_name: None,
+                agent_id: None,
+                agent_name: None,
+                agent_env: None,
+            }),
+        )
+        .await;
+        assert_eq!(topology.status(), axum::http::StatusCode::BAD_REQUEST);
+
+        let history = get_edge_history(
+            Path("default".to_string()),
+            Query(EdgeHistoryQuery {
+                client_service: None,
+                server_service: None,
+                start_time: Some(-1),
+                end_time: Some(10),
+                stream_name: None,
+            }),
+        )
+        .await;
+        assert_eq!(history.status(), axum::http::StatusCode::BAD_REQUEST);
+
+        let near_max = get_edge_history(
+            Path("default".to_string()),
+            Query(EdgeHistoryQuery {
+                client_service: None,
+                server_service: None,
+                start_time: Some(i64::MAX - 1),
+                end_time: Some(i64::MAX),
+                stream_name: None,
+            }),
+        )
+        .await;
+        assert_eq!(near_max.status(), axum::http::StatusCode::BAD_REQUEST);
+
+        let near_max_topology = get_current_topology(
+            Path("default".to_string()),
+            Query(ServiceGraphQuery {
+                start_time: Some(i64::MAX - 1),
+                end_time: Some(i64::MAX),
+                filter: None,
+                stream_name: None,
+                agent_id: None,
+                agent_name: None,
+                agent_env: None,
+            }),
+        )
+        .await;
+        assert_eq!(
+            near_max_topology.status(),
+            axum::http::StatusCode::BAD_REQUEST
+        );
+    }
 }
diff --git a/src/core/src/traces/service_graph/v4/history.rs b/src/core/src/traces/service_graph/v4/history.rs
index e9b2cf04c0..a817003421 100644
--- a/src/core/src/traces/service_graph/v4/history.rs
+++ b/src/core/src/traces/service_graph/v4/history.rs
@@ -90,7 +90,7 @@ pub async fn fetch_edge_history(
 
 /// Coarser than a minute only when the range would exceed `MAX_POINTS`; always whole minutes.
 fn step_micros(start: i64, end: i64) -> i64 {
-    let span_secs = ((end - start) / 1_000_000).max(1) as u64;
+    let span_secs = (end.saturating_sub(start) / 1_000_000).max(1) as u64;
     let minutes = span_secs
         .div_ceil(MAX_POINTS as u64)
         .div_ceil(MIN_STEP_SECS as u64);
@@ -99,7 +99,7 @@ fn step_micros(start: i64, end: i64) -> i64 {
 
 /// Evaluation times sit on step boundaries, where the rollup's samples are, inside the range.
 fn eval_bounds(start: i64, end: i64, step: i64) -> Option<(i64, i64)> {
-    let first = align_down(start + step - 1, step) + step;
+    let first = align_down(start.checked_add(step - 1)?, step).checked_add(step)?;
     let last = align_down(end, step);
     (first <= last).then_some((first, last))
 }
@@ -217,6 +217,14 @@ mod tests {
         assert_eq!(eval_bounds(0, MIN - 1, MIN), None);
     }
 
+    #[test]
+    fn test_step_and_bounds_survive_windows_near_i64_max() {
+        let step = step_micros(i64::MAX - 1, i64::MAX);
+        assert_eq!(step, MIN);
+        assert_eq!(eval_bounds(i64::MAX - 1, i64::MAX, step), None);
+        assert!(step_micros(i64::MIN, i64::MAX) > 0);
+    }
+
     #[test]
     fn test_plan_queries() {
         let plan = plan("server=\"b\"", MIN);
diff --git a/src/core/src/traces/service_graph/v4/read.rs b/src/core/src/traces/service_graph/v4/read.rs
index 42edd7c629..6e487c85fe 100644
--- a/src/core/src/traces/service_graph/v4/read.rs
+++ b/src/core/src/traces/service_graph/v4/read.rs
@@ -257,7 +257,7 @@ where
     Fut: Future<Output = Result<Vec<InstantValue>, anyhow::Error>>,
 {
     // Range selectors are left-open; +1ms keeps the `start` sample, not a baseline 1ms before it.
-    let range_ms = ((end - start) / 1_000).max(1_000) + 1;
+    let range_ms = (end.saturating_sub(start) / 1_000).max(1_000) + 1;
     let plan =
         |v4_only| plan_queries(filter, v4_only, range_ms, start, end).map_err(anyhow::Error::msg);
     let mut results = run_plan(&plan(true)?, &run).await;
diff --git a/src/core/src/users.rs b/src/core/src/users.rs
index ba1641cad1..31a6953ec9 100644
--- a/src/core/src/users.rs
+++ b/src/core/src/users.rs
@@ -1876,12 +1876,7 @@ mod tests {
     }
 
     async fn create_query_history_table() {
-        use sea_orm::{ConnectionTrait, Schema};
-        let conn = get_orm_client_rw().await;
-        let backend = conn.get_database_backend();
-        let mut stmt = Schema::new(backend)
-            .create_table_from_entity(infra_table::entity::query_history::Entity);
-        conn.execute(backend.build(stmt.if_not_exists()))
+        infra_table::query_history::create_table_for_tests(get_orm_client_rw().await)
             .await
             .unwrap();
     }
@@ -1906,14 +1901,24 @@ mod tests {
         };
         create_new_user(user).await.unwrap();
         for org in ["dummy", "other"] {
-            infra_table::query_history::record(org, email, "up", serde_json::json!({}), 1)
-                .await
-                .unwrap();
+            infra_table::query_history::record(infra_table::query_history::NewRun {
+                org_id: org,
+                user_email: email,
+                source: "logs",
+                query: "up",
+                query_key: None,
+                streams: &[],
+                status: "ok",
+                context: serde_json::json!({}),
+                now_us: 1,
+            })
+            .await
+            .unwrap();
         }
     }
 
     async fn history_count(org: &str, email: &str) -> usize {
-        infra_table::query_history::list(org, email, None, None, 10, 0)
+        infra_table::query_history::list(org, email, &Default::default(), 10, 0)
             .await
             .unwrap()
             .len()
diff --git a/src/db/src/authz.rs b/src/db/src/authz.rs
index e15fa4d278..ce046fac05 100644
--- a/src/db/src/authz.rs
+++ b/src/db/src/authz.rs
@@ -90,11 +90,31 @@ pub async fn list_objects_for_user(
     permission: &str,
     object_type: &str,
 ) -> anyhow::Result<Option<Vec<String>>> {
-    let openfga_config = o2_openfga::config::get_config();
-    if crate::user::is_root_user(user_id)
-        || !openfga_config.enabled
-        || !openfga_config.list_only_permitted
-    {
+    if !o2_openfga::config::get_config().list_only_permitted {
+        return Ok(None);
+    }
+    list_permitted_objects(org_id, user_id, permission, object_type).await
+}
+
+#[cfg(not(feature = "enterprise"))]
+pub async fn list_objects_for_user(
+    _org_id: &str,
+    _user_id: &str,
+    _permission: &str,
+    _object_type: &str,
+) -> anyhow::Result<Option<Vec<String>>> {
+    Ok(None)
+}
+
+/// [`list_objects_for_user`] whatever `list_only_permitted` says, for lists that carry secrets.
+#[cfg(feature = "enterprise")]
+pub async fn list_permitted_objects(
+    org_id: &str,
+    user_id: &str,
+    permission: &str,
+    object_type: &str,
+) -> anyhow::Result<Option<Vec<String>>> {
+    if crate::user::is_root_user(user_id) || !o2_openfga::config::get_config().enabled {
         return Ok(None);
     }
 
@@ -113,20 +133,12 @@ pub async fn list_objects_for_user(
     )
     .await
     .map_err(|_| anyhow::anyhow!("Unauthorized Access"))?;
-    log::debug!("list_objects_for_user for user {user_id} from {org_id} org returns: {objects:#?}");
+    log::debug!(
+        "list_permitted_objects for user {user_id} from {org_id} org returns: {objects:#?}"
+    );
     Ok(Some(objects))
 }
 
-#[cfg(not(feature = "enterprise"))]
-pub async fn list_objects_for_user(
-    _org_id: &str,
-    _user_id: &str,
-    _permission: &str,
-    _object_type: &str,
-) -> anyhow::Result<Option<Vec<String>>> {
-    Ok(None)
-}
-
 /// OpenFGA object and parent type of `obj`; `None` when either type is unmapped.
 #[cfg(feature = "enterprise")]
 fn ofga_object(obj_type: &str, obj: &Authz) -> Option<(String, &'static str)> {
diff --git a/src/infra/src/table/alerts/mod.rs b/src/infra/src/table/alerts/mod.rs
index a31e3e0c6d..1a5e2f36a5 100644
--- a/src/infra/src/table/alerts/mod.rs
+++ b/src/infra/src/table/alerts/mod.rs
@@ -220,6 +220,7 @@ impl TryFrom<alerts::Model> for MetaAlert {
         alert.notify_on_recovery = value.notify_on_recovery.unwrap_or(false);
         alert.recovery_destinations = recovery_destinations;
         alert.keep_firing_for = value.keep_firing_for_seconds.unwrap_or(0);
+        alert.suppress_repeats = value.suppress_repeats.unwrap_or(false);
 
         Ok(alert)
     }
@@ -958,6 +959,7 @@ fn update_mutable_fields(
         Some(serde_json::to_string(&alert.recovery_destinations)?)
     };
     let keep_firing_for_seconds = alert.keep_firing_for;
+    let suppress_repeats = alert.suppress_repeats;
 
     alert_am.name = Set(name);
     alert_am.is_real_time = Set(is_real_time);
@@ -1016,6 +1018,7 @@ fn update_mutable_fields(
     alert_am.notify_on_recovery = Set(Some(notify_on_recovery));
     alert_am.recovery_destinations = Set(recovery_destinations);
     alert_am.keep_firing_for_seconds = Set(Some(keep_firing_for_seconds));
+    alert_am.suppress_repeats = Set(Some(suppress_repeats));
     Ok(())
 }
 
@@ -1096,6 +1099,7 @@ pub(super) mod tests {
             notify_on_recovery: None,
             recovery_destinations: None,
             keep_firing_for_seconds: None,
+            suppress_repeats: None,
         }
     }
 
diff --git a/src/infra/src/table/entity/alerts.rs b/src/infra/src/table/entity/alerts.rs
index 91a3545ac3..0b172fb41a 100644
--- a/src/infra/src/table/entity/alerts.rs
+++ b/src/infra/src/table/entity/alerts.rs
@@ -92,6 +92,8 @@ pub struct Model {
     /// How long the condition must stay clear before the episode recovers.
     /// NULL or 0 recovers on the first clear evaluation.
     pub keep_firing_for_seconds: Option<i64>,
+    /// NULL predates the feature, which is the same as `false`.
+    pub suppress_repeats: Option<bool>,
 }
 
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
@@ -178,6 +180,7 @@ mod tests {
             notify_on_recovery: None,
             recovery_destinations: None,
             keep_firing_for_seconds: None,
+            suppress_repeats: None,
         };
         assert_eq!(m.id, "alert-1");
         assert_eq!(m.name, "High Error Rate");
diff --git a/src/infra/src/table/entity/mod.rs b/src/infra/src/table/entity/mod.rs
index 036f79d367..62c794dc0e 100644
--- a/src/infra/src/table/entity/mod.rs
+++ b/src/infra/src/table/entity/mod.rs
@@ -80,6 +80,8 @@ pub mod oncall_user_contacts;
 pub mod online_eval_jobs;
 pub mod org_ai_toolsets;
 pub mod org_cleanup_tasks;
+pub mod org_domain_ownership;
+pub mod org_domain_requests;
 pub mod org_ingestion_tokens;
 pub mod org_storage_providers;
 pub mod org_telephony;
diff --git a/src/infra/src/table/entity/org_domain_ownership.rs b/src/infra/src/table/entity/org_domain_ownership.rs
new file mode 100644
index 0000000000..963e3f8b2f
--- /dev/null
+++ b/src/infra/src/table/entity/org_domain_ownership.rs
@@ -0,0 +1,26 @@
+//! `SeaORM` Entity for the domain_org_ownership table.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, serde::Serialize, serde::Deserialize)]
+#[sea_orm(table_name = "org_domain_ownership")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: String,
+    pub org_id: String,
+    pub domain: String,
+    pub verification_token: String,
+    pub verification_state: i32,
+    pub verification_failure_reason: Option<i32>,
+    pub verified_at: Option<i64>,
+    pub released_at: Option<i64>,
+    pub last_checked_at: Option<i64>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub meta_mapped: bool,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/src/infra/src/table/entity/org_domain_requests.rs b/src/infra/src/table/entity/org_domain_requests.rs
new file mode 100644
index 0000000000..beef6b7a88
--- /dev/null
+++ b/src/infra/src/table/entity/org_domain_requests.rs
@@ -0,0 +1,23 @@
+//! `SeaORM` Entity for the domain_org_requests table.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, DeriveEntityModel, serde::Serialize, serde::Deserialize)]
+#[sea_orm(table_name = "org_domain_requests")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: String,
+    pub org_id: String,
+    pub domain: String,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub requested_by: String,
+    pub answered_by: Option<String>,
+    pub status: i32,
+    pub reason: Option<String>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/src/infra/src/table/entity/prelude.rs b/src/infra/src/table/entity/prelude.rs
index 20d0c3e4da..b093be72ea 100644
--- a/src/infra/src/table/entity/prelude.rs
+++ b/src/infra/src/table/entity/prelude.rs
@@ -21,7 +21,9 @@ pub use super::{
     llm_prompt_label_events::Entity as LlmPromptLabelEvents,
     llm_prompt_labels::Entity as LlmPromptLabels, llm_prompt_versions::Entity as LlmPromptVersions,
     llm_prompt_webhook_deliveries::Entity as LlmPromptWebhookDeliveries,
-    llm_prompts::Entity as LlmPrompts, org_ingestion_tokens::Entity as OrgIngestionTokens,
+    llm_prompts::Entity as LlmPrompts, org_domain_ownership::Entity as OrgDomainOwnership,
+    org_domain_requests::Entity as OrgDomainRequests,
+    org_ingestion_tokens::Entity as OrgIngestionTokens,
     org_storage_providers::Entity as OrgStorageProviders, org_users::Entity as OrgUsers,
     organizations::Entity as Organizations, pipeline_last_errors::Entity as PipelineLastErrors,
     re_pattern_stream_map::Entity as RePatternStreamMap, re_patterns::Entity as RePatterns,
diff --git a/src/infra/src/table/entity/query_history.rs b/src/infra/src/table/entity/query_history.rs
index 1aa738ed85..9e24535a06 100644
--- a/src/infra/src/table/entity/query_history.rs
+++ b/src/infra/src/table/entity/query_history.rs
@@ -26,7 +26,20 @@ pub struct Model {
     pub query: String,
     pub context: Json,
     pub starred: bool,
+    /// First run of this row; never changed after insert.
     pub created_at: i64,
+    #[sea_orm(column_type = "Text")]
+    pub source: String,
+    /// Hex sha256 of the merge key; NULL on rows written before the key existed.
+    pub query_key: Option<String>,
+    /// Comma-wrapped stream list (`,a,b,`), empty when there are none.
+    #[sea_orm(column_type = "Text")]
+    pub streams: String,
+    pub run_count: i64,
+    /// Last run of this row.
+    pub updated_at: i64,
+    #[sea_orm(column_type = "Text")]
+    pub status: String,
 }
 
 #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
diff --git a/src/infra/src/table/entity/status_page_custom_domains.rs b/src/infra/src/table/entity/status_page_custom_domains.rs
index d2da9838fb..fc37bae3fe 100644
--- a/src/infra/src/table/entity/status_page_custom_domains.rs
+++ b/src/infra/src/table/entity/status_page_custom_domains.rs
@@ -2,7 +2,9 @@
 
 use sea_orm::entity::prelude::*;
 
-#[derive(Clone, Debug, PartialEq, DeriveEntityModel, serde::Serialize, serde::Deserialize)]
+#[derive(
+    Clone, Default, Debug, PartialEq, DeriveEntityModel, serde::Serialize, serde::Deserialize,
+)]
 #[sea_orm(table_name = "status_page_custom_domains")]
 pub struct Model {
     #[sea_orm(primary_key, auto_increment = false)]
diff --git a/src/infra/src/table/entity/synthetics_checks.rs b/src/infra/src/table/entity/synthetics_checks.rs
index 358990742d..9d898286b4 100644
--- a/src/infra/src/table/entity/synthetics_checks.rs
+++ b/src/infra/src/table/entity/synthetics_checks.rs
@@ -31,7 +31,7 @@ pub struct Model {
     /// When the scheduler last fanned out this check (microseconds).
     pub last_triggered_at: i64,
     /// Denormalised status from the most recent completed check.
-    /// 0=Unknown, 1=Up, 2=Warning, 3=Down
+    /// 0=Unknown, 1=Up, 2=Warning, 3=Down, 4=Error (no verdict: dispatch/lease failure)
     pub last_check_status: i32,
     /// Runs that have failed back to back; reset to 0 by a pass. Compared
     /// against `settings.alert_if_fails` to decide whether to notify.
diff --git a/src/infra/src/table/migration/m20261025_000005_add_held_action_to_slack_link_requests.rs b/src/infra/src/table/migration/m20261025_000005_add_held_action_to_slack_link_requests.rs
index 08242eab64..f5a9a83bf2 100644
--- a/src/infra/src/table/migration/m20261025_000005_add_held_action_to_slack_link_requests.rs
+++ b/src/infra/src/table/migration/m20261025_000005_add_held_action_to_slack_link_requests.rs
@@ -46,12 +46,6 @@ impl MigrationTrait for Migration {
     }
 }
 
-/// Adds the column to a freshly created table (test setups that skip the migrator).
-pub(crate) async fn add_column<C: sea_orm::ConnectionTrait>(db: &C) -> Result<(), DbErr> {
-    let stmt = db.get_database_backend().build(&add_column_statement());
-    db.execute(stmt).await.map(|_| ())
-}
-
 fn add_column_statement() -> TableAlterStatement {
     Table::alter()
         .table(SlackLinkRequests::Table)
diff --git a/src/infra/src/table/migration/m20261027_000001_alter_query_history.rs b/src/infra/src/table/migration/m20261027_000001_alter_query_history.rs
new file mode 100644
index 0000000000..07f071eb54
--- /dev/null
+++ b/src/infra/src/table/migration/m20261027_000001_alter_query_history.rs
@@ -0,0 +1,644 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Adds source, merge key, streams, run count, last run and status to `query_history`.
+
+use sea_orm_migration::prelude::*;
+
+const TABLE: &str = "query_history";
+const OLD_ORG_USER_CREATED_AT_IDX: &str = "query_history_org_user_created_at_idx";
+const OLD_STARRED_CREATED_AT_IDX: &str = "query_history_starred_created_at_idx";
+const ORG_USER_UPDATED_AT_IDX: &str = "query_history_org_user_updated_at_idx";
+const ORG_USER_SOURCE_UPDATED_AT_IDX: &str = "query_history_org_user_source_updated_at_idx";
+const STARRED_UPDATED_AT_IDX: &str = "query_history_starred_updated_at_idx";
+const ORG_USER_SOURCE_KEY_UIDX: &str = "query_history_org_user_source_key_uidx";
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        // NOT NULL DEFAULT keeps v1.1.x nodes inserting during a rolling upgrade.
+        for mut def in [
+            ColumnDef::new(QueryHistory::Source)
+                .text()
+                .not_null()
+                .default("metrics")
+                .to_owned(),
+            ColumnDef::new(QueryHistory::QueryKey)
+                .char_len(64)
+                .null()
+                .to_owned(),
+            ColumnDef::new(QueryHistory::Streams)
+                .text()
+                .not_null()
+                .default("")
+                .to_owned(),
+            ColumnDef::new(QueryHistory::RunCount)
+                .big_integer()
+                .not_null()
+                .default(1)
+                .to_owned(),
+            ColumnDef::new(QueryHistory::UpdatedAt)
+                .big_integer()
+                .not_null()
+                .default(0)
+                .to_owned(),
+            ColumnDef::new(QueryHistory::Status)
+                .text()
+                .not_null()
+                .default("ok")
+                .to_owned(),
+        ] {
+            add_column(manager, &mut def).await?;
+        }
+        // v1.1.x stored each row's last run in created_at; the guard makes a rerun a no-op.
+        manager
+            .get_connection()
+            .execute_unprepared(
+                "UPDATE query_history SET updated_at = created_at WHERE updated_at < created_at",
+            )
+            .await?;
+        for name in [OLD_ORG_USER_CREATED_AT_IDX, OLD_STARRED_CREATED_AT_IDX] {
+            drop_index(manager, name).await?;
+        }
+        create_index(
+            manager,
+            ORG_USER_UPDATED_AT_IDX,
+            &[
+                QueryHistory::OrgId,
+                QueryHistory::UserEmail,
+                QueryHistory::UpdatedAt,
+            ],
+            false,
+        )
+        .await?;
+        create_index(
+            manager,
+            ORG_USER_SOURCE_UPDATED_AT_IDX,
+            &[
+                QueryHistory::OrgId,
+                QueryHistory::UserEmail,
+                QueryHistory::Source,
+                QueryHistory::UpdatedAt,
+            ],
+            false,
+        )
+        .await?;
+        create_index(
+            manager,
+            STARRED_UPDATED_AT_IDX,
+            &[QueryHistory::Starred, QueryHistory::UpdatedAt],
+            false,
+        )
+        .await?;
+        // NULL keys on v1.1.x rows are distinct, so they never collide here.
+        create_index(
+            manager,
+            ORG_USER_SOURCE_KEY_UIDX,
+            &[
+                QueryHistory::OrgId,
+                QueryHistory::UserEmail,
+                QueryHistory::Source,
+                QueryHistory::QueryKey,
+            ],
+            true,
+        )
+        .await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        for name in [
+            ORG_USER_SOURCE_KEY_UIDX,
+            STARRED_UPDATED_AT_IDX,
+            ORG_USER_SOURCE_UPDATED_AT_IDX,
+            ORG_USER_UPDATED_AT_IDX,
+        ] {
+            drop_index(manager, name).await?;
+        }
+        // A repeated or partial rollback has already dropped updated_at.
+        if manager
+            .has_column(TABLE, &QueryHistory::UpdatedAt.to_string())
+            .await?
+        {
+            manager
+                .get_connection()
+                .execute_unprepared(
+                    "UPDATE query_history SET created_at = updated_at WHERE updated_at > created_at",
+                )
+                .await?;
+        }
+        create_index(
+            manager,
+            OLD_ORG_USER_CREATED_AT_IDX,
+            &[
+                QueryHistory::OrgId,
+                QueryHistory::UserEmail,
+                QueryHistory::CreatedAt,
+            ],
+            false,
+        )
+        .await?;
+        create_index(
+            manager,
+            OLD_STARRED_CREATED_AT_IDX,
+            &[QueryHistory::Starred, QueryHistory::CreatedAt],
+            false,
+        )
+        .await?;
+        for column in [
+            QueryHistory::Status,
+            QueryHistory::UpdatedAt,
+            QueryHistory::RunCount,
+            QueryHistory::Streams,
+            QueryHistory::QueryKey,
+            QueryHistory::Source,
+        ] {
+            if manager.has_column(TABLE, &column.to_string()).await? {
+                manager
+                    .alter_table(
+                        Table::alter()
+                            .table(QueryHistory::Table)
+                            .drop_column(column)
+                            .to_owned(),
+                    )
+                    .await?;
+            }
+        }
+        Ok(())
+    }
+}
+
+#[derive(DeriveIden, Clone, Copy)]
+enum QueryHistory {
+    Table,
+    OrgId,
+    UserEmail,
+    Starred,
+    CreatedAt,
+    Source,
+    QueryKey,
+    Streams,
+    RunCount,
+    UpdatedAt,
+    Status,
+}
+
+async fn add_column(manager: &SchemaManager<'_>, def: &mut ColumnDef) -> Result<(), DbErr> {
+    if manager.has_column(TABLE, &def.get_column_name()).await? {
+        return Ok(());
+    }
+    manager
+        .alter_table(
+            Table::alter()
+                .table(QueryHistory::Table)
+                .add_column(def.to_owned())
+                .to_owned(),
+        )
+        .await
+}
+
+async fn drop_index(manager: &SchemaManager<'_>, name: &str) -> Result<(), DbErr> {
+    manager
+        .drop_index(
+            Index::drop()
+                .if_exists()
+                .name(name)
+                .table(QueryHistory::Table)
+                .to_owned(),
+        )
+        .await
+}
+
+async fn create_index(
+    manager: &SchemaManager<'_>,
+    name: &str,
+    columns: &[QueryHistory],
+    unique: bool,
+) -> Result<(), DbErr> {
+    let mut index = Index::create();
+    index.if_not_exists().name(name).table(QueryHistory::Table);
+    if unique {
+        index.unique();
+    }
+    for column in columns {
+        index.col(*column);
+    }
+    manager.create_index(index.to_owned()).await
+}
+
+#[cfg(test)]
+mod tests {
+    use sea_orm::{ConnectionTrait, Database, DatabaseConnection, DbBackend, Statement};
+    use sea_orm_migration::{MigrationName, MigrationTrait};
+
+    use super::*;
+
+    type Row = (
+        String,
+        String,
+        Option<String>,
+        String,
+        i64,
+        i64,
+        i64,
+        String,
+    );
+
+    async fn v1_1_table_with_rows() -> DatabaseConnection {
+        let db = Database::connect("sqlite::memory:").await.unwrap();
+        seed_v1_1_table(&db).await;
+        db
+    }
+
+    async fn seed_v1_1_table(db: &DatabaseConnection) {
+        super::super::m20261004_000001_create_query_history::Migration
+            .up(&SchemaManager::new(db))
+            .await
+            .unwrap();
+        for (id, starred, created_at) in [("old", false, 100), ("star", true, 200)] {
+            db.execute_unprepared(&format!(
+                "INSERT INTO query_history (id, org_id, user_email, query, context, starred, \
+                 created_at) VALUES ('{id}', 'default', 'a@x.com', 'up', '{{\"step\":\"1m\"}}', \
+                 {starred}, {created_at})"
+            ))
+            .await
+            .unwrap();
+        }
+    }
+
+    /// A throwaway schema on the CI Postgres; `None` where none is configured.
+    async fn postgres_schema() -> Option<(DatabaseConnection, DatabaseConnection, String)> {
+        let dsn = std::env::var("ZO_META_POSTGRES_DSN").ok()?;
+        // The SQLite lane sets the variable empty rather than unsetting it.
+        if dsn.trim().is_empty() {
+            return None;
+        }
+        let schema = format!(
+            "qh_migration_test_{}",
+            config::ider::generate().to_ascii_lowercase()
+        );
+        let admin = Database::connect(&dsn).await.unwrap();
+        admin
+            .execute_unprepared(&format!(r#"CREATE SCHEMA "{schema}""#))
+            .await
+            .unwrap();
+        let mut options = sea_orm::ConnectOptions::new(dsn);
+        options
+            .max_connections(1)
+            .set_schema_search_path(schema.clone());
+        Some((admin, Database::connect(options).await.unwrap(), schema))
+    }
+
+    async fn rows(db: &DatabaseConnection) -> Vec<Row> {
+        db.query_all(Statement::from_string(
+            DbBackend::Sqlite,
+            "SELECT id, source, query_key, streams, run_count, created_at, updated_at, status \
+             FROM query_history ORDER BY id",
+        ))
+        .await
+        .unwrap()
+        .iter()
+        .map(|r| {
+            (
+                r.try_get_by_index(0).unwrap(),
+                r.try_get_by_index(1).unwrap(),
+                r.try_get_by_index(2).unwrap(),
+                r.try_get_by_index(3).unwrap(),
+                r.try_get_by_index(4).unwrap(),
+                r.try_get_by_index(5).unwrap(),
+                r.try_get_by_index(6).unwrap(),
+                r.try_get_by_index(7).unwrap(),
+            )
+        })
+        .collect()
+    }
+
+    async fn index_columns(db: &DatabaseConnection, index: &str) -> Vec<Option<String>> {
+        db.query_all(Statement::from_string(
+            DbBackend::Sqlite,
+            format!("SELECT name FROM pragma_index_info('{index}') ORDER BY seqno"),
+        ))
+        .await
+        .unwrap()
+        .iter()
+        .map(|r| r.try_get::<Option<String>>("", "name").unwrap())
+        .collect()
+    }
+
+    #[tokio::test]
+    async fn test_up_backfills_updated_at_from_created_at_on_a_populated_v1_1_table() {
+        let db = v1_1_table_with_rows().await;
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.unwrap();
+
+        let to_row = |id: &str, created_at: i64, updated_at: i64| -> Row {
+            (
+                id.to_string(),
+                "metrics".to_string(),
+                None,
+                String::new(),
+                1,
+                created_at,
+                updated_at,
+                "ok".to_string(),
+            )
+        };
+        assert_eq!(
+            rows(&db).await,
+            vec![to_row("old", 100, 100), to_row("star", 200, 200)],
+            "every v1.1.x row gets updated_at = created_at"
+        );
+
+        db.execute_unprepared("UPDATE query_history SET updated_at = 900 WHERE id = 'old'")
+            .await
+            .unwrap();
+        Migration.up(&manager).await.expect("idempotent");
+        assert_eq!(
+            rows(&db).await,
+            vec![to_row("old", 100, 900), to_row("star", 200, 200)],
+            "a rerun leaves a row that ran after the upgrade alone"
+        );
+
+        let listed = crate::table::query_history::list_with(
+            &db,
+            "default",
+            "a@x.com",
+            &crate::table::query_history::ListFilter {
+                sources: vec!["metrics".to_string()],
+                ..Default::default()
+            },
+            10,
+            0,
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            listed
+                .iter()
+                .map(|r| (r.id.as_str(), r.updated_at))
+                .collect::<Vec<_>>(),
+            vec![("old", 900), ("star", 200)]
+        );
+    }
+
+    #[tokio::test]
+    async fn test_up_swaps_indexes() {
+        let db = v1_1_table_with_rows().await;
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.unwrap();
+
+        for old in [OLD_ORG_USER_CREATED_AT_IDX, OLD_STARRED_CREATED_AT_IDX] {
+            assert!(!manager.has_index(TABLE, old).await.unwrap(), "{old}");
+        }
+        let names = |cols: &[Option<&str>]| -> Vec<Option<String>> {
+            cols.iter().map(|c| c.map(str::to_string)).collect()
+        };
+        assert_eq!(
+            index_columns(&db, ORG_USER_UPDATED_AT_IDX).await,
+            names(&[Some("org_id"), Some("user_email"), Some("updated_at")])
+        );
+        assert_eq!(
+            index_columns(&db, ORG_USER_SOURCE_UPDATED_AT_IDX).await,
+            names(&[
+                Some("org_id"),
+                Some("user_email"),
+                Some("source"),
+                Some("updated_at")
+            ])
+        );
+        assert_eq!(
+            index_columns(&db, STARRED_UPDATED_AT_IDX).await,
+            names(&[Some("starred"), Some("updated_at")])
+        );
+        assert_eq!(
+            index_columns(&db, ORG_USER_SOURCE_KEY_UIDX).await,
+            names(&[
+                Some("org_id"),
+                Some("user_email"),
+                Some("source"),
+                Some("query_key")
+            ])
+        );
+    }
+
+    #[tokio::test]
+    async fn test_up_leaves_exactly_the_agreed_index_set() {
+        let db = v1_1_table_with_rows().await;
+        Migration.up(&SchemaManager::new(&db)).await.unwrap();
+        let indexes: Vec<(String, bool)> = db
+            .query_all(Statement::from_string(
+                DbBackend::Sqlite,
+                "SELECT name, \"unique\" FROM pragma_index_list('query_history') \
+                 WHERE origin = 'c' ORDER BY name",
+            ))
+            .await
+            .unwrap()
+            .iter()
+            .map(|r| {
+                (
+                    r.try_get_by_index(0).unwrap(),
+                    r.try_get_by_index::<i64>(1).unwrap() == 1,
+                )
+            })
+            .collect();
+        assert_eq!(
+            indexes,
+            vec![
+                (ORG_USER_SOURCE_KEY_UIDX.to_string(), true),
+                (ORG_USER_SOURCE_UPDATED_AT_IDX.to_string(), false),
+                (ORG_USER_UPDATED_AT_IDX.to_string(), false),
+                (STARRED_UPDATED_AT_IDX.to_string(), false),
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn test_unique_key_allows_null_keys_and_refuses_a_duplicate_key() {
+        let db = v1_1_table_with_rows().await;
+        Migration.up(&SchemaManager::new(&db)).await.unwrap();
+        let insert = |id: &str, key: &str| {
+            format!(
+                "INSERT INTO query_history (id, org_id, user_email, query, context, created_at, \
+                 query_key) VALUES ('{id}', 'default', 'a@x.com', 'up', '{{}}', 1, {key})"
+            )
+        };
+        db.execute_unprepared(&insert("legacy", "NULL"))
+            .await
+            .expect("a v1.1.x node inserts with no key");
+        db.execute_unprepared(&insert("k1", "'abc'")).await.unwrap();
+        assert!(db.execute_unprepared(&insert("k2", "'abc'")).await.is_err());
+    }
+
+    #[tokio::test]
+    async fn test_down_restores_the_v1_1_table() {
+        let db = v1_1_table_with_rows().await;
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.unwrap();
+        Migration.down(&manager).await.unwrap();
+        for column in [
+            "source",
+            "query_key",
+            "streams",
+            "run_count",
+            "updated_at",
+            "status",
+        ] {
+            assert!(
+                !manager.has_column(TABLE, column).await.unwrap(),
+                "{column}"
+            );
+        }
+        assert!(
+            manager
+                .has_index(TABLE, OLD_ORG_USER_CREATED_AT_IDX)
+                .await
+                .unwrap()
+        );
+        assert!(
+            manager
+                .has_index(TABLE, OLD_STARRED_CREATED_AT_IDX)
+                .await
+                .unwrap()
+        );
+    }
+
+    #[tokio::test]
+    async fn test_down_keeps_the_last_run_of_rows_an_old_node_wrote() {
+        let db = v1_1_table_with_rows().await;
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.unwrap();
+        db.execute_unprepared(
+            "INSERT INTO query_history (id, org_id, user_email, query, context, created_at) \
+             VALUES ('mid', 'default', 'a@x.com', 'up', '{}', 300)",
+        )
+        .await
+        .unwrap();
+        db.execute_unprepared("UPDATE query_history SET updated_at = 900 WHERE id = 'old'")
+            .await
+            .unwrap();
+        Migration.down(&manager).await.unwrap();
+
+        let created: Vec<(String, i64)> = db
+            .query_all(Statement::from_string(
+                DbBackend::Sqlite,
+                "SELECT id, created_at FROM query_history ORDER BY id",
+            ))
+            .await
+            .unwrap()
+            .iter()
+            .map(|r| {
+                (
+                    r.try_get_by_index(0).unwrap(),
+                    r.try_get_by_index(1).unwrap(),
+                )
+            })
+            .collect();
+        assert_eq!(
+            created,
+            vec![
+                ("mid".to_string(), 300),
+                ("old".to_string(), 900),
+                ("star".to_string(), 200)
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn test_down_runs_twice() {
+        let db = v1_1_table_with_rows().await;
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.unwrap();
+        Migration.down(&manager).await.unwrap();
+        Migration
+            .down(&manager)
+            .await
+            .expect("a second rollback is a no-op");
+    }
+
+    #[tokio::test]
+    async fn test_postgres_up_and_down_on_a_populated_v1_1_table_when_ci_provides_it() {
+        let Some((admin, db, schema)) = postgres_schema().await else {
+            return;
+        };
+        seed_v1_1_table(&db).await;
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.unwrap();
+        Migration.up(&manager).await.expect("idempotent");
+
+        for index in [
+            ORG_USER_UPDATED_AT_IDX,
+            ORG_USER_SOURCE_UPDATED_AT_IDX,
+            STARRED_UPDATED_AT_IDX,
+            ORG_USER_SOURCE_KEY_UIDX,
+        ] {
+            assert!(manager.has_index(TABLE, index).await.unwrap(), "{index}");
+        }
+        let listed = crate::table::query_history::list_with(
+            &db,
+            "default",
+            "a@x.com",
+            &crate::table::query_history::ListFilter {
+                sources: vec!["metrics".to_string()],
+                ..Default::default()
+            },
+            10,
+            0,
+        )
+        .await
+        .unwrap();
+        // Postgres pads the char(27) id.
+        assert_eq!(
+            listed
+                .iter()
+                .map(|r| (r.id.trim(), r.updated_at))
+                .collect::<Vec<_>>(),
+            vec![("star", 200), ("old", 100)]
+        );
+        let insert = |id: &str| {
+            format!(
+                "INSERT INTO query_history (id, org_id, user_email, query, context, created_at, \
+                 query_key) VALUES ('{id}', 'default', 'a@x.com', 'up', '{{}}', 1, 'abc')"
+            )
+        };
+        db.execute_unprepared(&insert("k1")).await.unwrap();
+        assert!(db.execute_unprepared(&insert("k2")).await.is_err());
+
+        Migration.down(&manager).await.unwrap();
+        Migration
+            .down(&manager)
+            .await
+            .expect("a second rollback is a no-op");
+        assert!(!manager.has_column(TABLE, "updated_at").await.unwrap());
+        assert!(
+            manager
+                .has_index(TABLE, OLD_ORG_USER_CREATED_AT_IDX)
+                .await
+                .unwrap()
+        );
+
+        db.close().await.unwrap();
+        admin
+            .execute_unprepared(&format!(r#"DROP SCHEMA "{schema}" CASCADE"#))
+            .await
+            .unwrap();
+    }
+
+    #[test]
+    fn test_migration_name() {
+        assert_eq!(Migration.name(), "m20261027_000001_alter_query_history");
+    }
+}
diff --git a/src/infra/src/table/migration/m20261030_000001_add_suppress_repeats_to_alerts.rs b/src/infra/src/table/migration/m20261030_000001_add_suppress_repeats_to_alerts.rs
new file mode 100644
index 0000000000..a24f3a941f
--- /dev/null
+++ b/src/infra/src/table/migration/m20261030_000001_add_suppress_repeats_to_alerts.rs
@@ -0,0 +1,92 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use sea_orm_migration::prelude::*;
+
+const TABLE: &str = "alerts";
+const COLUMN: &str = "suppress_repeats";
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        // SQLite emits a plain ADD COLUMN for add_column_if_not_exists, so guard explicitly.
+        if manager.has_column(TABLE, COLUMN).await? {
+            return Ok(());
+        }
+        manager.alter_table(add_column_statement()).await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        if !manager.has_column(TABLE, COLUMN).await? {
+            return Ok(());
+        }
+        manager
+            .alter_table(
+                Table::alter()
+                    .table(Alerts::Table)
+                    .drop_column(Alerts::SuppressRepeats)
+                    .to_owned(),
+            )
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum Alerts {
+    Table,
+    SuppressRepeats,
+}
+
+fn add_column_statement() -> TableAlterStatement {
+    Table::alter()
+        .table(Alerts::Table)
+        .add_column(ColumnDef::new(Alerts::SuppressRepeats).boolean().null())
+        .to_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use sea_orm::{ConnectionTrait, Database};
+
+    use super::*;
+
+    #[test]
+    fn postgres() {
+        assert_eq!(
+            &add_column_statement().to_string(PostgresQueryBuilder),
+            r#"ALTER TABLE "alerts" ADD COLUMN "suppress_repeats" bool NULL"#
+        );
+    }
+
+    #[tokio::test]
+    async fn test_up_reruns_without_adding_the_column_twice() {
+        let db = Database::connect("sqlite::memory:").await.unwrap();
+        db.execute_unprepared("CREATE TABLE alerts (id varchar(27) PRIMARY KEY)")
+            .await
+            .unwrap();
+        let manager = SchemaManager::new(&db);
+
+        Migration.up(&manager).await.expect("first run");
+        Migration.up(&manager).await.expect("second run");
+        assert!(manager.has_column(TABLE, COLUMN).await.unwrap());
+
+        Migration.down(&manager).await.unwrap();
+        Migration.down(&manager).await.unwrap();
+        assert!(!manager.has_column(TABLE, COLUMN).await.unwrap());
+    }
+}
diff --git a/src/infra/src/table/migration/m20261030_000001_create_org_domain_ownership_table.rs b/src/infra/src/table/migration/m20261030_000001_create_org_domain_ownership_table.rs
new file mode 100644
index 0000000000..193b6c575e
--- /dev/null
+++ b/src/infra/src/table/migration/m20261030_000001_create_org_domain_ownership_table.rs
@@ -0,0 +1,135 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager.create_table(create_domains_stmt()).await?;
+        manager.create_index(domain_org_idx()).await?;
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(OrgDomainOwnership::Table).to_owned())
+            .await?;
+        Ok(())
+    }
+}
+
+fn create_domains_stmt() -> TableCreateStatement {
+    Table::create()
+        .table(OrgDomainOwnership::Table)
+        .if_not_exists()
+        .col(
+            ColumnDef::new(OrgDomainOwnership::Id)
+                .string_len(27)
+                .not_null()
+                .primary_key(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::OrgId)
+                .string_len(100)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::Domain)
+                .string_len(253)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::VerificationToken)
+                .string_len(128)
+                .not_null(),
+        )
+        // 0 pending, 1 verified, 2 failed.
+        .col(
+            ColumnDef::new(OrgDomainOwnership::VerificationState)
+                .integer()
+                .not_null()
+                .default(0),
+        )
+        // 0 record-missing, 1 value-mismatch, 2 dns-resolution-failed.
+        .col(
+            ColumnDef::new(OrgDomainOwnership::VerificationFailureReason)
+                .integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::VerifiedAt)
+                .big_integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::ReleasedAt)
+                .big_integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::LastCheckedAt)
+                .big_integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::CreatedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::UpdatedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainOwnership::MetaMapped)
+                .boolean()
+                .not_null()
+                .default(false),
+        )
+        .to_owned()
+}
+
+fn domain_org_idx() -> IndexCreateStatement {
+    sea_query::Index::create()
+        .if_not_exists()
+        .name("org_domain_ownership_org_domain_idx")
+        .table(OrgDomainOwnership::Table)
+        .col(OrgDomainOwnership::OrgId)
+        .col(OrgDomainOwnership::Domain)
+        .col(OrgDomainOwnership::VerificationState)
+        .to_owned()
+}
+
+#[derive(DeriveIden)]
+enum OrgDomainOwnership {
+    Table,
+    Id,
+    OrgId,
+    Domain,
+    VerificationToken,
+    VerificationState,
+    VerificationFailureReason,
+    VerifiedAt,
+    ReleasedAt,
+    LastCheckedAt,
+    CreatedAt,
+    UpdatedAt,
+    MetaMapped,
+}
diff --git a/src/infra/src/table/migration/m20261030_000002_create_org_domain_ownership_req_table.rs b/src/infra/src/table/migration/m20261030_000002_create_org_domain_ownership_req_table.rs
new file mode 100644
index 0000000000..96a950bc32
--- /dev/null
+++ b/src/infra/src/table/migration/m20261030_000002_create_org_domain_ownership_req_table.rs
@@ -0,0 +1,98 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use sea_orm_migration::prelude::*;
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager.create_table(create_domaim_req_stmt()).await?;
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_table(Table::drop().table(OrgDomainRequests::Table).to_owned())
+            .await?;
+        Ok(())
+    }
+}
+
+fn create_domaim_req_stmt() -> TableCreateStatement {
+    Table::create()
+        .table(OrgDomainRequests::Table)
+        .if_not_exists()
+        .col(
+            ColumnDef::new(OrgDomainRequests::Id)
+                .string_len(27)
+                .not_null()
+                .primary_key(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainRequests::OrgId)
+                .string_len(100)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainRequests::Domain)
+                .string_len(253)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainRequests::CreatedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainRequests::UpdatedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainRequests::RequestedBy)
+                .string_len(100)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(OrgDomainRequests::AnsweredBy)
+                .string_len(100)
+                .null(),
+        )
+        .col(ColumnDef::new(OrgDomainRequests::Reason).string().null())
+        .col(
+            ColumnDef::new(OrgDomainRequests::Status)
+                .integer()
+                .not_null()
+                .default(0),
+        )
+        .to_owned()
+}
+
+#[derive(DeriveIden)]
+enum OrgDomainRequests {
+    Table,
+    Id,
+    OrgId,
+    Domain,
+    CreatedAt,
+    UpdatedAt,
+    RequestedBy,
+    AnsweredBy,
+    Reason,
+    Status,
+}
diff --git a/src/infra/src/table/migration/mod.rs b/src/infra/src/table/migration/mod.rs
index de27c92e44..66549dfe4d 100644
--- a/src/infra/src/table/migration/mod.rs
+++ b/src/infra/src/table/migration/mod.rs
@@ -241,8 +241,12 @@ mod m20261025_000003_add_mute_targets_to_downtimes;
 mod m20261025_000004_create_slack_alert_messages;
 mod m20261025_000005_add_held_action_to_slack_link_requests;
 mod m20261026_000001_backfill_v1_rca_pointer;
+mod m20261027_000001_alter_query_history;
 mod m20261028_000001_add_group_label_set_to_alert_states;
 mod m20261029_000001_widen_alert_dedup_fingerprint;
+mod m20261030_000001_add_suppress_repeats_to_alerts;
+mod m20261030_000001_create_org_domain_ownership_table;
+mod m20261030_000002_create_org_domain_ownership_req_table;
 /// Shared body of the two `folder_id` migrations above; not a migration itself.
 mod workflow_folder_id;
 
@@ -435,10 +439,13 @@ pub(crate) async fn create_rum_pa_tables(db: &sea_orm::DatabaseConnection) -> Re
 
 /// Apply only the Slack app tables, idempotently, for tests in any crate.
 #[cfg(any(test, feature = "test-utils"))]
-pub(crate) async fn create_slack_tables<C: sea_orm::ConnectionTrait>(db: &C) -> Result<(), DbErr> {
+pub(crate) async fn create_slack_tables(db: &sea_orm::DatabaseConnection) -> Result<(), DbErr> {
+    use sea_orm_migration::MigrationTrait;
     m20261018_000001_create_slack_tables::create_all(db).await?;
     m20261025_000004_create_slack_alert_messages::create_all(db).await?;
-    m20261025_000005_add_held_action_to_slack_link_requests::add_column(db).await
+    m20261025_000005_add_held_action_to_slack_link_requests::Migration
+        .up(&SchemaManager::new(db))
+        .await
 }
 
 /// Apply only `alert_acks`, idempotently, for tests in any crate.
@@ -501,6 +508,20 @@ pub(crate) async fn backfill_v1_rca_pointer(db: &sea_orm::DatabaseConnection) ->
         .await
 }
 
+/// Apply the query_history table and its columns, idempotently, for tests in any crate.
+#[cfg(any(test, feature = "test-utils"))]
+pub(crate) async fn create_query_history_table(
+    db: &sea_orm::DatabaseConnection,
+) -> Result<(), DbErr> {
+    let manager = SchemaManager::new(db);
+    m20261004_000001_create_query_history::Migration
+        .up(&manager)
+        .await?;
+    m20261027_000001_alter_query_history::Migration
+        .up(&manager)
+        .await
+}
+
 pub struct Migrator;
 
 #[async_trait::async_trait]
@@ -732,6 +753,10 @@ impl MigratorTrait for Migrator {
             Box::new(m20261025_000005_add_held_action_to_slack_link_requests::Migration),
             Box::new(m20261028_000001_add_group_label_set_to_alert_states::Migration),
             Box::new(m20261029_000001_widen_alert_dedup_fingerprint::Migration),
+            Box::new(m20261027_000001_alter_query_history::Migration),
+            Box::new(m20261030_000001_add_suppress_repeats_to_alerts::Migration),
+            Box::new(m20261030_000001_create_org_domain_ownership_table::Migration),
+            Box::new(m20261030_000002_create_org_domain_ownership_req_table::Migration),
         ]
     }
 }
@@ -825,6 +850,12 @@ mod tests {
         ),
         (127, "m20261028_000001_add_group_label_set_to_alert_states"),
         (128, "m20261029_000001_widen_alert_dedup_fingerprint"),
+        (129, "m20261027_000001_alter_query_history"),
+        (130, "m20261030_000001_add_suppress_repeats_to_alerts"),
+        (
+            131,
+            "m20261030_000002_create_org_domain_ownership_req_table",
+        ),
     ];
 
     // Two branches that each claim the next version merge cleanly, so a reused number must fail
diff --git a/src/infra/src/table/mod.rs b/src/infra/src/table/mod.rs
index 3bfbc17c3f..feb95ad2d2 100644
--- a/src/infra/src/table/mod.rs
+++ b/src/infra/src/table/mod.rs
@@ -82,6 +82,8 @@ pub mod oncall_user_contacts;
 pub mod online_eval_jobs;
 pub mod org_ai_toolsets;
 pub mod org_cleanup_tasks;
+pub mod org_domain_ownership;
+pub mod org_domain_requests;
 pub mod org_ingestion_tokens;
 pub mod org_storage_providers;
 pub mod org_telephony;
diff --git a/src/infra/src/table/org_domain_ownership.rs b/src/infra/src/table/org_domain_ownership.rs
new file mode 100644
index 0000000000..42ee704cef
--- /dev/null
+++ b/src/infra/src/table/org_domain_ownership.rs
@@ -0,0 +1,150 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use std::collections::HashMap;
+
+use config::utils::{rand::generate_random_string, time::now_micros};
+use sea_orm::{
+    ActiveModelTrait, ActiveValue::Set, ColumnTrait, EntityTrait, IntoActiveModel, QueryFilter,
+    QuerySelect, sea_query::Expr,
+};
+
+use super::entity::{org_domain_ownership::*, prelude::OrgDomainOwnership};
+use crate::db::{get_orm_client_ro, get_orm_client_rw};
+
+pub enum OwnershipState {
+    Pending = 0,
+    Verified = 1,
+    Failed = 2,
+}
+pub struct OwnershipRecord {
+    pub org_id: String,
+    pub domain: String,
+    pub state: OwnershipState,
+}
+
+pub async fn list_active_domain_org_map() -> Result<HashMap<String, String>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let records = OrgDomainOwnership::find()
+        .select_only()
+        .column(Column::Domain)
+        .column(Column::OrgId)
+        .filter(Column::VerificationState.eq(OwnershipState::Verified as i32))
+        .into_tuple::<(String, String)>()
+        .all(client)
+        .await?;
+    Ok(records.into_iter().collect())
+}
+
+pub async fn get_verified_org_for_domain(domain: &str) -> Result<Option<String>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let record = OrgDomainOwnership::find()
+        .select_only()
+        .column(Column::OrgId)
+        .filter(Column::Domain.eq(domain))
+        .filter(Column::VerificationState.eq(OwnershipState::Verified as i32))
+        .into_tuple::<(String,)>()
+        .one(client)
+        .await?;
+    Ok(record.map(|v| v.0))
+}
+
+pub async fn get_domains_for_org(org_id: &str) -> Result<Vec<Model>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let records = OrgDomainOwnership::find()
+        .filter(Column::OrgId.eq(org_id))
+        .all(client)
+        .await?;
+    Ok(records)
+}
+
+pub async fn save_org_domain_mapping(
+    record: OwnershipRecord,
+    meta_mapped: bool,
+) -> Result<(), anyhow::Error> {
+    let client = get_orm_client_rw().await;
+    let now = now_micros();
+    let token = format!("o2v_{}_{}", record.org_id, generate_random_string(32));
+
+    let m = ActiveModel {
+        id: Set(config::ider::generate()),
+        org_id: Set(record.org_id),
+        domain: Set(record.domain),
+        verification_token: Set(token),
+        verification_state: Set(record.state as i32),
+        verification_failure_reason: Set(None),
+        verified_at: Set(None),
+        released_at: Set(None),
+        last_checked_at: Set(None),
+        created_at: Set(now),
+        updated_at: Set(now),
+        meta_mapped: Set(meta_mapped),
+    };
+    OrgDomainOwnership::insert(m).exec(client).await?;
+    Ok(())
+}
+
+pub async fn delete_linked_domain(org_id: &str, domain: &str) -> Result<(), anyhow::Error> {
+    let client = get_orm_client_rw().await;
+    OrgDomainOwnership::delete_many()
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::Domain.eq(domain))
+        .exec(client)
+        .await?;
+    Ok(())
+}
+
+pub async fn get_domain_org_record(
+    org_id: &str,
+    domain: &str,
+) -> Result<Option<Model>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let res = OrgDomainOwnership::find()
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::Domain.eq(domain))
+        .one(client)
+        .await?;
+    Ok(res)
+}
+
+pub async fn save_domain_org_record(model: Model) -> Result<(), anyhow::Error> {
+    let client = get_orm_client_rw().await;
+    let am = model.clone().into_active_model().reset_all();
+    am.update(client).await?;
+    Ok(())
+}
+
+pub async fn list_all() -> Result<Vec<Model>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let res = OrgDomainOwnership::find().all(client).await?;
+    Ok(res)
+}
+
+pub async fn mark_meta_mapped(org_id: &str, domain: &str) -> Result<(), anyhow::Error> {
+    let now = now_micros();
+    let client = get_orm_client_rw().await;
+    OrgDomainOwnership::update_many()
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::Domain.eq(domain))
+        .col_expr(Column::MetaMapped, Expr::value(true))
+        .col_expr(Column::LastCheckedAt, Expr::value(now))
+        .col_expr(
+            Column::VerificationState,
+            Expr::value(OwnershipState::Verified as i32),
+        )
+        .exec(client)
+        .await?;
+    Ok(())
+}
diff --git a/src/infra/src/table/org_domain_requests.rs b/src/infra/src/table/org_domain_requests.rs
new file mode 100644
index 0000000000..b482055ec5
--- /dev/null
+++ b/src/infra/src/table/org_domain_requests.rs
@@ -0,0 +1,107 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use config::utils::time::now_micros;
+use sea_orm::{ColumnTrait, EntityTrait, IntoActiveModel, QueryFilter, sea_query::Expr};
+
+use super::entity::{org_domain_requests::*, prelude::OrgDomainRequests};
+use crate::db::{get_orm_client_ro, get_orm_client_rw};
+
+#[derive(Debug)]
+pub enum Status {
+    Pending = 0,
+    Approved = 1,
+    Rejected = 2,
+}
+impl From<i32> for Status {
+    fn from(value: i32) -> Self {
+        match value {
+            0 => Self::Pending,
+            1 => Self::Approved,
+            2 => Self::Rejected,
+            _ => Self::Pending,
+        }
+    }
+}
+
+pub async fn save_org_domain_request(req: Model) -> Result<(), anyhow::Error> {
+    let client = get_orm_client_rw().await;
+    let m = req.into_active_model();
+    OrgDomainRequests::insert(m).exec(client).await?;
+    Ok(())
+}
+
+pub async fn list_all() -> Result<Vec<Model>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let res = OrgDomainRequests::find().all(client).await?;
+    Ok(res)
+}
+
+pub async fn list_by_org(org_id: &str) -> Result<Vec<Model>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let res = OrgDomainRequests::find()
+        .filter(Column::OrgId.eq(org_id))
+        .all(client)
+        .await?;
+    Ok(res)
+}
+
+pub async fn update_status(
+    id: &str,
+    user: &str,
+    new_status: Status,
+    reason: String,
+) -> Result<(), anyhow::Error> {
+    let now = now_micros();
+    let client = get_orm_client_rw().await;
+    OrgDomainRequests::update_many()
+        .filter(Column::Id.eq(id))
+        .col_expr(Column::Status, Expr::value(new_status as i32))
+        .col_expr(Column::AnsweredBy, Expr::value(user))
+        .col_expr(Column::Reason, Expr::value(reason))
+        .col_expr(Column::UpdatedAt, Expr::value(now))
+        .exec(client)
+        .await?;
+    Ok(())
+}
+
+pub async fn get_by_id(id: &str) -> Result<Option<Model>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let res = OrgDomainRequests::find()
+        .filter(Column::Id.eq(id))
+        .one(client)
+        .await?;
+    Ok(res)
+}
+
+pub async fn get_by_org_domain(org_id: &str, domain: &str) -> Result<Option<Model>, anyhow::Error> {
+    let client = get_orm_client_ro().await;
+    let res = OrgDomainRequests::find()
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::Domain.eq(domain))
+        .filter(Column::Status.ne(Status::Approved as i32))
+        .one(client)
+        .await?;
+    Ok(res)
+}
+
+pub async fn delete_by_org(org_id: &str) -> Result<(), anyhow::Error> {
+    let client = get_orm_client_rw().await;
+    OrgDomainRequests::delete_many()
+        .filter(Column::OrgId.eq(org_id))
+        .exec(client)
+        .await?;
+    Ok(())
+}
diff --git a/src/infra/src/table/query_history.rs b/src/infra/src/table/query_history.rs
index 0e99051af3..a83d21635e 100644
--- a/src/infra/src/table/query_history.rs
+++ b/src/infra/src/table/query_history.rs
@@ -14,199 +14,173 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 use sea_orm::{
-    ColumnTrait, Condition, ConnectionTrait, EntityTrait, PaginatorTrait, QueryFilter, QueryOrder,
-    QuerySelect, Set, TransactionTrait,
-    sea_query::{Expr, Func, LikeExpr, SimpleExpr},
+    ColumnTrait, Condition, ConnectionTrait, DbBackend, EntityTrait, FromQueryResult,
+    PaginatorTrait, QueryFilter, QueryOrder, QuerySelect, QueryTrait, Set, Statement,
+    TransactionTrait,
+    sea_query::{Expr, Func, LikeExpr, OnConflict, Query, SimpleExpr},
 };
 
 use super::entity::query_history::{ActiveModel, Column, Entity, Model};
 use crate::{
     db::{get_orm_client_ro, get_orm_client_rw},
-    errors,
+    errors, orm_err,
 };
 
-/// Recording prunes the user's oldest unstarred entries beyond this many.
-pub const MAX_UNSTARRED_PER_USER: u64 = 1000;
-/// Starring past this many is refused; recording never stars, so it is unaffected.
+/// Recording a new row prunes the user's oldest unstarred rows of that source beyond this many.
+pub const MAX_UNSTARRED_PER_SOURCE: u64 = 500;
+/// Starring past this many across all sources is refused; recording never stars.
 pub const MAX_STARRED_PER_USER: u64 = 200;
+/// Pages that record history; the handler refuses any other source.
+pub const SOURCES: [&str; 5] = ["logs", "traces", "metrics", "dbm", "profiles"];
+/// What v1.1.x rows and clients that send no source are.
+pub const DEFAULT_SOURCE: &str = "metrics";
+pub const STATUS_OK: &str = "ok";
+pub const STATUS_ERROR: &str = "error";
 
 /// Outcome of starring or unstarring an entry.
 pub enum SetStarred {
-    Updated(Model),
+    Updated(Box<Model>),
     NotFound,
     /// Starring would take the user past `MAX_STARRED_PER_USER`.
     StarredCapReached,
 }
 
-/// Records a query for this org and user; the same query as their latest entry refreshes it.
-pub async fn record(
-    org_id: &str,
-    user_email: &str,
-    query: &str,
-    context: serde_json::Value,
-    now_us: i64,
-) -> Result<Model, errors::Error> {
-    let client = get_orm_client_rw().await;
-    record_with(client, org_id, user_email, query, context, now_us).await
+/// One run to record; repeats of the same source and key merge into one row.
+pub struct NewRun<'a> {
+    pub org_id: &'a str,
+    pub user_email: &'a str,
+    pub source: &'a str,
+    pub query: &'a str,
+    /// The client's merge key; `None` or empty falls back to the query text.
+    pub query_key: Option<&'a str>,
+    pub streams: &'a [String],
+    pub status: &'a str,
+    pub context: serde_json::Value,
+    pub now_us: i64,
 }
 
-pub async fn record_with<C: ConnectionTrait + TransactionTrait>(
+/// List filters; every `None` or empty field matches all rows.
+#[derive(Default)]
+pub struct ListFilter {
+    pub sources: Vec<String>,
+    pub status: Option<String>,
+    /// Exact stream name.
+    pub stream: Option<String>,
+    /// Case-insensitive literal substring of the query or the streams.
+    pub q: Option<String>,
+    pub starred: Option<bool>,
+    /// Inclusive bounds on `updated_at`, in microseconds.
+    pub ran_from: Option<i64>,
+    pub ran_to: Option<i64>,
+}
+
+/// Records a run: inserts a row, or merges into the row with the same org, user, source and key.
+pub async fn record(run: NewRun<'_>) -> Result<Model, errors::Error> {
+    let client = get_orm_client_rw().await;
+    record_with(client, run).await
+}
+
+pub async fn record_with<C: ConnectionTrait>(
     conn: &C,
-    org_id: &str,
-    user_email: &str,
-    query: &str,
-    context: serde_json::Value,
-    now_us: i64,
+    run: NewRun<'_>,
 ) -> Result<Model, errors::Error> {
-    let txn = conn.begin().await?;
-    let latest = Entity::find()
-        .filter(Column::OrgId.eq(org_id))
-        .filter(Column::UserEmail.eq(user_email))
-        .select_only()
-        .column(Column::Id)
-        .column(Column::Query)
-        .column(Column::Starred)
-        .order_by_desc(Column::CreatedAt)
-        .order_by_desc(Column::Id)
-        .into_tuple::<(String, String, bool)>()
-        .one(&txn)
-        .await?;
-    let model = match latest {
-        Some((id, latest_query, starred)) if latest_query == query => {
-            Entity::update_many()
-                .col_expr(Column::CreatedAt, Expr::value(now_us))
-                .col_expr(Column::Context, Expr::value(context.clone()))
-                .filter(Column::Id.eq(&id))
-                .exec(&txn)
-                .await?;
-            Model {
-                id,
-                org_id: org_id.to_string(),
-                user_email: user_email.to_string(),
-                query: latest_query,
-                context,
-                starred,
-                created_at: now_us,
-            }
-        }
-        _ => {
-            let model = Model {
-                id: config::ider::uuid(),
-                org_id: org_id.to_string(),
-                user_email: user_email.to_string(),
-                query: query.to_string(),
-                context,
-                starred: false,
-                created_at: now_us,
-            };
-            Entity::insert(ActiveModel {
-                id: Set(model.id.clone()),
-                org_id: Set(model.org_id.clone()),
-                user_email: Set(model.user_email.clone()),
-                query: Set(model.query.clone()),
-                context: Set(model.context.clone()),
-                starred: Set(false),
-                created_at: Set(now_us),
-            })
-            .exec(&txn)
-            .await?;
-            prune_unstarred_over_cap(&txn, org_id, user_email).await?;
-            model
-        }
+    let entry = ActiveModel {
+        id: Set(config::ider::uuid()),
+        org_id: Set(run.org_id.to_string()),
+        user_email: Set(run.user_email.to_string()),
+        query: Set(run.query.to_string()),
+        context: Set(run.context),
+        starred: Set(false),
+        created_at: Set(run.now_us),
+        source: Set(run.source.to_string()),
+        query_key: Set(Some(query_key_hash(run.query_key, run.query))),
+        streams: Set(encode_streams(run.streams)),
+        run_count: Set(1),
+        updated_at: Set(run.now_us),
+        status: Set(run.status.to_string()),
     };
-    txn.commit().await?;
+    // One statement, so concurrent identical runs merge instead of racing to insert.
+    let mut stmt = Entity::insert(entry)
+        .on_conflict(
+            OnConflict::columns([
+                Column::OrgId,
+                Column::UserEmail,
+                Column::Source,
+                Column::QueryKey,
+            ])
+            .value(
+                Column::RunCount,
+                Expr::col((Entity, Column::RunCount)).add(1),
+            )
+            .update_columns([Column::UpdatedAt, Column::Context, Column::Status])
+            .to_owned(),
+        )
+        .into_query();
+    stmt.returning(Query::returning().all());
+
+    let Some(row) = conn
+        .query_one(conn.get_database_backend().build(&stmt))
+        .await?
+    else {
+        return orm_err!("query history upsert returned no row");
+    };
+    let model = Model::from_query_result(&row, "")?;
+    // After the upsert has committed, so a prune also sees rows that concurrent runs inserted.
+    if model.run_count == 1 {
+        prune_unstarred_over_cap(conn, run.org_id, run.user_email, run.source, &model.id).await?;
+    }
     Ok(model)
 }
 
-/// Lists one user's entries in one org, newest first.
+/// Lists one user's entries in one org, most recently run first.
 pub async fn list(
     org_id: &str,
     user_email: &str,
-    starred: Option<bool>,
-    q: Option<&str>,
+    filter: &ListFilter,
     limit: u64,
     offset: u64,
 ) -> Result<Vec<Model>, errors::Error> {
     let client = get_orm_client_ro().await;
-    list_with(client, org_id, user_email, starred, q, limit, offset).await
+    list_with(client, org_id, user_email, filter, limit, offset).await
 }
 
 pub async fn list_with<C: ConnectionTrait>(
     conn: &C,
     org_id: &str,
     user_email: &str,
-    starred: Option<bool>,
-    q: Option<&str>,
+    filter: &ListFilter,
     limit: u64,
     offset: u64,
 ) -> Result<Vec<Model>, errors::Error> {
-    let mut select = Entity::find()
-        .filter(Column::OrgId.eq(org_id))
-        .filter(Column::UserEmail.eq(user_email));
-    if let Some(starred) = starred {
-        select = select.filter(Column::Starred.eq(starred));
-    }
-    if let Some(q) = q.filter(|q| !q.is_empty()) {
-        select = select.filter(query_matches(q));
-    }
-    Ok(select
-        .order_by_desc(Column::CreatedAt)
-        .order_by_desc(Column::Id)
+    Ok(list_query(org_id, user_email, filter)
         .limit(limit)
         .offset(offset)
         .all(conn)
         .await?)
 }
 
-/// Deletes the user's unstarred rows from the `MAX_UNSTARRED_PER_USER + 1`-th newest onward.
-async fn prune_unstarred_over_cap<C: ConnectionTrait>(
+/// How many entries `list` would return with no limit.
+pub async fn count(
+    org_id: &str,
+    user_email: &str,
+    filter: &ListFilter,
+) -> Result<u64, errors::Error> {
+    let client = get_orm_client_ro().await;
+    count_with(client, org_id, user_email, filter).await
+}
+
+pub async fn count_with<C: ConnectionTrait>(
     conn: &C,
     org_id: &str,
     user_email: &str,
-) -> Result<(), errors::Error> {
-    let unstarred = Condition::all()
-        .add(Column::OrgId.eq(org_id))
-        .add(Column::UserEmail.eq(user_email))
-        .add(Column::Starred.eq(false));
-    let Some((created_at, id)) = Entity::find()
-        .filter(unstarred.clone())
-        .select_only()
-        .column(Column::CreatedAt)
-        .column(Column::Id)
-        .order_by_desc(Column::CreatedAt)
-        .order_by_desc(Column::Id)
-        .offset(MAX_UNSTARRED_PER_USER)
-        .into_tuple::<(i64, String)>()
-        .one(conn)
-        .await?
-    else {
-        return Ok(());
-    };
-    let at_or_before_boundary = Condition::any().add(Column::CreatedAt.lt(created_at)).add(
-        Condition::all()
-            .add(Column::CreatedAt.eq(created_at))
-            .add(Column::Id.lte(id)),
-    );
-    Entity::delete_many()
-        .filter(unstarred)
-        .filter(at_or_before_boundary)
-        .exec(conn)
-        .await?;
-    Ok(())
-}
-
-/// Case-insensitive literal substring match: `%`, `_` and `\` match only themselves.
-fn query_matches(q: &str) -> SimpleExpr {
-    let mut pattern = String::with_capacity(q.len() + 2);
-    pattern.push('%');
-    for c in q.to_lowercase().chars() {
-        if matches!(c, '\\' | '%' | '_') {
-            pattern.push('\\');
-        }
-        pattern.push(c);
-    }
-    pattern.push('%');
-    Expr::expr(Func::lower(Expr::col(Column::Query))).like(LikeExpr::new(pattern).escape('\\'))
+    filter: &ListFilter,
+) -> Result<u64, errors::Error> {
+    Ok(Entity::find()
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::UserEmail.eq(user_email))
+        .filter(list_condition(filter))
+        .count(conn)
+        .await?)
 }
 
 /// Stars or unstars one of the user's entries; starring is refused at `MAX_STARRED_PER_USER`.
@@ -220,29 +194,35 @@ pub async fn set_starred(
     set_starred_with(client, org_id, user_email, id, starred).await
 }
 
-pub async fn set_starred_with<C: ConnectionTrait>(
+pub async fn set_starred_with<C: ConnectionTrait + TransactionTrait>(
     conn: &C,
     org_id: &str,
     user_email: &str,
     id: &str,
     starred: bool,
 ) -> Result<SetStarred, errors::Error> {
-    // MySQL rows_affected counts changed rows, so a re-star reports 0; "not found" needs a lookup.
+    let txn = conn.begin().await?;
+    let users_rows = Condition::all()
+        .add(Column::OrgId.eq(org_id))
+        .add(Column::UserEmail.eq(user_email));
+    // Only a star can pass the cap, so an unstar takes no lock.
+    if starred && let Some(lock) = star_lock(txn.get_database_backend(), org_id, user_email) {
+        txn.execute(lock).await?;
+    }
+    // MySQL rows_affected counts changed rows, so a re-star reports 0; the response needs the row.
     let Some(entry) = Entity::find()
-        .filter(Column::OrgId.eq(org_id))
-        .filter(Column::UserEmail.eq(user_email))
+        .filter(users_rows.clone())
         .filter(Column::Id.eq(id))
-        .one(conn)
+        .one(&txn)
         .await?
     else {
         return Ok(SetStarred::NotFound);
     };
     if starred && !entry.starred {
         let starred_count = Entity::find()
-            .filter(Column::OrgId.eq(org_id))
-            .filter(Column::UserEmail.eq(user_email))
+            .filter(users_rows)
             .filter(Column::Starred.eq(true))
-            .count(conn)
+            .count(&txn)
             .await?;
         if starred_count >= MAX_STARRED_PER_USER {
             return Ok(SetStarred::StarredCapReached);
@@ -251,9 +231,10 @@ pub async fn set_starred_with<C: ConnectionTrait>(
     Entity::update_many()
         .col_expr(Column::Starred, Expr::value(starred))
         .filter(Column::Id.eq(id))
-        .exec(conn)
+        .exec(&txn)
         .await?;
-    Ok(SetStarred::Updated(Model { starred, ..entry }))
+    txn.commit().await?;
+    Ok(SetStarred::Updated(Box::new(Model { starred, ..entry })))
 }
 
 /// Deletes one of the user's entries in the org; false when it is not theirs or does not exist.
@@ -277,7 +258,37 @@ pub async fn delete_with<C: ConnectionTrait>(
     Ok(res.rows_affected > 0)
 }
 
-/// Deletes unstarred entries older than `cutoff_us` across every org and user; starred are kept.
+/// Deletes the user's entries in the org for `sources` (all when empty); starred only on request.
+pub async fn clear(
+    org_id: &str,
+    user_email: &str,
+    sources: &[String],
+    include_starred: bool,
+) -> Result<u64, errors::Error> {
+    let client = get_orm_client_rw().await;
+    clear_with(client, org_id, user_email, sources, include_starred).await
+}
+
+pub async fn clear_with<C: ConnectionTrait>(
+    conn: &C,
+    org_id: &str,
+    user_email: &str,
+    sources: &[String],
+    include_starred: bool,
+) -> Result<u64, errors::Error> {
+    let mut delete = Entity::delete_many()
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::UserEmail.eq(user_email));
+    if !sources.is_empty() {
+        delete = delete.filter(Column::Source.is_in(sources.iter().cloned()));
+    }
+    if !include_starred {
+        delete = delete.filter(Column::Starred.eq(false));
+    }
+    Ok(delete.exec(conn).await?.rows_affected)
+}
+
+/// Deletes unstarred entries first and last run before `cutoff_us` across every org and user.
 pub async fn delete_unstarred_before(cutoff_us: i64) -> Result<u64, errors::Error> {
     let client = get_orm_client_rw().await;
     delete_unstarred_before_with(client, cutoff_us).await
@@ -289,6 +300,8 @@ pub async fn delete_unstarred_before_with<C: ConnectionTrait>(
 ) -> Result<u64, errors::Error> {
     let res = Entity::delete_many()
         .filter(Column::Starred.eq(false))
+        .filter(Column::UpdatedAt.lt(cutoff_us))
+        // An older node in a rolling upgrade writes rows with updated_at = 0.
         .filter(Column::CreatedAt.lt(cutoff_us))
         .exec(conn)
         .await?;
@@ -345,151 +358,708 @@ pub async fn delete_by_email_with<C: ConnectionTrait>(
     Ok(res.rows_affected)
 }
 
+/// Splits the stored `,a,b,` form back into stream names.
+pub fn decode_streams(streams: &str) -> Vec<String> {
+    streams
+        .split(',')
+        .filter(|s| !s.is_empty())
+        .map(str::to_string)
+        .collect()
+}
+
+/// Creates the table as the migrations leave it; for tests, since the migrator replays everything.
+#[cfg(any(test, feature = "test-utils"))]
+pub async fn create_table_for_tests(
+    db: &sea_orm::DatabaseConnection,
+) -> Result<(), sea_orm::DbErr> {
+    super::migration::create_query_history_table(db).await
+}
+
+/// Comma-wrapped so `LIKE '%,name,%'` matches whole stream names only.
+fn encode_streams(streams: &[String]) -> String {
+    if streams.is_empty() {
+        return String::new();
+    }
+    format!(",{},", streams.join(","))
+}
+
+fn query_key_hash(query_key: Option<&str>, query: &str) -> String {
+    sha256::digest(query_key.filter(|k| !k.is_empty()).unwrap_or(query))
+}
+
+fn list_condition(filter: &ListFilter) -> Condition {
+    let mut cond = Condition::all();
+    if !filter.sources.is_empty() {
+        cond = cond.add(Column::Source.is_in(filter.sources.iter().cloned()));
+    }
+    if let Some(status) = &filter.status {
+        cond = cond.add(Column::Status.eq(status.as_str()));
+    }
+    if let Some(stream) = filter.stream.as_deref().filter(|s| !s.is_empty()) {
+        let pattern = format!("%,{},%", escape_like(stream));
+        cond = cond.add(Expr::col(Column::Streams).like(LikeExpr::new(pattern).escape('\\')));
+    }
+    if let Some(q) = filter.q.as_deref().filter(|q| !q.is_empty()) {
+        cond = cond.add(
+            Condition::any()
+                .add(contains_lowered(Column::Query, q))
+                .add(contains_lowered(Column::Streams, q)),
+        );
+    }
+    if let Some(starred) = filter.starred {
+        cond = cond.add(Column::Starred.eq(starred));
+    }
+    if let Some(from) = filter.ran_from {
+        cond = cond.add(Column::UpdatedAt.gte(from));
+    }
+    if let Some(to) = filter.ran_to {
+        cond = cond.add(Column::UpdatedAt.lte(to));
+    }
+    cond
+}
+
+/// Newest first; the id breaks ties so pages never overlap.
+fn list_query(org_id: &str, user_email: &str, filter: &ListFilter) -> sea_orm::Select<Entity> {
+    Entity::find()
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::UserEmail.eq(user_email))
+        .filter(list_condition(filter))
+        .order_by_desc(Column::UpdatedAt)
+        .order_by_desc(Column::Id)
+}
+
+/// Keeps `kept_id` and the newest other unstarred rows of `source`, up to the per-source cap.
+async fn prune_unstarred_over_cap<C: ConnectionTrait>(
+    conn: &C,
+    org_id: &str,
+    user_email: &str,
+    source: &str,
+    kept_id: &str,
+) -> Result<(), errors::Error> {
+    // The run just recorded survives a timestamp tie or a clock that stepped back.
+    let unstarred = Condition::all()
+        .add(Column::OrgId.eq(org_id))
+        .add(Column::UserEmail.eq(user_email))
+        .add(Column::Source.eq(source))
+        .add(Column::Starred.eq(false))
+        .add(Column::Id.ne(kept_id));
+    let Some((ran_at, id)) = Entity::find()
+        .filter(unstarred.clone())
+        .select_only()
+        .column(Column::UpdatedAt)
+        .column(Column::Id)
+        .order_by_desc(Column::UpdatedAt)
+        .order_by_desc(Column::Id)
+        .offset(MAX_UNSTARRED_PER_SOURCE - 1)
+        .into_tuple::<(i64, String)>()
+        .one(conn)
+        .await?
+    else {
+        return Ok(());
+    };
+    let at_or_before_boundary = Condition::any().add(Column::UpdatedAt.lt(ran_at)).add(
+        Condition::all()
+            .add(Column::UpdatedAt.eq(ran_at))
+            .add(Column::Id.lte(id)),
+    );
+    Entity::delete_many()
+        .filter(unstarred)
+        .filter(at_or_before_boundary)
+        .exec(conn)
+        .await?;
+    Ok(())
+}
+
+/// Serializes one user's stars in an org, so the starred count below cannot go stale.
+fn star_lock(backend: DbBackend, org_id: &str, user_email: &str) -> Option<Statement> {
+    match backend {
+        DbBackend::Postgres => Some(Statement::from_sql_and_values(
+            backend,
+            "SELECT pg_advisory_xact_lock(hashtextextended($1, 0))",
+            [format!("query_history_star/{org_id}/{user_email}").into()],
+        )),
+        // MySQL has no transaction-scoped named lock, so it row-locks the user's rows instead.
+        DbBackend::MySql => Some(Statement::from_sql_and_values(
+            backend,
+            "SELECT COUNT(*) FROM query_history WHERE org_id = ? AND user_email = ? FOR UPDATE",
+            [org_id.into(), user_email.into()],
+        )),
+        // SQLite serializes every write transaction already.
+        DbBackend::Sqlite => None,
+    }
+}
+
+/// Case-insensitive literal substring match: `%`, `_` and `\` match only themselves.
+fn contains_lowered(column: Column, q: &str) -> SimpleExpr {
+    let pattern = format!("%{}%", escape_like(&q.to_lowercase()));
+    Expr::expr(Func::lower(Expr::col(column))).like(LikeExpr::new(pattern).escape('\\'))
+}
+
+fn escape_like(text: &str) -> String {
+    let mut escaped = String::with_capacity(text.len());
+    for c in text.chars() {
+        if matches!(c, '\\' | '%' | '_') {
+            escaped.push('\\');
+        }
+        escaped.push(c);
+    }
+    escaped
+}
+
 #[cfg(test)]
 mod tests {
-    use sea_orm::{Database, DatabaseConnection, PaginatorTrait, Schema};
+    use sea_orm::{Database, DatabaseConnection, PaginatorTrait};
     use serde_json::json;
 
     use super::*;
 
     const A: &str = "a@x.com";
     const B: &str = "b@x.com";
+    const DAY_US: i64 = 86_400 * 1_000_000;
 
     async fn db() -> DatabaseConnection {
         let db = Database::connect("sqlite::memory:").await.unwrap();
-        let backend = db.get_database_backend();
-        let stmt = Schema::new(backend).create_table_from_entity(Entity);
-        db.execute(backend.build(&stmt)).await.unwrap();
+        create_table_for_tests(&db).await.unwrap();
         db
     }
 
+    fn run<'a>(user: &'a str, source: &'a str, query: &'a str, now_us: i64) -> NewRun<'a> {
+        NewRun {
+            org_id: "default",
+            user_email: user,
+            source,
+            query,
+            query_key: None,
+            streams: &[],
+            status: STATUS_OK,
+            context: json!({}),
+            now_us,
+        }
+    }
+
+    async fn rec(db: &DatabaseConnection, run: NewRun<'_>) -> Model {
+        record_with(db, run).await.unwrap()
+    }
+
     fn updated(outcome: SetStarred) -> Model {
         match outcome {
-            SetStarred::Updated(m) => m,
+            SetStarred::Updated(m) => *m,
             _ => panic!("expected the entry to be updated"),
         }
     }
 
-    async fn all(db: &DatabaseConnection, user: &str) -> Vec<Model> {
-        list_with(db, "default", user, None, None, 10_000, 0)
+    async fn listed(db: &DatabaseConnection, user: &str, filter: ListFilter) -> Vec<Model> {
+        list_with(db, "default", user, &filter, 10_000, 0)
             .await
             .unwrap()
     }
 
+    async fn all(db: &DatabaseConnection, user: &str) -> Vec<Model> {
+        listed(db, user, ListFilter::default()).await
+    }
+
+    fn queries(rows: Vec<Model>) -> Vec<String> {
+        rows.into_iter().map(|r| r.query).collect()
+    }
+
     #[tokio::test]
-    async fn test_same_query_as_latest_updates_time_and_context() {
+    async fn test_same_key_merges_and_keeps_first_run_and_star() {
         let db = db().await;
-        let first = record_with(&db, "default", A, "up", json!({"chart": "line"}), 1)
-            .await
-            .unwrap();
-        let again = record_with(&db, "default", A, "up", json!({"chart": "bar"}), 2)
+        let streams = vec!["k8s".to_string()];
+        let first = rec(
+            &db,
+            NewRun {
+                query_key: Some("k8s|sql|up|"),
+                streams: &streams,
+                context: json!({"chart": "line"}),
+                ..run(A, "logs", "up", 1)
+            },
+        )
+        .await;
+        assert_eq!(
+            (first.run_count, first.created_at, first.updated_at),
+            (1, 1, 1)
+        );
+        set_starred_with(&db, "default", A, &first.id, true)
             .await
             .unwrap();
+
+        let again = rec(
+            &db,
+            NewRun {
+                query_key: Some("k8s|sql|up|"),
+                status: STATUS_ERROR,
+                context: json!({"error": "boom"}),
+                ..run(A, "logs", "up", 5)
+            },
+        )
+        .await;
         assert_eq!(again.id, first.id);
-        let rows = all(&db, A).await;
-        assert_eq!(rows.len(), 1);
-        assert_eq!(rows[0].created_at, 2);
-        assert_eq!(rows[0].context, json!({"chart": "bar"}));
-
-        record_with(&db, "default", A, "rate(x[5m])", json!({}), 3)
-            .await
-            .unwrap();
-        record_with(&db, "default", A, "up", json!({}), 4)
-            .await
-            .unwrap();
-        assert_eq!(all(&db, A).await.len(), 3, "only the latest entry dedupes");
-    }
-
-    #[tokio::test]
-    async fn test_dedupe_is_per_user() {
-        let db = db().await;
-        record_with(&db, "default", A, "up", json!({}), 1)
-            .await
-            .unwrap();
-        record_with(&db, "default", B, "up", json!({}), 2)
-            .await
-            .unwrap();
+        assert_eq!(
+            (again.run_count, again.created_at, again.updated_at),
+            (2, 1, 5)
+        );
+        assert!(again.starred, "a merge keeps the star");
+        assert_eq!(again.status, STATUS_ERROR);
+        assert_eq!(again.context, json!({"error": "boom"}));
+        assert_eq!(again.streams, ",k8s,", "the key already holds the streams");
         assert_eq!(all(&db, A).await.len(), 1);
-        assert_eq!(all(&db, B).await.len(), 1);
     }
 
     #[tokio::test]
-    async fn test_cap_prunes_oldest_unstarred_and_keeps_starred() {
+    async fn test_the_same_search_on_two_days_is_one_row() {
         let db = db().await;
-        let starred = record_with(&db, "default", A, "starred", json!({}), 0)
-            .await
-            .unwrap();
+        let key = Some("k8s|sql|up|");
+        let monday = rec(
+            &db,
+            NewRun {
+                query_key: key,
+                ..run(A, "logs", "up", DAY_US)
+            },
+        )
+        .await;
+        let later = rec(
+            &db,
+            NewRun {
+                query_key: key,
+                ..run(A, "logs", "up", 40 * DAY_US)
+            },
+        )
+        .await;
+        assert_eq!(later.id, monday.id);
+        assert_eq!(
+            (later.run_count, later.created_at, later.updated_at),
+            (2, DAY_US, 40 * DAY_US)
+        );
+        assert_eq!(all(&db, A).await.len(), 1);
+    }
+
+    #[tokio::test]
+    async fn test_a_merge_sets_only_run_count_updated_at_context_and_status() {
+        let db = db().await;
+        let k8s = vec!["k8s".to_string()];
+        let other = vec!["other".to_string()];
+        let first = rec(
+            &db,
+            NewRun {
+                query_key: Some("k8s|sql|q|"),
+                streams: &k8s,
+                ..run(A, "logs", "SELECT 1", 1)
+            },
+        )
+        .await;
+        let merged = rec(
+            &db,
+            NewRun {
+                query_key: Some("k8s|sql|q|"),
+                streams: &other,
+                status: STATUS_ERROR,
+                context: json!({"error": "boom"}),
+                ..run(A, "logs", "SELECT 1 -- edited", 2)
+            },
+        )
+        .await;
+        assert_eq!(merged.id, first.id);
+        assert_eq!(
+            (merged.run_count, merged.created_at, merged.updated_at),
+            (2, 1, 2)
+        );
+        assert_eq!(
+            (merged.status.as_str(), &merged.context),
+            (STATUS_ERROR, &json!({"error": "boom"}))
+        );
+        assert_eq!(
+            (merged.query.as_str(), merged.streams.as_str()),
+            ("SELECT 1", ",k8s,"),
+            "query and streams stay as inserted"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_a_merge_on_a_later_day_leaves_every_other_column_as_first_inserted() {
+        let db = db().await;
+        let k8s = vec!["k8s".to_string()];
+        let first = rec(
+            &db,
+            NewRun {
+                query_key: Some("k8s|sql|q|"),
+                streams: &k8s,
+                context: json!({"run": 1}),
+                ..run(A, "logs", "q", DAY_US)
+            },
+        )
+        .await;
+        let starred = updated(
+            set_starred_with(&db, "default", A, &first.id, true)
+                .await
+                .unwrap(),
+        );
+        let merged = rec(
+            &db,
+            NewRun {
+                query_key: Some("k8s|sql|q|"),
+                streams: &[],
+                status: STATUS_ERROR,
+                context: json!({"run": 2}),
+                ..run(A, "logs", "q edited", 3 * DAY_US)
+            },
+        )
+        .await;
+        assert_eq!(
+            merged,
+            Model {
+                run_count: 2,
+                updated_at: 3 * DAY_US,
+                context: json!({"run": 2}),
+                status: STATUS_ERROR.to_string(),
+                ..starred
+            }
+        );
+        assert_eq!(all(&db, A).await, vec![merged]);
+    }
+
+    #[tokio::test]
+    async fn test_merge_is_per_user_per_source_and_per_key() {
+        let db = db().await;
+        rec(&db, run(A, "logs", "up", 1)).await;
+        rec(&db, run(B, "logs", "up", 2)).await;
+        rec(&db, run(A, "traces", "up", 3)).await;
+        rec(
+            &db,
+            NewRun {
+                query_key: Some("up|2026-10-28"),
+                ..run(A, "logs", "up", 4)
+            },
+        )
+        .await;
+        assert_eq!(all(&db, A).await.len(), 3);
+        assert_eq!(all(&db, B).await.len(), 1);
+        let merged = rec(&db, run(A, "logs", "up", 5)).await;
+        assert_eq!(merged.run_count, 2, "no key falls back to the query text");
+    }
+
+    #[tokio::test]
+    async fn test_new_key_prunes_over_the_per_source_cap_and_keeps_starred() {
+        let db = db().await;
+        let starred = rec(&db, run(A, "logs", "starred", 0)).await;
         set_starred_with(&db, "default", A, &starred.id, true)
             .await
             .unwrap();
-        for i in 1..=MAX_UNSTARRED_PER_USER as i64 {
-            record_with(&db, "default", A, &format!("q{i}"), json!({}), i)
-                .await
-                .unwrap();
+        for i in 1..=MAX_UNSTARRED_PER_SOURCE as i64 {
+            rec(&db, run(A, "logs", &format!("q{i}"), i)).await;
         }
-        record_with(&db, "default", B, "other user", json!({}), 1)
-            .await
-            .unwrap();
-        assert_eq!(all(&db, A).await.len(), 1001);
+        rec(&db, run(A, "traces", "other source", 0)).await;
+        rec(&db, run(B, "logs", "other user", 0)).await;
+        let logs = |rows: Vec<Model>| rows.into_iter().filter(|r| r.source == "logs").count();
+        assert_eq!(logs(all(&db, A).await), 501);
 
-        record_with(&db, "default", A, "q1001", json!({}), 1001)
-            .await
-            .unwrap();
+        rec(&db, run(A, "logs", "q1", 1_000)).await;
+        assert_eq!(logs(all(&db, A).await), 501, "a merge never prunes");
+
+        rec(&db, run(A, "logs", "q501", 1_001)).await;
         let rows = all(&db, A).await;
-        assert_eq!(rows.len(), 1001);
-        assert!(rows.iter().all(|r| r.query != "q1"), "oldest is pruned");
-        assert!(rows.iter().any(|r| r.query == "q2"));
+        assert_eq!(logs(rows.clone()), 501);
+        assert!(rows.iter().all(|r| r.query != "q2"), "oldest is pruned");
+        assert!(
+            rows.iter().any(|r| r.query == "q1"),
+            "the merge refreshed q1"
+        );
         assert!(rows.iter().any(|r| r.id == starred.id && r.starred));
+        assert!(rows.iter().any(|r| r.source == "traces"));
         assert_eq!(all(&db, B).await.len(), 1);
     }
 
     #[tokio::test]
     async fn test_cap_holds_when_timestamps_tie() {
         let db = db().await;
-        for i in 0..=MAX_UNSTARRED_PER_USER {
-            record_with(&db, "default", A, &format!("q{i}"), json!({}), 7)
-                .await
-                .unwrap();
+        for i in 0..=MAX_UNSTARRED_PER_SOURCE {
+            rec(&db, run(A, "logs", &format!("q{i}"), 7)).await;
         }
-        assert_eq!(all(&db, A).await.len() as u64, MAX_UNSTARRED_PER_USER);
+        assert_eq!(all(&db, A).await.len() as u64, MAX_UNSTARRED_PER_SOURCE);
     }
 
     #[tokio::test]
-    async fn test_list_filters_newest_first() {
+    async fn test_reaper_uses_updated_at_and_keeps_starred() {
         let db = db().await;
-        let up = record_with(&db, "default", A, "up", json!({}), 1)
+        let now = 100 * DAY_US;
+        let cutoff = now - 14 * DAY_US;
+        let old = rec(&db, run(A, "logs", "old", now - 15 * DAY_US)).await;
+        let old_starred = rec(&db, run(A, "logs", "old starred", now - 15 * DAY_US)).await;
+        set_starred_with(&db, "default", A, &old_starred.id, true)
             .await
             .unwrap();
-        record_with(&db, "default", A, "rate(http_total[5m])", json!({}), 2)
-            .await
-            .unwrap();
-        record_with(&db, "default", A, "sum(http_total)", json!({}), 3)
-            .await
-            .unwrap();
-        record_with(&db, "other", A, "http_total", json!({}), 4)
+        let rerun = rec(&db, run(A, "logs", "rerun", now - 20 * DAY_US)).await;
+        rec(&db, run(A, "logs", "rerun", now)).await;
+
+        assert_eq!(delete_unstarred_before_with(&db, cutoff).await.unwrap(), 1);
+        let ids: Vec<String> = all(&db, A).await.into_iter().map(|r| r.id).collect();
+        assert!(!ids.contains(&old.id));
+        assert!(ids.contains(&old_starred.id));
+        assert!(ids.contains(&rerun.id), "a recent run keeps an old row");
+    }
+
+    async fn row_at(db: &DatabaseConnection, id: &str, created_at: i64, updated_at: i64) {
+        db.execute_unprepared(&format!(
+            "INSERT INTO query_history (id, org_id, user_email, query, context, created_at, \
+             updated_at, source) VALUES ('{id}', 'default', '{A}', 'q {id}', '{{}}', {created_at}, \
+             {updated_at}, 'logs')"
+        ))
+        .await
+        .unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_the_reaper_needs_both_runs_before_the_cutoff() {
+        let db = db().await;
+        row_at(&db, "stale", 50, 60).await;
+        row_at(&db, "fresh", 50, 500).await;
+        row_at(&db, "old-node", 500, 0).await;
+        assert_eq!(delete_unstarred_before_with(&db, 100).await.unwrap(), 1);
+        let mut ids: Vec<String> = all(&db, A).await.into_iter().map(|r| r.id).collect();
+        ids.sort();
+        assert_eq!(ids, vec!["fresh", "old-node"]);
+    }
+
+    #[tokio::test]
+    async fn test_order_window_and_prune_read_updated_at_alone() {
+        let db = db().await;
+        for i in 1..=MAX_UNSTARRED_PER_SOURCE as i64 {
+            row_at(&db, &format!("r{i:04}"), 1_000_000 - i, i * 10).await;
+        }
+        let rows = all(&db, A).await;
+        assert_eq!(
+            rows.iter()
+                .take(2)
+                .map(|r| r.id.as_str())
+                .collect::<Vec<_>>(),
+            vec!["r0500", "r0499"],
+            "newest updated_at first, whatever created_at says"
+        );
+        let window = ListFilter {
+            ran_from: Some(4_980),
+            ran_to: Some(4_990),
+            ..Default::default()
+        };
+        assert_eq!(
+            listed(&db, A, window)
+                .await
+                .iter()
+                .map(|r| r.id.as_str())
+                .collect::<Vec<_>>(),
+            vec!["r0499", "r0498"]
+        );
+        rec(&db, run(A, "logs", "new", 1)).await;
+        let ids: Vec<String> = all(&db, A).await.into_iter().map(|r| r.id).collect();
+        assert_eq!(ids.len() as u64, MAX_UNSTARRED_PER_SOURCE);
+        assert!(
+            !ids.contains(&"r0001".to_string()),
+            "lowest updated_at is pruned"
+        );
+        assert!(ids.contains(&"r0002".to_string()));
+    }
+
+    #[tokio::test]
+    async fn test_count_matches_the_list_filters() {
+        let db = db().await;
+        let starred = rec(&db, run(A, "logs", "a", 1)).await;
+        set_starred_with(&db, "default", A, &starred.id, true)
             .await
             .unwrap();
+        rec(&db, run(A, "logs", "b", 2)).await;
+        rec(&db, run(A, "traces", "c", 3)).await;
+        rec(&db, run(B, "logs", "d", 4)).await;
+        let count = |sources: &[&str], starred: Option<bool>| ListFilter {
+            sources: sources.iter().map(|s| s.to_string()).collect(),
+            starred,
+            ..Default::default()
+        };
+        assert_eq!(
+            count_with(&db, "default", A, &count(&[], None))
+                .await
+                .unwrap(),
+            3
+        );
+        assert_eq!(
+            count_with(&db, "default", A, &count(&["logs"], None))
+                .await
+                .unwrap(),
+            2
+        );
+        assert_eq!(
+            count_with(&db, "default", A, &count(&["logs"], Some(false)))
+                .await
+                .unwrap(),
+            1
+        );
+        assert_eq!(
+            count_with(&db, "default", A, &count(&[], Some(true)))
+                .await
+                .unwrap(),
+            1
+        );
+    }
+
+    #[tokio::test]
+    async fn test_a_new_row_survives_the_cap_when_others_ran_later() {
+        let db = db().await;
+        for i in 0..MAX_UNSTARRED_PER_SOURCE as i64 {
+            rec(&db, run(A, "logs", &format!("q{i}"), 1_000 + i)).await;
+        }
+        // The clock stepped back, or every row ties: the new run must still be kept.
+        let new = rec(&db, run(A, "logs", "after the step back", 5)).await;
+        let rows = all(&db, A).await;
+        assert_eq!(rows.len() as u64, MAX_UNSTARRED_PER_SOURCE);
+        assert!(rows.iter().any(|r| r.id == new.id));
+        assert!(
+            rows.iter().all(|r| r.query != "q0"),
+            "the oldest other row is pruned"
+        );
+
+        let tie = rec(&db, run(A, "logs", "tie", 1_001)).await;
+        let rows = all(&db, A).await;
+        assert_eq!(rows.len() as u64, MAX_UNSTARRED_PER_SOURCE);
+        assert!(rows.iter().any(|r| r.id == tie.id));
+    }
+
+    #[tokio::test]
+    async fn test_list_order_is_served_by_the_updated_at_indexes_on_sqlite() {
+        let db = db().await;
+        for i in 0..20 {
+            rec(&db, run(A, "logs", &format!("q{i}"), i)).await;
+        }
+        let filters = [
+            ListFilter::default(),
+            ListFilter {
+                sources: vec!["logs".to_string()],
+                ..Default::default()
+            },
+        ];
+        for filter in filters {
+            let sql = list_query("default", A, &filter)
+                .limit(50)
+                .build(sea_orm::DbBackend::Sqlite)
+                .to_string();
+            let plan: Vec<String> = db
+                .query_all(sea_orm::Statement::from_string(
+                    sea_orm::DbBackend::Sqlite,
+                    format!("EXPLAIN QUERY PLAN {sql}"),
+                ))
+                .await
+                .unwrap()
+                .iter()
+                .map(|r| r.try_get::<String>("", "detail").unwrap())
+                .collect();
+            let plan = plan.join(" | ");
+            assert!(plan.contains("updated_at_idx"), "{plan}");
+            assert!(!plan.contains("TEMP B-TREE FOR ORDER BY"), "{plan}");
+        }
+    }
+
+    #[tokio::test]
+    async fn test_concurrent_new_rows_keep_the_per_source_cap() {
+        let db = db().await;
+        for i in 0..MAX_UNSTARRED_PER_SOURCE as i64 {
+            rec(&db, run(A, "logs", &format!("q{i}"), i)).await;
+        }
+        let queries: Vec<String> = (0..8).map(|i| format!("new{i}")).collect();
+        let results = futures::future::join_all(
+            queries
+                .iter()
+                .enumerate()
+                .map(|(i, q)| record_with(&db, run(A, "logs", q, 10_000 + i as i64))),
+        )
+        .await;
+        assert!(results.iter().all(Result::is_ok));
+        assert_eq!(all(&db, A).await.len() as u64, MAX_UNSTARRED_PER_SOURCE);
+    }
+
+    #[tokio::test]
+    async fn test_list_orders_by_last_run_and_filters() {
+        let db = db().await;
+        let k8s = vec!["k8s_logs".to_string(), "default".to_string()];
+        let app = vec!["app_logs".to_string()];
+        let up = rec(
+            &db,
+            NewRun {
+                streams: &k8s,
+                ..run(A, "logs", "level = 'error'", 1)
+            },
+        )
+        .await;
+        rec(
+            &db,
+            NewRun {
+                streams: &app,
+                status: STATUS_ERROR,
+                ..run(A, "logs", "SELECT * FROM app", 2)
+            },
+        )
+        .await;
+        rec(&db, run(A, "traces", "service = 'cart'", 3)).await;
+        rec(&db, run(A, "metrics", "rate(http_total[5m])", 4)).await;
+        rec(&db, run(A, "logs", "level = 'error'", 5)).await;
         set_starred_with(&db, "default", A, &up.id, true)
             .await
             .unwrap();
 
-        let queries = |rows: Vec<Model>| rows.into_iter().map(|r| r.query).collect::<Vec<_>>();
+        let f = |build: fn(&mut ListFilter)| {
+            let mut filter = ListFilter::default();
+            build(&mut filter);
+            filter
+        };
         assert_eq!(
             queries(all(&db, A).await),
-            vec!["sum(http_total)", "rate(http_total[5m])", "up"]
+            vec![
+                "level = 'error'",
+                "rate(http_total[5m])",
+                "service = 'cart'",
+                "SELECT * FROM app"
+            ]
         );
-        let starred = list_with(&db, "default", A, Some(true), None, 50, 0)
-            .await
-            .unwrap();
-        assert_eq!(queries(starred), vec!["up"]);
-        let matched = list_with(&db, "default", A, None, Some("http_total"), 50, 0)
-            .await
-            .unwrap();
+        let by_source = f(|f| f.sources = vec!["logs".into(), "traces".into()]);
+        assert_eq!(queries(listed(&db, A, by_source).await).len(), 3);
+        let failed = f(|f| f.status = Some(STATUS_ERROR.into()));
         assert_eq!(
-            queries(matched),
-            vec!["sum(http_total)", "rate(http_total[5m])"]
+            queries(listed(&db, A, failed).await),
+            vec!["SELECT * FROM app"]
         );
-        let page = list_with(&db, "default", A, None, None, 1, 1)
+        let stream = f(|f| f.stream = Some("default".into()));
+        assert_eq!(
+            queries(listed(&db, A, stream).await),
+            vec!["level = 'error'"],
+            "a merge keeps the streams"
+        );
+        let stream = f(|f| f.stream = Some("app_logs".into()));
+        assert_eq!(
+            queries(listed(&db, A, stream).await),
+            vec!["SELECT * FROM app"]
+        );
+        let partial = f(|f| f.stream = Some("app".into()));
+        assert!(listed(&db, A, partial).await.is_empty(), "stream is exact");
+        let q_stream = f(|f| f.q = Some("APP_LO".into()));
+        assert_eq!(
+            queries(listed(&db, A, q_stream).await),
+            vec!["SELECT * FROM app"]
+        );
+        let q_query = f(|f| f.q = Some("HTTP".into()));
+        assert_eq!(
+            queries(listed(&db, A, q_query).await),
+            vec!["rate(http_total[5m])"]
+        );
+        let starred = f(|f| f.starred = Some(true));
+        assert_eq!(
+            queries(listed(&db, A, starred).await),
+            vec!["level = 'error'"]
+        );
+        let window = f(|f| {
+            f.ran_from = Some(2);
+            f.ran_to = Some(3);
+        });
+        assert_eq!(
+            queries(listed(&db, A, window).await),
+            vec!["service = 'cart'", "SELECT * FROM app"]
+        );
+        let page = list_with(&db, "default", A, &ListFilter::default(), 1, 1)
             .await
             .unwrap();
         assert_eq!(queries(page), vec!["rate(http_total[5m])"]);
@@ -509,19 +1079,16 @@ mod tests {
         .into_iter()
         .enumerate()
         {
-            record_with(&db, "default", A, query, json!({}), i as i64)
-                .await
-                .unwrap();
+            rec(&db, run(A, "metrics", query, i as i64)).await;
         }
         let search = |q: &'static str| {
             let db = &db;
             async move {
-                let mut rows: Vec<String> = list_with(db, "default", A, None, Some(q), 50, 0)
-                    .await
-                    .unwrap()
-                    .into_iter()
-                    .map(|r| r.query)
-                    .collect();
+                let filter = ListFilter {
+                    q: Some(q.to_string()),
+                    ..Default::default()
+                };
+                let mut rows = queries(listed(db, A, filter).await);
                 rows.sort();
                 rows
             }
@@ -535,9 +1102,9 @@ mod tests {
     // Postgres LIKE is case-sensitive, so the filter must lower both sides.
     #[test]
     fn test_search_sql_lowers_and_escapes_on_postgres() {
-        use sea_orm::{DbBackend, QueryTrait};
+        use sea_orm::DbBackend;
         let sql = Entity::find()
-            .filter(query_matches("50%_X"))
+            .filter(contains_lowered(Column::Query, "50%_X"))
             .build(DbBackend::Postgres)
             .to_string();
         assert!(
@@ -546,12 +1113,95 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_star_lock_is_narrow_on_each_backend() {
+        let pg = star_lock(DbBackend::Postgres, "default", A)
+            .unwrap()
+            .to_string();
+        assert!(pg.contains("pg_advisory_xact_lock"), "{pg}");
+        assert!(
+            !pg.contains("FOR UPDATE"),
+            "no rows are locked or read: {pg}"
+        );
+        let mysql = star_lock(DbBackend::MySql, "default", A)
+            .unwrap()
+            .to_string();
+        assert!(
+            mysql.starts_with("SELECT COUNT(*)") && mysql.ends_with("FOR UPDATE"),
+            "{mysql}"
+        );
+        assert!(star_lock(DbBackend::Sqlite, "default", A).is_none());
+    }
+
+    #[test]
+    fn test_upsert_sql_targets_the_unique_key_on_postgres() {
+        use sea_orm::DbBackend;
+        let sql = Entity::insert(ActiveModel {
+            id: Set("x".into()),
+            ..Default::default()
+        })
+        .on_conflict(
+            OnConflict::columns([Column::OrgId, Column::QueryKey])
+                .value(
+                    Column::RunCount,
+                    Expr::col((Entity, Column::RunCount)).add(1),
+                )
+                .to_owned(),
+        )
+        .build(DbBackend::Postgres)
+        .to_string();
+        assert!(
+            sql.contains(r#""run_count" = "query_history"."run_count" + 1"#),
+            "{sql}"
+        );
+    }
+
+    #[test]
+    fn test_streams_round_trip_through_the_comma_wrapped_form() {
+        let streams = vec!["a".to_string(), "b".to_string()];
+        assert_eq!(encode_streams(&streams), ",a,b,");
+        assert_eq!(decode_streams(",a,b,"), streams);
+        assert_eq!(encode_streams(&[]), "");
+        assert!(decode_streams("").is_empty());
+    }
+
+    #[test]
+    fn test_query_key_is_a_sha256_of_the_key_or_the_query() {
+        assert_eq!(query_key_hash(Some("k"), "q"), sha256::digest("k"));
+        assert_eq!(query_key_hash(None, "q"), sha256::digest("q"));
+        assert_eq!(query_key_hash(Some(""), "q"), sha256::digest("q"));
+        assert_eq!(query_key_hash(None, "q").len(), 64);
+    }
+
+    #[tokio::test]
+    async fn test_clear_scopes_by_source_and_keeps_starred_unless_asked() {
+        let db = db().await;
+        let star = rec(&db, run(A, "logs", "starred", 1)).await;
+        set_starred_with(&db, "default", A, &star.id, true)
+            .await
+            .unwrap();
+        rec(&db, run(A, "logs", "a", 2)).await;
+        rec(&db, run(A, "traces", "b", 3)).await;
+        rec(&db, run(A, "metrics", "c", 4)).await;
+        rec(&db, run(B, "logs", "a", 5)).await;
+
+        let logs = vec!["logs".to_string()];
+        assert_eq!(
+            clear_with(&db, "default", A, &logs, false).await.unwrap(),
+            1
+        );
+        assert_eq!(queries(all(&db, A).await), vec!["c", "b", "starred"]);
+        assert_eq!(clear_with(&db, "default", A, &[], false).await.unwrap(), 2);
+        assert_eq!(queries(all(&db, A).await), vec!["starred"]);
+        assert_eq!(clear_with(&db, "default", A, &[], true).await.unwrap(), 1);
+        assert!(all(&db, A).await.is_empty());
+        assert_eq!(all(&db, B).await.len(), 1, "only the caller's rows");
+    }
+
     #[tokio::test]
     async fn test_by_id_operations_are_scoped_to_org_and_user() {
         let db = db().await;
-        let entry = record_with(&db, "default", A, "up", json!({}), 1)
-            .await
-            .unwrap();
+        let entry = rec(&db, run(A, "metrics", "up", 1)).await;
 
         assert!(matches!(
             set_starred_with(&db, "default", B, &entry.id, true)
@@ -583,9 +1233,7 @@ mod tests {
     #[tokio::test]
     async fn test_starring_twice_still_returns_the_entry() {
         let db = db().await;
-        let entry = record_with(&db, "default", A, "up", json!({}), 1)
-            .await
-            .unwrap();
+        let entry = rec(&db, run(A, "metrics", "up", 1)).await;
         for _ in 0..2 {
             let starred = updated(
                 set_starred_with(&db, "default", A, &entry.id, true)
@@ -609,13 +1257,12 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_starring_past_the_cap_is_refused_per_user() {
+    async fn test_starring_past_the_cap_is_refused_across_sources() {
         let db = db().await;
         let mut ids = Vec::new();
         for i in 0..=MAX_STARRED_PER_USER as i64 {
-            let entry = record_with(&db, "default", A, &format!("q{i}"), json!({}), i)
-                .await
-                .unwrap();
+            let source = SOURCES[i as usize % 3];
+            let entry = rec(&db, run(A, source, &format!("q{i}"), i)).await;
             assert!(!entry.starred, "recording never stars");
             ids.push(entry.id);
         }
@@ -638,22 +1285,12 @@ mod tests {
             .starred,
             "re-starring an already starred entry at the cap still succeeds"
         );
-        let other_user = record_with(&db, "default", B, "up", json!({}), 1)
-            .await
-            .unwrap();
+        let other_user = rec(&db, run(B, "logs", "up", 1)).await;
         updated(
             set_starred_with(&db, "default", B, &other_user.id, true)
                 .await
                 .unwrap(),
         );
-        let other_org = record_with(&db, "other", A, "up", json!({}), 1)
-            .await
-            .unwrap();
-        updated(
-            set_starred_with(&db, "other", A, &other_org.id, true)
-                .await
-                .unwrap(),
-        );
 
         updated(
             set_starred_with(&db, "default", A, &at_cap[0], false)
@@ -672,68 +1309,167 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_dedupe_keeps_the_starred_flag() {
+    async fn test_concurrent_stars_never_pass_the_cap() {
         let db = db().await;
-        let entry = record_with(&db, "default", A, "up", json!({}), 1)
+        let mut ids = Vec::new();
+        for i in 0..MAX_STARRED_PER_USER as i64 + 5 {
+            ids.push(rec(&db, run(A, "logs", &format!("q{i}"), i)).await.id);
+        }
+        let (racing, below_cap) = ids.split_at(6);
+        for id in &below_cap[..MAX_STARRED_PER_USER as usize - 1] {
+            updated(set_starred_with(&db, "default", A, id, true).await.unwrap());
+        }
+        let outcomes = futures::future::join_all(
+            racing
+                .iter()
+                .map(|id| set_starred_with(&db, "default", A, id, true)),
+        )
+        .await;
+        let starred_now = outcomes
+            .into_iter()
+            .filter(|o| matches!(o, Ok(SetStarred::Updated(_))))
+            .count();
+        assert_eq!(starred_now, 1);
+        let starred = Entity::find()
+            .filter(Column::Starred.eq(true))
+            .count(&db)
             .await
             .unwrap();
-        updated(
-            set_starred_with(&db, "default", A, &entry.id, true)
-                .await
-                .unwrap(),
-        );
-        let again = record_with(&db, "default", A, "up", json!({"chart": "bar"}), 2)
-            .await
-            .unwrap();
-        assert_eq!(again.id, entry.id);
-        assert!(again.starred);
-        assert_eq!(again.org_id, "default");
-        assert_eq!(again.user_email, A);
-        assert_eq!(again.query, "up");
+        assert_eq!(starred, MAX_STARRED_PER_USER);
     }
 
     #[tokio::test]
-    async fn test_retention_deletes_only_old_unstarred_rows() {
+    async fn test_concurrent_first_stars_from_zero_stop_at_the_cap() {
         let db = db().await;
-        let day_us = 86_400 * 1_000_000;
-        let now = 100 * day_us;
-        let old = record_with(&db, "default", A, "old", json!({}), now - 15 * day_us)
-            .await
-            .unwrap();
-        let old_starred = record_with(
-            &db,
-            "default",
-            A,
-            "old starred",
-            json!({}),
-            now - 15 * day_us,
+        let mut ids = Vec::new();
+        for i in 0..MAX_STARRED_PER_USER as i64 + 10 {
+            ids.push(rec(&db, run(A, "logs", &format!("q{i}"), i)).await.id);
+        }
+        let outcomes = futures::future::join_all(
+            ids.iter()
+                .map(|id| set_starred_with(&db, "default", A, id, true)),
         )
-        .await
-        .unwrap();
-        set_starred_with(&db, "default", A, &old_starred.id, true)
-            .await
-            .unwrap();
-        record_with(&db, "default", A, "fresh", json!({}), now)
+        .await;
+        let starred_now = outcomes
+            .iter()
+            .filter(|o| matches!(o, Ok(SetStarred::Updated(_))))
+            .count();
+        let refused = outcomes
+            .iter()
+            .filter(|o| matches!(o, Ok(SetStarred::StarredCapReached)))
+            .count();
+        assert_eq!((starred_now, refused), (MAX_STARRED_PER_USER as usize, 10));
+        let starred = Entity::find()
+            .filter(Column::Starred.eq(true))
+            .count(&db)
             .await
             .unwrap();
+        assert_eq!(starred, MAX_STARRED_PER_USER);
+    }
 
-        let deleted = delete_unstarred_before_with(&db, now - 14 * day_us)
+    /// One-connection pools on a throwaway CI Postgres schema, so calls truly race.
+    async fn postgres_pools(
+        n: usize,
+    ) -> Option<(DatabaseConnection, String, Vec<DatabaseConnection>)> {
+        let dsn = std::env::var("ZO_META_POSTGRES_DSN").ok()?;
+        // The SQLite lane sets the variable empty rather than unsetting it.
+        if dsn.trim().is_empty() {
+            return None;
+        }
+        let schema = format!("qh_test_{}", config::ider::generate().to_ascii_lowercase());
+        let admin = Database::connect(&dsn).await.unwrap();
+        admin
+            .execute_unprepared(&format!(r#"CREATE SCHEMA "{schema}""#))
             .await
             .unwrap();
-        assert_eq!(deleted, 1);
-        let ids: Vec<String> = all(&db, A).await.into_iter().map(|r| r.id).collect();
-        assert!(!ids.contains(&old.id));
-        assert!(ids.contains(&old_starred.id));
-        assert_eq!(ids.len(), 2);
+        let mut pools = Vec::new();
+        for _ in 0..n {
+            let mut options = sea_orm::ConnectOptions::new(dsn.clone());
+            options
+                .max_connections(1)
+                .min_connections(1)
+                .set_schema_search_path(schema.clone());
+            pools.push(Database::connect(options).await.unwrap());
+        }
+        create_table_for_tests(&pools[0]).await.unwrap();
+        Some((admin, schema, pools))
+    }
+
+    async fn drop_schema(admin: DatabaseConnection, schema: &str, pools: Vec<DatabaseConnection>) {
+        for pool in pools {
+            pool.close().await.unwrap();
+        }
+        admin
+            .execute_unprepared(&format!(r#"DROP SCHEMA "{schema}" CASCADE"#))
+            .await
+            .unwrap();
+    }
+
+    #[tokio::test]
+    async fn test_postgres_concurrent_first_stars_stop_at_the_cap_when_ci_provides_it() {
+        let Some((admin, schema, pools)) = postgres_pools(8).await else {
+            return;
+        };
+        let mut ids = Vec::new();
+        for i in 0..MAX_STARRED_PER_USER as i64 + 16 {
+            ids.push(rec(&pools[0], run(A, "logs", &format!("q{i}"), i)).await.id);
+        }
+        let outcomes = futures::future::join_all(
+            ids.iter()
+                .enumerate()
+                .map(|(i, id)| set_starred_with(&pools[i % pools.len()], "default", A, id, true)),
+        )
+        .await;
+        let starred_now = outcomes
+            .iter()
+            .filter(|o| matches!(o, Ok(SetStarred::Updated(_))))
+            .count();
+        assert_eq!(starred_now, MAX_STARRED_PER_USER as usize);
+        let starred = Entity::find()
+            .filter(Column::Starred.eq(true))
+            .count(&pools[0])
+            .await
+            .unwrap();
+        assert_eq!(starred, MAX_STARRED_PER_USER);
+        drop_schema(admin, &schema, pools).await;
+    }
+
+    #[tokio::test]
+    async fn test_postgres_concurrent_new_rows_keep_the_cap_when_ci_provides_it() {
+        let Some((admin, schema, pools)) = postgres_pools(8).await else {
+            return;
+        };
+        for i in 0..MAX_UNSTARRED_PER_SOURCE as i64 {
+            rec(&pools[0], run(A, "logs", &format!("q{i}"), i)).await;
+        }
+        let queries: Vec<String> = (0..16).map(|i| format!("new{i}")).collect();
+        let results = futures::future::join_all(queries.iter().enumerate().map(|(i, q)| {
+            record_with(
+                &pools[i % pools.len()],
+                run(A, "logs", q, 10_000 + i as i64),
+            )
+        }))
+        .await;
+        assert!(results.iter().all(Result::is_ok));
+        assert_eq!(
+            all(&pools[0], A).await.len() as u64,
+            MAX_UNSTARRED_PER_SOURCE
+        );
+        drop_schema(admin, &schema, pools).await;
     }
 
     #[tokio::test]
     async fn test_cleanup_by_org_user_and_email() {
         let db = db().await;
         for (org, user) in [("default", A), ("default", B), ("other", A), ("other", B)] {
-            record_with(&db, org, user, "up", json!({}), 1)
-                .await
-                .unwrap();
+            rec(
+                &db,
+                NewRun {
+                    org_id: org,
+                    ..run(user, "logs", "up", 1)
+                },
+            )
+            .await;
         }
         assert_eq!(delete_by_user_with(&db, "default", A).await.unwrap(), 1);
         assert!(all(&db, A).await.is_empty());
diff --git a/src/infra/src/table/slack.rs b/src/infra/src/table/slack.rs
index 6e2cd0e9e1..3fae8cb908 100644
--- a/src/infra/src/table/slack.rs
+++ b/src/infra/src/table/slack.rs
@@ -13,9 +13,9 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-use sea_orm::{ConnectionTrait, DbErr};
+use sea_orm::{DatabaseConnection, DbErr};
 
 /// Creates the Slack tables, `slack_alert_messages` included, without replaying the migrator.
-pub async fn create_tables_for_test<C: ConnectionTrait>(conn: &C) -> Result<(), DbErr> {
+pub async fn create_tables_for_test(conn: &DatabaseConnection) -> Result<(), DbErr> {
     super::migration::create_slack_tables(conn).await
 }
diff --git a/src/infra/src/table/status_pages.rs b/src/infra/src/table/status_pages.rs
index 23ef43bf0e..41dff4ebc6 100644
--- a/src/infra/src/table/status_pages.rs
+++ b/src/infra/src/table/status_pages.rs
@@ -31,21 +31,26 @@ use super::entity::{
     status_page_audit_log, status_page_check_snoozes, status_page_component_checks,
     status_page_components, status_page_custom_domains, status_page_notice_components,
     status_page_notice_updates, status_page_notices, status_page_snapshots, status_pages,
-    synthetics_checks,
+    synthetics_checks, synthetics_runs,
 };
 use crate::{
     db::{get_orm_client_ro, get_orm_client_rw},
     errors,
 };
 
-/// The three columns the auto-incident engine needs per mapped check —
+/// The columns the auto-incident engine needs per mapped check —
 /// deliberately not the whole row (config/secrets are KB each).
 #[derive(Clone, Debug)]
 pub struct CheckStateRow {
     pub id: String,
+    pub org_id: String,
     pub last_check_status: i32,
     pub consecutive_failures: i32,
     pub last_triggered_at: i64,
+    /// `completed_at` of the check's latest completed run, filled by
+    /// [`latest_run_completions`]; `None` until read or when no run completed
+    /// inside the lookback window.
+    pub last_completed_at: Option<i64>,
 }
 
 pub async fn get_page_by_slug<C: ConnectionTrait>(
@@ -117,6 +122,7 @@ pub async fn get_check_states<C: ConnectionTrait>(
     let mut q = synthetics_checks::Entity::find()
         .select_only()
         .column(synthetics_checks::Column::Id)
+        .column(synthetics_checks::Column::OrgId)
         .column(synthetics_checks::Column::LastCheckStatus)
         .column(synthetics_checks::Column::ConsecutiveFailures)
         .column(synthetics_checks::Column::LastTriggeredAt)
@@ -126,22 +132,31 @@ pub async fn get_check_states<C: ConnectionTrait>(
         q = q.filter(synthetics_checks::Column::UpdatedAt.gt(watermark));
     }
     let rows = q
-        .into_tuple::<(String, i32, i32, i64, i64)>()
+        .into_tuple::<(String, String, i32, i32, i64, i64)>()
         .all(conn)
         .await?;
     let mut max_updated = since.unwrap_or(0);
     let out = rows
         .into_iter()
         .map(
-            |(id, last_check_status, consecutive_failures, last_triggered_at, updated_at)| {
+            |(
+                id,
+                org_id,
+                last_check_status,
+                consecutive_failures,
+                last_triggered_at,
+                updated_at,
+            )| {
                 if updated_at > max_updated {
                     max_updated = updated_at;
                 }
                 CheckStateRow {
                     id,
+                    org_id,
                     last_check_status,
                     consecutive_failures,
                     last_triggered_at,
+                    last_completed_at: None,
                 }
             },
         )
@@ -149,6 +164,43 @@ pub async fn get_check_states<C: ConnectionTrait>(
     Ok((out, max_updated))
 }
 
+/// Latest `synthetics_runs.completed_at` per check, for runs scheduled at or
+/// after `scheduled_since`. Keys are check ids; checks with no completed run in
+/// the window are absent.
+///
+/// Region-local like the runs table itself: it sees the runs this region's
+/// scheduler enqueued, which is the region that holds the job-cluster claim and
+/// therefore runs the incident engine. The `org_id` + `synthetics_id` +
+/// `scheduled_ts` predicates match `synthetics_runs_monitor_idx`, so the read
+/// is an index range per mapped check, not a table scan.
+pub async fn latest_run_completions<C: ConnectionTrait>(
+    conn: &C,
+    checks: &[(String, String)],
+    scheduled_since: i64,
+) -> Result<std::collections::HashMap<String, i64>, errors::Error> {
+    if checks.is_empty() {
+        return Ok(Default::default());
+    }
+    let orgs: HashSet<&str> = checks.iter().map(|(o, _)| o.as_str()).collect();
+    let ids: HashSet<&str> = checks.iter().map(|(_, id)| id.as_str()).collect();
+    let rows = synthetics_runs::Entity::find()
+        .select_only()
+        .column(synthetics_runs::Column::SyntheticsId)
+        .column_as(synthetics_runs::Column::CompletedAt.max(), "completed_at")
+        .filter(synthetics_runs::Column::OrgId.is_in(orgs.into_iter().map(str::to_owned)))
+        .filter(synthetics_runs::Column::SyntheticsId.is_in(ids.into_iter().map(str::to_owned)))
+        .filter(synthetics_runs::Column::ScheduledTs.gte(scheduled_since))
+        .filter(synthetics_runs::Column::CompletedAt.is_not_null())
+        .group_by(synthetics_runs::Column::SyntheticsId)
+        .into_tuple::<(String, Option<i64>)>()
+        .all(conn)
+        .await?;
+    Ok(rows
+        .into_iter()
+        .filter_map(|(id, at)| at.map(|at| (id, at)))
+        .collect())
+}
+
 /// Notices the engine and snapshots need: not deleted, and open or resolved
 /// after `resolved_cutoff` (90d for history; the merge window rides within).
 pub async fn list_notices_since<C: ConnectionTrait>(
diff --git a/src/infra/src/table/synthetics_checks.rs b/src/infra/src/table/synthetics_checks.rs
index 29ea7415e0..fa153b4583 100644
--- a/src/infra/src/table/synthetics_checks.rs
+++ b/src/infra/src/table/synthetics_checks.rs
@@ -269,6 +269,17 @@ pub async fn count<C: ConnectionTrait>(
     org_id: &str,
     params: &ListSyntheticsParams,
 ) -> Result<u64, errors::Error> {
+    if has_json_filters(params) {
+        // location/tag live in JSON text columns: filter in Rust so count and
+        // page agree.
+        let models = Entity::find()
+            .filter(Column::OrgId.eq(org_id))
+            .apply_filters(params)
+            .order_by_asc(Column::Name)
+            .all(conn)
+            .await?;
+        return Ok(filter_and_paginate(models, params).1);
+    }
     let q = Entity::find()
         .filter(Column::OrgId.eq(org_id))
         .apply_filters(params);
@@ -1040,6 +1051,50 @@ async fn get_model<C: ConnectionTrait>(
         .await
 }
 
+fn has_json_filters(params: &ListSyntheticsParams) -> bool {
+    params.location.is_some() || params.tag.is_some()
+}
+
+fn json_array_contains(v: &serde_json::Value, needle: &str) -> bool {
+    v.as_array()
+        .is_some_and(|a| a.iter().any(|x| x.as_str() == Some(needle)))
+}
+
+/// Applies the `location` / `tag` exact-match filters (JSON text columns, so
+/// no DB operators) and then page/page_size over the filtered set. Returns the
+/// requested page and the filtered total; `models` must already be ordered.
+fn filter_and_paginate(
+    models: Vec<synthetics_checks::Model>,
+    params: &ListSyntheticsParams,
+) -> (Vec<synthetics_checks::Model>, u64) {
+    let filtered: Vec<_> = models
+        .into_iter()
+        .filter(|m| {
+            params
+                .location
+                .as_deref()
+                .is_none_or(|l| json_array_contains(&m.locations, l))
+                && params
+                    .tag
+                    .as_deref()
+                    .is_none_or(|t| json_array_contains(&m.tags, t))
+        })
+        .collect();
+    let total = filtered.len() as u64;
+    if let (Some(page_size), Some(page)) = (params.page_size, params.page)
+        && page_size > 0
+    {
+        let start = page.saturating_mul(page_size) as usize;
+        let page_rows = filtered
+            .into_iter()
+            .skip(start)
+            .take(page_size as usize)
+            .collect();
+        return (page_rows, total);
+    }
+    (filtered, total)
+}
+
 async fn list_models<C: ConnectionTrait>(
     conn: &C,
     org_id: &str,
@@ -1050,6 +1105,11 @@ async fn list_models<C: ConnectionTrait>(
         .apply_filters(params)
         .order_by_asc(Column::Name);
 
+    if has_json_filters(params) {
+        let models = q.all(conn).await?;
+        return Ok(filter_and_paginate(models, params).0);
+    }
+
     if let (Some(page_size), Some(page)) = (params.page_size, params.page)
         && page_size > 0
     {
@@ -1227,6 +1287,63 @@ pub(crate) mod tests {
         }
     }
 
+    #[test]
+    fn filter_and_paginate_combined_filters_and_pages() {
+        let mk = |id: &str, locs: &[&str], tags: &[&str]| {
+            let mut m = make_model();
+            m.id = id.to_string();
+            m.locations = serde_json::json!(locs);
+            m.tags = serde_json::json!(tags);
+            m
+        };
+        let models = vec![
+            mk("a", &["l1"], &["prod"]),
+            mk("b", &["l1", "l2"], &["prod", "x"]),
+            mk("c", &["l2"], &["prod"]),
+            mk("d", &["l1"], &["dev"]),
+            mk("e", &["l1"], &["prod"]),
+        ];
+        let params = |loc: Option<&str>, tag: Option<&str>, page, size| ListSyntheticsParams {
+            location: loc.map(String::from),
+            tag: tag.map(String::from),
+            page,
+            page_size: size,
+            ..Default::default()
+        };
+        // location only
+        let (rows, total) =
+            filter_and_paginate(models.clone(), &params(Some("l2"), None, None, None));
+        assert_eq!((rows.len(), total), (2, 2));
+        // exact match, not substring
+        let (_, total) = filter_and_paginate(models.clone(), &params(Some("l"), None, None, None));
+        assert_eq!(total, 0);
+        // combined
+        let (rows, total) = filter_and_paginate(
+            models.clone(),
+            &params(Some("l1"), Some("prod"), None, None),
+        );
+        assert_eq!(total, 3);
+        assert_eq!(
+            rows.iter().map(|m| m.id.as_str()).collect::<Vec<_>>(),
+            ["a", "b", "e"]
+        );
+        // page boundaries: total stays 3, pages 2 + 1 + empty
+        let (rows, total) = filter_and_paginate(
+            models.clone(),
+            &params(Some("l1"), Some("prod"), Some(0), Some(2)),
+        );
+        assert_eq!((rows.len(), total), (2, 3));
+        let (rows, total) = filter_and_paginate(
+            models.clone(),
+            &params(Some("l1"), Some("prod"), Some(1), Some(2)),
+        );
+        assert_eq!((rows.len(), total), (1, 3));
+        assert_eq!(rows[0].id, "e");
+        let (rows, total) =
+            filter_and_paginate(models, &params(Some("l1"), Some("prod"), Some(2), Some(2)));
+        assert_eq!((rows.len(), total), (0, 3));
+    }
+
     #[test]
     fn test_try_from_model() {
         let check = Synthetic::try_from(make_model()).unwrap();
diff --git a/src/jobs/Cargo.toml b/src/jobs/Cargo.toml
index 4de18ac87a..6b8931ef88 100644
--- a/src/jobs/Cargo.toml
+++ b/src/jobs/Cargo.toml
@@ -40,7 +40,8 @@ vectorscan = [
     "search_service/vectorscan",
     "stream/vectorscan",
 ]
-profiling = ["openobserve-core/profiling"]
+cpu-profiling = ["openobserve-core/cpu-profiling"]
+profiling = ["cpu-profiling", "openobserve-core/profiling"]
 
 [dependencies]
 audit = { workspace = true, optional = true }
diff --git a/src/jobs/src/job/cloud.rs b/src/jobs/src/job/cloud.rs
index 9d747302bd..27ab95de42 100644
--- a/src/jobs/src/job/cloud.rs
+++ b/src/jobs/src/job/cloud.rs
@@ -34,6 +34,7 @@ use db::{
 use hashbrown::HashSet;
 use infra::table::org_users::get_admin;
 use o2_enterprise::enterprise::cloud::billings::{MeteringDetail, MeteringProvider};
+use openobserve_core::org_domain_ownership;
 use stream::get_streams;
 
 use crate::{
@@ -52,6 +53,8 @@ const TRIAL_QUOTA_FLUSH_INTERVAL: u64 = 10;
 /// Interval for external contract expiry checks (1 hour).
 const EXTERNAL_CONTRACT_CHECK_INTERVAL: u64 = 3600;
 
+const ORG_DOMAIN_OWNERSHIP_CHECK_INTERVAL: u64 = 300;
+
 /// (days-remaining threshold, stage stored after the warning fires).
 /// Walked in descending-urgency order so we send at most one warning per tick.
 const EXPIRY_WARNING_STAGES: &[(
@@ -99,6 +102,7 @@ pub fn start() {
     tokio::spawn(async move { run_org_expiry_daily().await });
     tokio::spawn(async move { run_ai_quota_check().await });
     tokio::spawn(async move { run_external_contract_expiry_check().await });
+    tokio::spawn(async move { run_org_domain_ownership_validation().await });
     tokio::spawn(async move { run_budget_warning_emails().await });
 }
 
@@ -111,6 +115,55 @@ pub fn start_trial_quota_jobs() {
     });
 }
 
+async fn run_org_domain_ownership_validation() {
+    let mut interval = tokio::time::interval(tokio::time::Duration::from_secs(
+        ORG_DOMAIN_OWNERSHIP_CHECK_INTERVAL,
+    ));
+    loop {
+        interval.tick().await;
+        let records = match infra::table::org_domain_ownership::list_all().await {
+            Ok(v) => v,
+            Err(e) => {
+                log::error!(
+                    "error listing org domain ownership records for verification, skipping : {e}"
+                );
+                continue;
+            }
+        };
+        for record in records {
+            if record.meta_mapped {
+                continue;
+            }
+            let original_state = record.verification_state;
+            let org_id = record.org_id.clone();
+            let domain = record.domain.clone();
+            let updated_record = match org_domain_ownership::verify(record).await {
+                Ok(v) => v,
+                Err(e) => {
+                    log::error!(
+                        "error verifying org domain ownership record for {org_id} domain {domain} : {e}"
+                    );
+                    continue;
+                }
+            };
+            let new_state = updated_record.verification_state;
+            if new_state != original_state {
+                log::info!(
+                    "org domain ownership state for {org_id} domain {domain} changed from {original_state} to {new_state}"
+                );
+                if let Err(e) =
+                    org_domain_ownership::update_state(&org_id, &domain, new_state).await
+                {
+                    log::error!(
+                        "error updating in memory org domain ownership state for org {org_id} domain {domain} : {e}"
+                    );
+                    continue;
+                }
+            }
+        }
+    }
+}
+
 async fn run_no_ingestion_period() {
     let mut interval = tokio::time::interval(tokio::time::Duration::from_secs(
         NO_INGESTION_REPORT_INTERVAL,
diff --git a/src/jobs/src/job/mod.rs b/src/jobs/src/job/mod.rs
index 6b4d189aa4..60926a9513 100644
--- a/src/jobs/src/job/mod.rs
+++ b/src/jobs/src/job/mod.rs
@@ -596,7 +596,11 @@ pub async fn init() -> Result<(), anyhow::Error> {
     .await?;
 
     #[cfg(feature = "cloud")]
-    tokio::task::spawn(o2_enterprise::enterprise::cloud::billings::watch());
+    {
+        openobserve_core::org_domain_ownership::init().await;
+        tokio::task::spawn(o2_enterprise::enterprise::cloud::billings::watch());
+        tokio::task::spawn(openobserve_core::org_domain_ownership::watch());
+    }
 
     // check version
     db::metas::version::set()
@@ -690,7 +694,7 @@ pub async fn init() -> Result<(), anyhow::Error> {
         return Ok(());
     }
 
-    #[cfg(feature = "profiling")]
+    #[cfg(feature = "cpu-profiling")]
     tokio::task::spawn(openobserve_core::self_profiles::run());
 
     // telemetry run
diff --git a/src/jobs/src/job/slack_hooks.rs b/src/jobs/src/job/slack_hooks.rs
index e541a2e6f1..57dd54e571 100644
--- a/src/jobs/src/job/slack_hooks.rs
+++ b/src/jobs/src/job/slack_hooks.rs
@@ -71,7 +71,7 @@ async fn mapped_domains(org_id: &str) -> anyhow::Result<Vec<String>> {
     if db::org_status::is_blocked(org_id) {
         return Ok(vec![]);
     }
-    let settings = db::organization::get_org_setting(config::META_ORG_ID).await?;
+    let settings = db::organization::get_org_setting(org_id).await?;
     let mappings = settings
         .domain_org_mappings
         .iter()
diff --git a/src/synthetics/src/callback_endpoint.rs b/src/synthetics/src/callback_endpoint.rs
new file mode 100644
index 0000000000..ae73ad9624
--- /dev/null
+++ b/src/synthetics/src/callback_endpoint.rs
@@ -0,0 +1,260 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! The callback endpoint probes are told to call back on
+//! (`config::meta::synthetics::api_endpoint`), as it can safely appear in a
+//! log line or a dead-letter message, plus a startup reachability warning for
+//! Lambda venues (o2-enterprise#3165).
+
+use std::{
+    net::{IpAddr, Ipv4Addr, Ipv6Addr},
+    time::Duration,
+};
+
+/// Placeholder for an endpoint that does not parse, so no raw value (which may
+/// carry credentials) is ever echoed.
+pub const UNPARSEABLE_ENDPOINT: &str = "<unparseable callback endpoint>";
+
+/// `scheme://host[:port]/path` of `raw`: no userinfo, no query, no fragment.
+/// `None` when `raw` is not an absolute URL with a host.
+pub fn sanitize_callback_url(raw: &str) -> Option<String> {
+    let url = reqwest::Url::parse(raw.trim()).ok()?;
+    let host = url.host_str()?;
+    let port = url.port().map(|p| format!(":{p}")).unwrap_or_default();
+    let path = url.path().trim_end_matches('/');
+    Some(format!("{}://{host}{port}{path}", url.scheme()))
+}
+
+/// The endpoint probes are currently told to call back on, sanitized.
+pub fn current_callback_endpoint() -> String {
+    sanitize_callback_url(&config::meta::synthetics::api_endpoint())
+        .unwrap_or_else(|| UNPARSEABLE_ENDPOINT.to_string())
+}
+
+/// Address classes a Lambda function outside the deployment's network usually
+/// cannot reach.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum AddrClass {
+    Public,
+    Loopback,
+    Unspecified,
+    LinkLocal,
+    Private,
+}
+
+pub fn classify_ip(ip: IpAddr) -> AddrClass {
+    match ip {
+        IpAddr::V4(v4) => classify_v4(v4),
+        IpAddr::V6(v6) => {
+            if let Some(v4) = v6.to_ipv4_mapped() {
+                return classify_v4(v4);
+            }
+            classify_v6(v6)
+        }
+    }
+}
+
+fn classify_v4(ip: Ipv4Addr) -> AddrClass {
+    let o = ip.octets();
+    if ip.is_loopback() {
+        AddrClass::Loopback
+    } else if ip.is_unspecified() {
+        AddrClass::Unspecified
+    } else if ip.is_link_local() {
+        AddrClass::LinkLocal
+    } else if ip.is_private() || (o[0] == 100 && (o[1] & 0xc0) == 64) {
+        // RFC 1918 plus shared address space (100.64.0.0/10, carrier NAT).
+        AddrClass::Private
+    } else {
+        AddrClass::Public
+    }
+}
+
+fn classify_v6(ip: Ipv6Addr) -> AddrClass {
+    let first = ip.segments()[0];
+    if ip.is_loopback() {
+        AddrClass::Loopback
+    } else if ip.is_unspecified() {
+        AddrClass::Unspecified
+    } else if (first & 0xffc0) == 0xfe80 {
+        AddrClass::LinkLocal
+    } else if (first & 0xfe00) == 0xfc00 {
+        // Unique local addresses, fc00::/7.
+        AddrClass::Private
+    } else {
+        AddrClass::Public
+    }
+}
+
+/// The host part of a parsed URL as an IP literal, IPv6 brackets stripped.
+fn host_ip(host: &str) -> Option<IpAddr> {
+    host.trim_start_matches('[')
+        .trim_end_matches(']')
+        .parse()
+        .ok()
+}
+
+const DNS_TIMEOUT: Duration = Duration::from_secs(2);
+
+/// Log-only check run when a Lambda venue is enabled: a Lambda function can
+/// call back only on an endpoint reachable from its own network. Never rejects
+/// anything, because a VPC-connected Lambda can legitimately reach private
+/// addresses. Logs only the sanitized endpoint.
+pub async fn warn_if_lambda_callback_may_be_unreachable() {
+    let raw = config::meta::synthetics::api_endpoint();
+    let Some(shown) = sanitize_callback_url(&raw) else {
+        tracing::warn!(
+            "[synthetics] Lambda venue enabled but the callback endpoint \
+             (ZO_SYNTHETICS_API_ENDPOINT, else ZO_WEB_URL) is empty or not an absolute URL; \
+             Lambda probes may be unable to report results"
+        );
+        return;
+    };
+    let Ok(url) = reqwest::Url::parse(raw.trim()) else {
+        return;
+    };
+    let Some(host) = url.host_str() else { return };
+    let advice = "a Lambda probe can report only if this endpoint is reachable from the \
+                  Lambda function's network (a VPC-connected function can reach private \
+                  addresses; otherwise use a public endpoint)";
+
+    if let Some(ip) = host_ip(host) {
+        let class = classify_ip(ip);
+        if class != AddrClass::Public {
+            tracing::warn!(
+                endpoint = %shown,
+                address_class = ?class,
+                "[synthetics] callback endpoint is a {class:?} address; {advice}"
+            );
+        }
+        return;
+    }
+    if host.eq_ignore_ascii_case("localhost") || host.to_ascii_lowercase().ends_with(".localhost") {
+        tracing::warn!(
+            endpoint = %shown,
+            "[synthetics] callback endpoint is localhost; {advice}"
+        );
+        return;
+    }
+
+    let port = url.port_or_known_default().unwrap_or(443);
+    let lookup = tokio::time::timeout(
+        DNS_TIMEOUT,
+        tokio::net::lookup_host((host.to_string(), port)),
+    )
+    .await;
+    let addrs: Vec<IpAddr> = match lookup {
+        Ok(Ok(it)) => it.map(|sa| sa.ip()).collect(),
+        Ok(Err(e)) => {
+            tracing::warn!(
+                endpoint = %shown,
+                "[synthetics] could not resolve the callback endpoint host from this node ({e}); \
+                 Lambda probes may be unable to report results if it does not resolve for them \
+                 either"
+            );
+            return;
+        }
+        Err(_) => {
+            tracing::warn!(
+                endpoint = %shown,
+                "[synthetics] resolving the callback endpoint host timed out after {}s; \
+                 Lambda probes may be unable to report results if it does not resolve for them \
+                 either",
+                DNS_TIMEOUT.as_secs()
+            );
+            return;
+        }
+    };
+    let non_public = addrs
+        .iter()
+        .filter(|ip| classify_ip(**ip) != AddrClass::Public)
+        .count();
+    if non_public == 0 {
+        return;
+    }
+    let kind = if non_public == addrs.len() {
+        "only private, loopback or link-local addresses"
+    } else {
+        "a mix of public and private addresses"
+    };
+    tracing::warn!(
+        endpoint = %shown,
+        "[synthetics] callback endpoint host resolves to {kind}; {advice}"
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sanitize_strips_userinfo_query_and_fragment() {
+        assert_eq!(
+            sanitize_callback_url("https://user:secret@o2.example.com:8443/api/?token=abc#x"),
+            Some("https://o2.example.com:8443/api".to_string())
+        );
+        assert_eq!(
+            sanitize_callback_url("http://o2.example.com"),
+            Some("http://o2.example.com".to_string())
+        );
+    }
+
+    #[test]
+    fn sanitize_keeps_ipv6_brackets() {
+        assert_eq!(
+            sanitize_callback_url("http://[fd00::1]:5080/base?sig=1"),
+            Some("http://[fd00::1]:5080/base".to_string())
+        );
+    }
+
+    #[test]
+    fn sanitize_rejects_bad_urls() {
+        assert_eq!(sanitize_callback_url(""), None);
+        assert_eq!(sanitize_callback_url("not a url"), None);
+        assert_eq!(sanitize_callback_url("o2.example.com/api"), None);
+        assert_eq!(sanitize_callback_url("mailto:a@b.c"), None);
+    }
+
+    #[test]
+    fn classify_ipv4() {
+        let c = |s: &str| classify_ip(s.parse().unwrap());
+        assert_eq!(c("127.0.0.1"), AddrClass::Loopback);
+        assert_eq!(c("0.0.0.0"), AddrClass::Unspecified);
+        assert_eq!(c("169.254.169.254"), AddrClass::LinkLocal);
+        assert_eq!(c("10.1.2.3"), AddrClass::Private);
+        assert_eq!(c("172.16.0.1"), AddrClass::Private);
+        assert_eq!(c("192.168.1.1"), AddrClass::Private);
+        assert_eq!(c("100.64.0.1"), AddrClass::Private);
+        assert_eq!(c("8.8.8.8"), AddrClass::Public);
+        assert_eq!(c("172.32.0.1"), AddrClass::Public);
+    }
+
+    #[test]
+    fn classify_ipv6() {
+        let c = |s: &str| classify_ip(s.parse().unwrap());
+        assert_eq!(c("::1"), AddrClass::Loopback);
+        assert_eq!(c("::"), AddrClass::Unspecified);
+        assert_eq!(c("fe80::1"), AddrClass::LinkLocal);
+        assert_eq!(c("fd12:3456::1"), AddrClass::Private);
+        assert_eq!(c("::ffff:10.0.0.1"), AddrClass::Private);
+        assert_eq!(c("2606:4700::1111"), AddrClass::Public);
+    }
+
+    #[test]
+    fn host_ip_parses_bracketed_ipv6() {
+        assert_eq!(host_ip("[::1]"), Some("::1".parse().unwrap()));
+        assert_eq!(host_ip("o2.example.com"), None);
+    }
+}
diff --git a/src/synthetics/src/dispatcher.rs b/src/synthetics/src/dispatcher.rs
index 0f50f057fc..d4daa92592 100644
--- a/src/synthetics/src/dispatcher.rs
+++ b/src/synthetics/src/dispatcher.rs
@@ -35,7 +35,22 @@ use infra::{
 };
 
 const TICK: Duration = Duration::from_secs(2);
-const LEASE_BATCH_SIZE: i64 = 10;
+
+/// Jobs per pool per lease call (`ZO_SYNTHETICS_LEASE_BATCH_SIZE`), read per tick.
+fn lease_batch_size() -> i64 {
+    config::get_config().synthetics.lease_batch_size.max(1)
+}
+
+/// Most jobs leased across all pools in one tick (`ZO_SYNTHETICS_MAX_INFLIGHT_PER_TICK`).
+fn max_inflight_per_tick() -> i64 {
+    config::get_config().synthetics.max_inflight_per_tick.max(1)
+}
+
+/// Size of the next lease call: a full batch, trimmed so the tick never leases
+/// past its cap. Zero means the tick is out of budget.
+fn next_batch_limit(batch: i64, leased_this_tick: i64, cap: i64) -> i64 {
+    batch.min(cap - leased_this_tick).max(0)
+}
 /// How long a leased job may run before the reaper requeues it
 /// (`reaper::requeue_expired`).
 ///
@@ -95,39 +110,88 @@ static INSTANCE_ID: LazyLock<String> = LazyLock::new(|| {
     )
 });
 
-pub async fn run() {
+static POOL_ROTATION: std::sync::atomic::AtomicUsize = std::sync::atomic::AtomicUsize::new(0);
+
+pub async fn run(stop: crate::StopToken) {
     let instance_id = INSTANCE_ID.as_str();
     tracing::info!(instance_id = %instance_id, "[synthetics dispatcher] started");
 
+    // o2-enterprise#3165: a Lambda probe can only report to a callback endpoint
+    // its own network reaches. Log-only; never blocks the dispatcher.
+    {
+        let cfg = config::get_config();
+        if !cfg.synthetics.lambda_browser.is_empty() || !cfg.synthetics.lambda_net.is_empty() {
+            crate::callback_endpoint::warn_if_lambda_callback_may_be_unreachable().await;
+        }
+    }
+
     loop {
-        tokio::time::sleep(TICK).await;
+        if stop.sleep(TICK).await {
+            tracing::info!("[synthetics dispatcher] stopped");
+            return;
+        }
 
         let db = get_orm_client_rw().await;
 
         let now_us = config::utils::time::now_micros();
 
-        for pool in dispatcher_pools().await {
-            let rows = match synthetics_jobs::lease_batch(
-                db,
-                &pool,
-                instance_id,
-                LEASE_BATCH_SIZE,
-                now_us,
-                lease_secs(),
-                None, // public pools are already type-segmented (net-* vs aws-browser)
-            )
-            .await
-            {
-                Ok(r) => r,
-                Err(e) => {
-                    tracing::error!(pool = %pool, "[synthetics dispatcher] lease_batch: {e}");
-                    continue;
+        // Round-robin across pools, one batch each per round. A pool whose batch
+        // came back full may have more due, so it stays in for another round;
+        // the per-tick cap bounds the total, and no pool gets a second batch
+        // before every other active pool has had its turn.
+        let batch = lease_batch_size();
+        let cap = max_inflight_per_tick();
+        let mut leased_this_tick: i64 = 0;
+        let mut active = dispatcher_pools().await;
+        // Rotate the starting pool every tick: with the cap reached, a fixed
+        // order would let the first pools take the whole budget every tick.
+        if !active.is_empty() {
+            let start =
+                POOL_ROTATION.fetch_add(1, std::sync::atomic::Ordering::Relaxed) % active.len();
+            active.rotate_left(start);
+        }
+        while !active.is_empty() {
+            let mut still_active = Vec::with_capacity(active.len());
+            for pool in active {
+                // Ownership lost mid-tick: lease nothing more.
+                if stop.is_cancelled() {
+                    return;
                 }
-            };
+                let limit = next_batch_limit(batch, leased_this_tick, cap);
+                if limit == 0 {
+                    break;
+                }
+                let rows = match synthetics_jobs::lease_batch(
+                    db,
+                    &pool,
+                    instance_id,
+                    limit,
+                    now_us,
+                    lease_secs(),
+                    None, // public pools are already type-segmented (net-* vs aws-browser)
+                )
+                .await
+                {
+                    Ok(r) => r,
+                    Err(e) => {
+                        tracing::error!(pool = %pool, "[synthetics dispatcher] lease_batch: {e}");
+                        continue;
+                    }
+                };
 
-            for row in rows {
-                tokio::spawn(invoke_probe(row));
+                let full = rows.len() as i64 >= limit;
+                leased_this_tick += rows.len() as i64;
+                for row in rows {
+                    tokio::spawn(invoke_probe(row, stop.clone()));
+                }
+                if full {
+                    still_active.push(pool);
+                }
             }
+            if leased_this_tick >= cap {
+                break;
+            }
+            active = still_active;
         }
     }
 }
@@ -304,7 +368,13 @@ async fn mark_failure(row: &synthetics_jobs::LeasedRow, reason: Option<&str>) ->
     // nothing, while the first failure after a pass sends one message. Without
     // it the other regions' LIST would keep showing the last status they
     // themselves ran, or "Unknown".
-    match synthetics_checks::update_last_check_status(db, &row.synthetics_id, 4).await {
+    match synthetics_checks::update_last_check_status(
+        db,
+        &row.synthetics_id,
+        config::meta::status_pages::CHECK_STATUS_ERROR,
+    )
+    .await
+    {
         Ok(true) => {
             #[cfg(feature = "enterprise")]
             if o2_enterprise::enterprise::common::config::get_config()
@@ -449,7 +519,13 @@ async fn report_to_stream(
 }
 
 /// Invokes the browser probe Lambda for a leased check row.
-async fn invoke_probe(row: synthetics_jobs::LeasedRow) {
+async fn invoke_probe(row: synthetics_jobs::LeasedRow, stop: crate::StopToken) {
+    // Leased just before ownership moved: do not start the probe here. The
+    // lease expires and the new owner's reaper re-queues the row.
+    if stop.is_cancelled() {
+        tracing::info!(job_id = %row.id, "[synthetics dispatcher] ownership lost — not invoking");
+        return;
+    }
     // Derive AWS region from the job's location field.
     let region = match aws_region_from_location(&row.location) {
         Some(r) => r.to_owned(),
@@ -691,3 +767,16 @@ async fn handle_dispatch_failure(
         }
     }
 }
+
+#[cfg(test)]
+mod lease_batch_tests {
+    use super::next_batch_limit;
+
+    #[test]
+    fn batch_limit_is_trimmed_to_the_tick_cap() {
+        assert_eq!(next_batch_limit(10, 0, 100), 10);
+        assert_eq!(next_batch_limit(10, 95, 100), 5);
+        assert_eq!(next_batch_limit(10, 100, 100), 0);
+        assert_eq!(next_batch_limit(10, 120, 100), 0);
+    }
+}
diff --git a/src/synthetics/src/lib.rs b/src/synthetics/src/lib.rs
index 11be7d03ba..d71b43f252 100644
--- a/src/synthetics/src/lib.rs
+++ b/src/synthetics/src/lib.rs
@@ -60,6 +60,7 @@ pub(crate) static CONFIG_SWAP_LOCK: tokio::sync::Mutex<()> = tokio::sync::Mutex:
 pub const BUILT_WITH_CLOUD: bool = cfg!(feature = "cloud");
 
 pub mod alerting;
+pub mod callback_endpoint;
 pub mod dispatcher;
 pub mod job_api;
 pub mod pool;
@@ -157,52 +158,200 @@ pub async fn init(step_pool: Option<pool::StepPoolHooks>) {
     // super-cluster KV client is built and no NATS read is issued on this path
     // (spec §14 — super cluster off must be byte-identical).
     #[cfg(not(feature = "enterprise"))]
-    spawn_workers();
+    drop(spawn_workers(StopToken::never()));
 
     #[cfg(feature = "enterprise")]
     if !o2_enterprise::enterprise::common::config::get_config()
         .super_cluster
         .enabled
     {
-        spawn_workers();
+        drop(spawn_workers(StopToken::never()));
         return;
     }
 
     #[cfg(feature = "enterprise")]
-    tokio::spawn(async move {
-        let mut announced = false;
-        while !holds_job_cluster_claim().await {
-            if !announced {
-                // Once, not per poll: a region that legitimately does not hold
-                // the claim is the steady state for the whole life of the
-                // process, and an every-10s line would bury it.
-                tracing::info!(
-                    "[synthetics] another cluster holds the job-cluster claim (or none is \
-                     registered yet) — workers not started, re-checking every {}s",
-                    JOB_CLUSTER_POLL.as_secs()
-                );
-                announced = true;
-            }
-            tokio::time::sleep(JOB_CLUSTER_POLL).await;
-        }
-        tracing::info!("[synthetics] this cluster holds the job-cluster claim — starting workers");
-        spawn_workers();
-    });
+    tokio::spawn(ownership_supervisor());
 }
 
-fn spawn_workers() {
-    tokio::spawn(scheduler::run());
-    tokio::spawn(dispatcher::run());
-    tokio::spawn(reaper::run());
-    // POC scope: single cluster. Multi-region needs this split — the
-    // incident-engine half claim-gated, the snapshot half per region.
-    // Status pages ships with synthetics — no separate toggle.
-    tokio::spawn(status_pages::run());
-    tokio::spawn(status_pages::run_domain_verifier());
-    // Its own task, not a step on the reaper's tick: a pass is up to a thousand
-    // rows of outbound HTTP, and the reaper's lease bookkeeping cannot wait
-    // behind it. Its own kill switch too, checked per pass rather than here.
-    tokio::spawn(reaper::orphan::run());
+/// Cooperative stop signal handed to every claim-gated worker.
+///
+/// A minimal `CancellationToken` on `tokio::sync::watch` (the crate has no
+/// `tokio-util` dependency, and adding one is not worth a manifest change).
+/// A dropped sender reads as cancelled, so a supervisor that goes away fails
+/// closed rather than leaving workers running unsupervised.
+#[derive(Clone)]
+pub struct StopToken {
+    rx: tokio::sync::watch::Receiver<bool>,
+    // Only set by [`StopToken::never`]: keeps the channel open forever.
+    _keep: Option<std::sync::Arc<tokio::sync::watch::Sender<bool>>>,
+}
+
+impl StopToken {
+    /// A token plus the sender that cancels it.
+    pub fn new() -> (tokio::sync::watch::Sender<bool>, Self) {
+        let (tx, rx) = tokio::sync::watch::channel(false);
+        (tx, Self { rx, _keep: None })
+    }
+
+    /// A token that is never cancelled: the single-cluster path, where there
+    /// is no ownership to lose.
+    pub fn never() -> Self {
+        let (tx, rx) = tokio::sync::watch::channel(false);
+        Self {
+            rx,
+            _keep: Some(std::sync::Arc::new(tx)),
+        }
+    }
+
+    pub fn is_cancelled(&self) -> bool {
+        *self.rx.borrow() || (self._keep.is_none() && self.rx.has_changed().is_err())
+    }
+
+    pub async fn cancelled(&self) {
+        let mut rx = self.rx.clone();
+        // Err = sender dropped, which also means stop.
+        let _ = rx.wait_for(|v| *v).await;
+    }
+
+    /// Sleeps for `d`; returns `true` when cancelled first (the caller exits
+    /// its loop at this tick boundary, never mid-pass).
+    pub async fn sleep(&self, d: std::time::Duration) -> bool {
+        tokio::select! {
+            _ = self.cancelled() => true,
+            _ = tokio::time::sleep(d) => self.is_cancelled(),
+        }
+    }
+}
+
+/// Result of one read of the job-cluster claim. A failed read is `Unknown`,
+/// never "held": the supervisor fails closed.
+#[cfg_attr(not(feature = "enterprise"), allow(dead_code))]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum ClaimRead {
+    Held,
+    NotHeld,
+    Unknown,
+}
+
+#[cfg_attr(not(feature = "enterprise"), allow(dead_code))]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SupervisorAction {
+    Start,
+    Stop,
+    Hold,
+}
+
+/// The supervisor's whole decision: a pure function of whether a worker
+/// generation is running and what the claim read returned. Workers run exactly
+/// while the claim is provably held here; `NotHeld` and `Unknown` both stop a
+/// running generation (same fail-closed rule as the anomaly supervisor in
+/// `jobs::job::mod.rs`).
+#[cfg_attr(not(feature = "enterprise"), allow(dead_code))]
+fn supervisor_action(running: bool, claim: ClaimRead) -> SupervisorAction {
+    match (running, claim) {
+        (false, ClaimRead::Held) => SupervisorAction::Start,
+        (true, ClaimRead::NotHeld | ClaimRead::Unknown) => SupervisorAction::Stop,
+        _ => SupervisorAction::Hold,
+    }
+}
+
+/// Start/Stop supervisor for the claim-gated workers (o2-enterprise#3190).
+///
+/// Replaces the old start-only latch, which spawned the workers once on
+/// gaining the claim and never stopped them when the claim moved away, so two
+/// regions could schedule, dispatch and reap the same checks. Each generation
+/// gets its own [`StopToken`]; Stop cancels it and JOINS every worker before
+/// the next Start can happen, so there are never two generations at once.
+#[cfg(feature = "enterprise")]
+async fn ownership_supervisor() {
+    let mut generation: u64 = 0;
+    let mut running: Option<(
+        tokio::sync::watch::Sender<bool>,
+        Vec<tokio::task::JoinHandle<()>>,
+    )> = None;
+    let mut last_claim: Option<ClaimRead> = None;
+    loop {
+        let claim = read_job_cluster_claim().await;
+        if last_claim != Some(claim) && claim == ClaimRead::NotHeld && running.is_none() {
+            tracing::info!(
+                "[synthetics] another cluster holds the job-cluster claim (or none is registered \
+                 yet) — workers not running here, re-checking every {}s",
+                JOB_CLUSTER_POLL.as_secs()
+            );
+        }
+        last_claim = Some(claim);
+        match supervisor_action(running.is_some(), claim) {
+            SupervisorAction::Start => {
+                generation += 1;
+                tracing::info!(
+                    generation,
+                    "[synthetics] ownership acquired — starting workers"
+                );
+                let (tx, token) = StopToken::new();
+                running = Some((tx, spawn_workers(token)));
+            }
+            SupervisorAction::Stop => {
+                if claim == ClaimRead::Unknown {
+                    tracing::warn!(
+                        generation,
+                        "[synthetics] ownership unknown (claim read failed) — stopping workers"
+                    );
+                } else {
+                    tracing::info!(generation, "[synthetics] ownership lost — stopping workers");
+                }
+                if let Some((tx, handles)) = running.take() {
+                    let _ = tx.send(true);
+                    for h in handles {
+                        if let Err(e) = h.await {
+                            tracing::error!(generation, "[synthetics] worker join failed: {e}");
+                        }
+                    }
+                }
+                tracing::info!(generation, "[synthetics] workers stopped");
+            }
+            SupervisorAction::Hold => {}
+        }
+        tokio::time::sleep(JOB_CLUSTER_POLL).await;
+    }
+}
+
+#[cfg(feature = "enterprise")]
+async fn read_job_cluster_claim() -> ClaimRead {
+    match holds_job_cluster_claim().await {
+        Some(true) => ClaimRead::Held,
+        Some(false) => ClaimRead::NotHeld,
+        None => ClaimRead::Unknown,
+    }
+}
+
+/// Spawns one generation of workers. Every worker takes `stop` and leaves its
+/// loop at the next tick boundary once it is cancelled.
+///
+/// All of them are claim-gated, as they were under the old latch: the status
+/// page task is still one loop (incident engine and snapshot together — the
+/// per-region snapshot split is future work), and the domain verifier writes
+/// shared verification state, so both stay owner-only.
+fn spawn_workers(stop: StopToken) -> Vec<tokio::task::JoinHandle<()>> {
+    let verifier_stop = stop.clone();
+    vec![
+        tokio::spawn(scheduler::run(stop.clone())),
+        tokio::spawn(dispatcher::run(stop.clone())),
+        tokio::spawn(reaper::run(stop.clone())),
+        // Status pages ships with synthetics — no separate toggle.
+        tokio::spawn(status_pages::run(stop.clone())),
+        // The verifier lives in the enterprise crate and takes no token, so it
+        // is dropped at its next await point on cancel.
+        tokio::spawn(async move {
+            tokio::select! {
+                _ = verifier_stop.cancelled() => {}
+                _ = status_pages::run_domain_verifier() => {}
+            }
+        }),
+        // Its own task, not a step on the reaper's tick: a pass is up to a
+        // thousand rows of outbound HTTP, and the reaper's lease bookkeeping
+        // cannot wait behind it. Its own kill switch too, checked per pass.
+        tokio::spawn(reaper::orphan::run(stop)),
+    ]
 }
 
 /// One evaluation of [`should_start`] against the super-cluster KV.
@@ -217,7 +366,7 @@ fn spawn_workers() {
 /// increments `SYNTHETICS_ORPHAN_SCANS_TOTAL` anywhere, which is exactly the
 /// dead-region signal `reaper::orphan` documents.
 #[cfg(feature = "enterprise")]
-async fn holds_job_cluster_claim() -> bool {
+async fn holds_job_cluster_claim() -> Option<bool> {
     use o2_enterprise::enterprise::super_cluster::kv;
 
     let local = config::get_cluster_name();
@@ -225,27 +374,27 @@ async fn holds_job_cluster_claim() -> bool {
         Ok(name) => name,
         Err(e) => {
             tracing::error!("[synthetics] could not read the job cluster, not starting yet: {e}");
-            return false;
+            return None;
         }
     };
 
     // Both settled without the cluster list, which is the more expensive read.
     // Must agree with `should_start`, which is where the rule is tested.
     if claim.is_empty() {
-        return false;
+        return Some(false);
     }
     if claim == local {
-        return true;
+        return Some(true);
     }
 
     let live = match kv::cluster::list_by_role_group(None).await {
         Ok(clusters) => clusters.into_iter().map(|c| c.name).collect::<Vec<_>>(),
         Err(e) => {
             tracing::error!("[synthetics] could not list clusters, not starting yet: {e}");
-            return false;
+            return None;
         }
     };
-    should_start(true, &claim, &local, &live)
+    Some(should_start(true, &claim, &local, &live))
 }
 
 /// Whether this cluster may start the synthetics workers.
@@ -344,4 +493,62 @@ mod job_cluster_gate_tests {
 }
 
 #[cfg(test)]
-mod tests {}
+mod tests {
+    use super::{ClaimRead::*, StopToken, SupervisorAction::*, supervisor_action};
+
+    #[test]
+    fn starts_only_on_a_held_claim() {
+        assert_eq!(supervisor_action(false, Held), Start);
+        assert_eq!(supervisor_action(false, NotHeld), Hold);
+        assert_eq!(supervisor_action(false, Unknown), Hold);
+    }
+
+    #[test]
+    fn a_running_generation_stops_on_loss_or_read_error() {
+        assert_eq!(supervisor_action(true, NotHeld), Stop);
+        assert_eq!(supervisor_action(true, Unknown), Stop);
+        assert_eq!(supervisor_action(true, Held), Hold);
+    }
+
+    /// Flapping claim: replay the reads through the decision function and
+    /// check the generation never overlaps and every flip is acted on.
+    #[test]
+    fn flapping_claim_alternates_start_and_stop_without_overlap() {
+        let reads = [Held, Held, NotHeld, Held, Unknown, Unknown, Held, NotHeld];
+        let mut running = false;
+        let mut starts = 0;
+        let mut stops = 0;
+        for r in reads {
+            match supervisor_action(running, r) {
+                Start => {
+                    assert!(!running, "never two generations");
+                    running = true;
+                    starts += 1;
+                }
+                Stop => {
+                    assert!(running);
+                    running = false;
+                    stops += 1;
+                }
+                Hold => {}
+            }
+        }
+        assert_eq!((starts, stops), (3, 3));
+        assert!(!running);
+    }
+
+    #[tokio::test]
+    async fn stop_token_cancels_sleep_and_dropped_sender_fails_closed() {
+        let (tx, token) = StopToken::new();
+        assert!(!token.is_cancelled());
+        tx.send(true).unwrap();
+        assert!(token.sleep(std::time::Duration::from_secs(60)).await);
+
+        let (tx, token) = StopToken::new();
+        drop(tx);
+        assert!(token.sleep(std::time::Duration::from_secs(60)).await);
+
+        let never = StopToken::never();
+        assert!(!never.sleep(std::time::Duration::from_millis(1)).await);
+    }
+}
diff --git a/src/synthetics/src/reaper/mod.rs b/src/synthetics/src/reaper/mod.rs
index 0171cc8b46..561266c432 100644
--- a/src/synthetics/src/reaper/mod.rs
+++ b/src/synthetics/src/reaper/mod.rs
@@ -48,11 +48,14 @@ use infra::{
 use crate::{MAX_DISPATCH_ATTEMPTS as MAX_ATTEMPTS, alerting::ERROR_SOURCE_DISPATCH};
 const TICK: Duration = Duration::from_secs(30);
 
-pub async fn run() {
+pub async fn run(stop: crate::StopToken) {
     tracing::info!("[synthetics reaper] started");
 
     loop {
-        tokio::time::sleep(TICK).await;
+        if stop.sleep(TICK).await {
+            tracing::info!("[synthetics reaper] stopped");
+            return;
+        }
 
         let db = get_orm_client_rw().await;
 
@@ -181,7 +184,13 @@ async fn handle_dead_letter(
     // check that is already in Error dead-letters silently, which is the common
     // case when a private agent has gone away and every run of every check it
     // served is expiring.
-    match synthetics_checks::update_last_check_status(db, &row.synthetics_id, 4).await {
+    match synthetics_checks::update_last_check_status(
+        db,
+        &row.synthetics_id,
+        config::meta::status_pages::CHECK_STATUS_ERROR,
+    )
+    .await
+    {
         Ok(true) => {
             #[cfg(feature = "enterprise")]
             if o2_enterprise::enterprise::common::config::get_config()
@@ -218,21 +227,16 @@ async fn handle_dead_letter(
     // points at a dead agent or a location nothing polls; the other two point at
     // a probe that took the job and stopped talking. They need different
     // responses, so they should not read identically in the record.
-    let error_msg = match row.reason {
-        synthetics_jobs::DeadLetterReason::AttemptsExhausted => format!(
-            "probe did not respond after {} dispatch attempts",
-            row.dispatch_attempts
-        ),
-        synthetics_jobs::DeadLetterReason::Expired => format!(
-            "probe held the check but did not respond before its schedule window closed \
-             (after {} dispatch attempt(s)); the next scheduled run will retry",
-            row.dispatch_attempts
-        ),
-        synthetics_jobs::DeadLetterReason::NeverDispatched => {
-            "no probe claimed the check for this location before its schedule window closed"
-                .to_string()
-        }
-    };
+    // Phase, attempt count and the callback endpoint (o2-enterprise#3165): a
+    // timeout says the probe did not report, not why, so the message names
+    // where it was told to report and stops short of a cause.
+    //
+    // The endpoint is the one resolved NOW, not at dispatch: the job row does
+    // not store the dispatch-time endpoint. Capturing it needs a column
+    // (deferred); until then a config change between dispatch and reaping
+    // would show the new value.
+    let callback = crate::callback_endpoint::current_callback_endpoint();
+    let error_msg = dead_letter_message(row.reason, row.dispatch_attempts, &callback);
 
     // Above the token lookup, which returns early: the triggers half needs no token.
     usage_reporting::publish_triggers_usage(dead_letter_trigger(row, now_us, &error_msg));
@@ -264,6 +268,32 @@ async fn handle_dead_letter(
     write_results_stream(row, &ingest_token, &api_endpoint, now_us, &error_msg).await;
 }
 
+/// The dead-letter text for one reason. `callback` must already be sanitized.
+fn dead_letter_message(
+    reason: synthetics_jobs::DeadLetterReason,
+    dispatch_attempts: i32,
+    callback: &str,
+) -> String {
+    match reason {
+        synthetics_jobs::DeadLetterReason::AttemptsExhausted => format!(
+            "probe did not respond after {dispatch_attempts} dispatch attempts \
+             (phase: claimed, no result before the lease ran out); the probe may be unable to reach \
+             the callback endpoint {callback}"
+        ),
+        synthetics_jobs::DeadLetterReason::Expired => format!(
+            "probe held the check but did not respond before its schedule window closed \
+             (phase: claimed, lease expired without a result; after {dispatch_attempts} dispatch attempt(s)); \
+             the probe may be unable to reach the callback endpoint {callback}; \
+             the next scheduled run will retry"
+        ),
+        synthetics_jobs::DeadLetterReason::NeverDispatched => format!(
+            "no probe claimed the check for this location before its schedule window closed \
+             (phase: never claimed; {dispatch_attempts} dispatch attempt(s)); a probe may be \
+             unable to reach the callback endpoint {callback}"
+        ),
+    }
+}
+
 async fn write_results_stream(
     row: &synthetics_jobs::DeadLetteredRow,
     ingest_token: &str,
@@ -393,4 +423,21 @@ mod tests {
             "an alert rule matches the SERIALIZED value, and this row writes `failed` today",
         );
     }
+
+    #[test]
+    fn dead_letter_messages_name_phase_attempts_and_endpoint() {
+        use infra::table::synthetics_jobs::DeadLetterReason as R;
+        let ep = "https://o2.example.com/api";
+        for (reason, phase) in [
+            (R::AttemptsExhausted, "phase: claimed, no result"),
+            (R::Expired, "phase: claimed, lease expired"),
+            (R::NeverDispatched, "phase: never claimed"),
+        ] {
+            let msg = super::dead_letter_message(reason, 3, ep);
+            assert!(msg.contains(phase), "{msg}");
+            assert!(msg.contains("3 dispatch attempt"), "{msg}");
+            assert!(msg.contains(ep), "{msg}");
+            assert!(msg.contains("may be unable to reach"), "{msg}");
+        }
+    }
 }
diff --git a/src/synthetics/src/reaper/orphan.rs b/src/synthetics/src/reaper/orphan.rs
index 1b77609475..80a886f474 100644
--- a/src/synthetics/src/reaper/orphan.rs
+++ b/src/synthetics/src/reaper/orphan.rs
@@ -296,7 +296,7 @@ async fn is_scan_leader() -> bool {
 /// slow scan stalls run accounting, and runs that never complete never notify.
 /// A separate loop cannot do that, and it is free to run at a cadence that
 /// suits the threshold instead of the lease timers.
-pub async fn run() {
+pub async fn run(stop: crate::StopToken) {
     tracing::info!("[synthetics orphan] started");
     if !orphan_detection_enabled() {
         tracing::info!(
@@ -310,7 +310,10 @@ pub async fn run() {
     let mut last_reported: HashMap<String, i64> = HashMap::new();
 
     loop {
-        tokio::time::sleep(ORPHAN_TICK).await;
+        if stop.sleep(ORPHAN_TICK).await {
+            tracing::info!("[synthetics orphan] stopped");
+            return;
+        }
 
         // Read per pass, not captured here: the operator turning this off is
         // reacting to something happening now.
diff --git a/src/synthetics/src/scheduler.rs b/src/synthetics/src/scheduler.rs
index 0f2fd36dff..3551138882 100644
--- a/src/synthetics/src/scheduler.rs
+++ b/src/synthetics/src/scheduler.rs
@@ -279,11 +279,14 @@ pub fn trial_gate_decision(
     }
 }
 
-pub async fn run() {
+pub async fn run(stop: crate::StopToken) {
     tracing::info!("[synthetics scheduler] started");
 
     loop {
-        tokio::time::sleep(TICK).await;
+        if stop.sleep(TICK).await {
+            tracing::info!("[synthetics scheduler] stopped");
+            return;
+        }
 
         let db = get_orm_client_rw().await;
 
diff --git a/src/synthetics/src/service/composition_lock.rs b/src/synthetics/src/service/composition_lock.rs
index f3c0299968..5b28f5d4d4 100644
--- a/src/synthetics/src/service/composition_lock.rs
+++ b/src/synthetics/src/service/composition_lock.rs
@@ -30,6 +30,27 @@ enum Inner {
     Distributed(Option<infra::dist_lock::Locker>),
 }
 
+/// Longest a save or delete waits for the org-wide composition lock locally.
+/// The existing lock-wait config (`ZO_NATS_LOCK_WAIT_TIMEOUT`, 3600s) belongs to
+/// NATS and is far too long for a request, so this is a fixed bound. A stuck
+/// holder then fails the request with a retryable error instead of hanging it.
+const LOCAL_LOCK_WAIT: std::time::Duration = std::time::Duration::from_secs(30);
+
+async fn lock_local(
+    key: &str,
+    wait: std::time::Duration,
+) -> Result<tokio::sync::OwnedMutexGuard<bool>, infra::errors::Error> {
+    let holder = infra::local_lock::lock(key).await?;
+    tokio::time::timeout(wait, holder.lock_owned())
+        .await
+        .map_err(|_| {
+            infra::errors::Error::Message(format!(
+                "timed out after {}s waiting for the synthetics composition lock; retry shortly",
+                wait.as_secs()
+            ))
+        })
+}
+
 pub async fn lock(org_id: &str) -> Result<CompositionGuard, infra::errors::Error> {
     #[cfg(test)]
     {
@@ -41,8 +62,7 @@ pub async fn lock(org_id: &str) -> Result<CompositionGuard, infra::errors::Error
     }
     let key = format!("/synthetics/composition/{org_id}");
     let inner = if config::get_config().common.local_mode {
-        let holder = infra::local_lock::lock(&key).await?;
-        Inner::Local(holder.lock_owned().await)
+        Inner::Local(lock_local(&key, LOCAL_LOCK_WAIT).await?)
     } else {
         Inner::Distributed(infra::dist_lock::lock(&key, 0).await?)
     };
@@ -61,3 +81,22 @@ impl CompositionGuard {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use super::*;
+
+    #[tokio::test]
+    async fn local_lock_contention_times_out_then_recovers_on_release() {
+        let key = "/synthetics/composition/lock-timeout-test";
+        let held = lock_local(key, Duration::from_secs(1)).await.unwrap();
+        let err = lock_local(key, Duration::from_millis(50))
+            .await
+            .unwrap_err();
+        assert!(err.to_string().contains("retry"), "{err}");
+        drop(held);
+        lock_local(key, Duration::from_millis(50)).await.unwrap();
+    }
+}
diff --git a/src/synthetics/src/service/locations.rs b/src/synthetics/src/service/locations.rs
index 6194a6a4e2..68511922fa 100644
--- a/src/synthetics/src/service/locations.rs
+++ b/src/synthetics/src/service/locations.rs
@@ -332,8 +332,14 @@ fn default_true() -> bool {
 #[derive(Debug, Deserialize)]
 pub struct UpdateLocationRequest {
     pub label: String,
-    #[serde(default = "default_true")]
-    pub enabled: bool,
+    /// Omitted keeps the stored value; an explicit `false` disables.
+    #[serde(default)]
+    pub enabled: Option<bool>,
+}
+
+/// The `enabled` value to store: the request's, else the row's current one.
+fn resolve_enabled(requested: Option<bool>, stored: bool) -> bool {
+    requested.unwrap_or(stored)
 }
 
 /// Legacy compat: old UIs sent bare AWS regions ("us-east-1") for public
@@ -595,8 +601,9 @@ pub async fn update_location(
     id: &str,
     req: UpdateLocationRequest,
 ) -> anyhow::Result<synthetics_locations::SyntheticsLocationRecord> {
-    location_for_write(org_id, is_root, id).await?;
-    synthetics_locations::update(id, &req.label, req.enabled).await?;
+    let existing = location_for_write(org_id, is_root, id).await?;
+    let enabled = resolve_enabled(req.enabled, existing.enabled);
+    synthetics_locations::update(id, &req.label, enabled).await?;
     // The two columns the write touched, not the row: sending a row would carry
     // `down_notified_at` with it, and that flag is the claim on the right to
     // send one "location down" notification.
@@ -606,9 +613,7 @@ pub async fn update_location(
         .enabled
     {
         o2_enterprise::enterprise::super_cluster::queue::synthetics_location_update(
-            id,
-            &req.label,
-            req.enabled,
+            id, &req.label, enabled,
         )
         .await?;
     }
@@ -725,6 +730,20 @@ async fn private_location_install(
 mod tests {
     use super::*;
 
+    #[test]
+    fn label_only_update_preserves_disabled() {
+        let req: UpdateLocationRequest = serde_json::from_str(r#"{"label":"new"}"#).unwrap();
+        assert_eq!(req.enabled, None);
+        assert!(!resolve_enabled(req.enabled, false));
+        assert!(resolve_enabled(req.enabled, true));
+        let req: UpdateLocationRequest =
+            serde_json::from_str(r#"{"label":"new","enabled":false}"#).unwrap();
+        assert!(!resolve_enabled(req.enabled, true));
+        let req: UpdateLocationRequest =
+            serde_json::from_str(r#"{"label":"new","enabled":true}"#).unwrap();
+        assert!(resolve_enabled(req.enabled, false));
+    }
+
     /// Moved from the enterprise config module with the reader it pins.
     ///
     /// Decides whether a location shows Offline and whether the staleness
diff --git a/src/synthetics/src/status_pages.rs b/src/synthetics/src/status_pages.rs
index b52e60e3a0..6d4877b65b 100644
--- a/src/synthetics/src/status_pages.rs
+++ b/src/synthetics/src/status_pages.rs
@@ -91,11 +91,20 @@ pub async fn preview_snapshot(
             .push(u);
     }
 
+    // Same state read as the rebuilder, so a preview of an all-Error component
+    // shows NoData exactly as the published snapshot does.
+    let preview_check_ids: Vec<String> = mappings
+        .iter()
+        .map(|m| m.synthetics_id.clone())
+        .collect::<HashSet<_>>()
+        .into_iter()
+        .collect();
+    let (states, _) = table::get_check_states(conn, &preview_check_ids, None).await?;
     let data = TickData {
         pages: vec![page.clone()],
         components,
         mappings,
-        states: Vec::new(),
+        states,
         snoozed: HashSet::new(),
         notices: notices.clone(),
     };
@@ -146,7 +155,7 @@ pub async fn refresh_snapshot(org_id: &str, page_id: &str) -> Result<(), infra::
     .await
 }
 
-pub async fn run() {
+pub async fn run(stop: crate::StopToken) {
     let interval = config::get_config()
         .synthetics
         .status_page_rebuild_interval
@@ -164,7 +173,10 @@ pub async fn run() {
     // deletions and refreshes `last_triggered_at` for the dead-probe rule.
     let mut rt = RebuilderState::default();
     loop {
-        tokio::time::sleep(std::time::Duration::from_secs(interval)).await;
+        if stop.sleep(std::time::Duration::from_secs(interval)).await {
+            tracing::info!("[status_pages] rebuilder stopped");
+            return;
+        }
         if let Err(e) = tick(&mut hashes, &mut down_streaks, &mut rt).await {
             tracing::error!("[status_pages] rebuild tick failed: {e}");
         }
@@ -183,6 +195,106 @@ struct RebuilderState {
     /// Highest `updated_at` consumed so far (the delta watermark).
     watermark: i64,
     tick_count: u64,
+    /// Per check, the `completed_at` of the last run this loop counted.
+    seen_runs: HashMap<String, i64>,
+}
+
+/// How far back (by `scheduled_ts`) the rebuilder looks for completed runs.
+/// Only completions that are new since the previous tick matter, and a probe
+/// run completes within its job timeout (minutes), so an hour covers every
+/// normal result with room for a delayed tick. A run that completes later than
+/// this — a long-expired dead letter — ends as Error, which never advances a
+/// streak anyway.
+const RUN_COMPLETION_LOOKBACK_MICROS: i64 = 3_600_000_000;
+
+/// Records one tick's view of a check and says whether it is a new result.
+///
+/// Streaks count completed RUNS, not rebuild ticks: the rebuilder ticks far
+/// more often than most checks run, so counting ticks confirmed a single DOWN
+/// as three failures. The marker is the check's latest
+/// `synthetics_runs.completed_at`, so one completed run counts exactly once.
+/// (`last_triggered_at` moves at dispatch, before the result exists, so it
+/// counted the previous result again when the next run was dispatched.) No
+/// completed run in the lookback window means nothing new to count.
+fn observe_run(
+    down_streaks: &mut HashMap<String, i32>,
+    seen_runs: &mut HashMap<String, i64>,
+    s: &table::CheckStateRow,
+) -> bool {
+    let fresh = match s.last_completed_at {
+        Some(at) => seen_runs.insert(s.id.clone(), at) != Some(at),
+        None => false,
+    };
+    if s.last_check_status == engine::CHECK_STATUS_DOWN {
+        if fresh {
+            *down_streaks.entry(s.id.clone()).or_insert(0) += 1;
+        }
+    } else {
+        down_streaks.remove(&s.id);
+    }
+    fresh
+}
+
+/// Per-check thresholds from the pages the check is mapped to. A check on
+/// several pages uses the STRICTEST settings (max of each value), so one
+/// result stream never opens or resolves an org-wide notice earlier than any
+/// of its pages allows.
+fn thresholds_by_check(data: &TickData) -> HashMap<String, engine::Thresholds> {
+    let page_of_component: HashMap<&str, &str> = data
+        .components
+        .iter()
+        .map(|c| (c.id.as_str(), c.status_page_id.as_str()))
+        .collect();
+    let page_th: HashMap<&str, engine::Thresholds> = data
+        .pages
+        .iter()
+        .map(|p| (p.id.as_str(), page_thresholds(p)))
+        .collect();
+    let mut out: HashMap<String, engine::Thresholds> = HashMap::new();
+    for m in &data.mappings {
+        let Some(th) = page_of_component
+            .get(m.component_id.as_str())
+            .and_then(|pid| page_th.get(pid))
+        else {
+            continue;
+        };
+        out.entry(m.synthetics_id.clone())
+            .and_modify(|cur| *cur = strictest(*cur, *th))
+            .or_insert(*th);
+    }
+    out
+}
+
+fn page_thresholds(p: &infra::table::entity::status_pages::Model) -> engine::Thresholds {
+    let d = engine::Thresholds::default();
+    engine::Thresholds {
+        confirm_failures: if p.confirm_failures > 0 {
+            p.confirm_failures
+        } else {
+            d.confirm_failures
+        },
+        confirm_recovery: if p.confirm_recovery > 0 {
+            p.confirm_recovery
+        } else {
+            d.confirm_recovery
+        },
+        confirm_after_micros: p
+            .confirm_after_secs
+            .filter(|s| *s > 0)
+            .and_then(|s| (s as i64).checked_mul(1_000_000)),
+    }
+}
+
+fn strictest(a: engine::Thresholds, b: engine::Thresholds) -> engine::Thresholds {
+    engine::Thresholds {
+        confirm_failures: a.confirm_failures.max(b.confirm_failures),
+        confirm_recovery: a.confirm_recovery.max(b.confirm_recovery),
+        // Only time-confirm when every page allows it; then the longest wait.
+        confirm_after_micros: match (a.confirm_after_micros, b.confirm_after_micros) {
+            (Some(x), Some(y)) => Some(x.max(y)),
+            _ => None,
+        },
+    }
 }
 
 async fn tick(
@@ -193,14 +305,15 @@ async fn tick(
     let conn = get_orm_client_rw().await;
     let now = config::utils::time::now_micros();
     let data = load(conn, now, rt).await?;
+    let mut fresh: HashSet<String> = HashSet::new();
+    rt.seen_runs
+        .retain(|id, _| data.states.iter().any(|s| &s.id == id));
     for s in &data.states {
-        if s.last_check_status == engine::CHECK_STATUS_DOWN {
-            *down_streaks.entry(s.id.clone()).or_insert(0) += 1;
-        } else {
-            down_streaks.remove(&s.id);
+        if observe_run(down_streaks, &mut rt.seen_runs, s) {
+            fresh.insert(s.id.clone());
         }
     }
-    apply_engine_actions(conn, &data, down_streaks, now).await?;
+    apply_engine_actions(conn, &data, down_streaks, &fresh, now).await?;
     // Re-read notices only if actions changed them; a second bounded read per
     // tick is cheaper than tracking per-action deltas in the POC.
     let notices = table::list_notices_since(conn, now - RESOLVED_LOOKBACK_MICROS).await?;
@@ -239,7 +352,13 @@ async fn load(
     // Delta by default; full sweep on the Nth tick. The sweep replaces the
     // cache wholesale (so deleted/unmapped checks drop out); the delta merges
     // only changed rows over the carried cache.
-    let full_sweep = rt.tick_count.is_multiple_of(FULL_SWEEP_TICKS);
+    // Always a full read of the mapped checks' state. The delta read keys on
+    // `updated_at`, which only moves on a status TRANSITION; a check that keeps
+    // failing (or keeps passing) advances only `last_triggered_at`, so the
+    // run-based streaks in `observe_run` would see a repeated result only on
+    // the periodic sweep and confirm many minutes late. The read is three
+    // scalar columns of the mapped checks only.
+    let full_sweep = FULL_SWEEP_TICKS > 0;
     rt.tick_count = rt.tick_count.wrapping_add(1);
     let since = if full_sweep { None } else { Some(rt.watermark) };
     let (changed, max_updated) = table::get_check_states(conn, &check_ids, since).await?;
@@ -260,7 +379,16 @@ async fn load(
         rt.check_state.retain(|id, _| mapped.contains(id.as_str()));
     }
     rt.watermark = rt.watermark.max(max_updated);
-    let states: Vec<table::CheckStateRow> = rt.check_state.values().cloned().collect();
+    let mut states: Vec<table::CheckStateRow> = rt.check_state.values().cloned().collect();
+    let keys: Vec<(String, String)> = states
+        .iter()
+        .map(|s| (s.org_id.clone(), s.id.clone()))
+        .collect();
+    let completions =
+        table::latest_run_completions(conn, &keys, now - RUN_COMPLETION_LOOKBACK_MICROS).await?;
+    for s in &mut states {
+        s.last_completed_at = completions.get(&s.id).copied();
+    }
 
     let mut snoozed: HashSet<String> = table::list_active_snoozes(conn, now)
         .await?
@@ -315,6 +443,7 @@ async fn apply_engine_actions(
     conn: &sea_orm::DatabaseConnection,
     data: &TickData,
     down_streaks: &HashMap<String, i32>,
+    fresh: &HashSet<String>,
     now: i64,
 ) -> Result<(), infra::errors::Error> {
     let checks: Vec<engine::EngineCheck> = data
@@ -327,6 +456,7 @@ async fn apply_engine_actions(
             consecutive_failures: down_streaks.get(&s.id).copied().unwrap_or(0),
             first_fail_at: None,
             failing_since: None,
+            fresh_result: fresh.contains(&s.id),
         })
         .collect();
 
@@ -358,12 +488,13 @@ async fn apply_engine_actions(
         }
     }
 
-    let actions = engine::incident_actions(
+    let th_by_check = thresholds_by_check(data);
+    let actions = engine::incident_actions_with(
         &checks,
         &open_by_check,
         &recently_resolved,
         &data.snoozed,
-        &engine::Thresholds::default(),
+        |id| th_by_check.get(id).copied().unwrap_or_default(),
         now,
     );
     for action in actions {
@@ -616,8 +747,19 @@ fn build_page_snapshot(
                 });
             }
         }
-        let has_checks = data.mappings.iter().any(|m| m.component_id == component.id);
-        if !has_checks {
+        let mapped: Vec<&str> = data
+            .mappings
+            .iter()
+            .filter(|m| m.component_id == component.id)
+            .map(|m| m.synthetics_id.as_str())
+            .collect();
+        if mapped.is_empty() {
+            status = engine::ComponentStatus::NoData;
+        } else if status == engine::ComponentStatus::Operational
+            && all_checks_in_error(&mapped, &data.states)
+        {
+            // Every probe is failing to produce a verdict: we cannot say the
+            // service is up, so show "no data" rather than plain Operational.
             status = engine::ComponentStatus::NoData;
         }
         current_components.push(engine::CurrentComponent {
@@ -649,7 +791,24 @@ fn build_page_snapshot(
         generated_at: now,
         components: history_components,
     };
-    (current, history, page_notice_ids.into_iter().collect())
+    // Sorted: HashSet order is random per process, and this list feeds the
+    // serialized snapshot whose hash decides whether to rewrite it.
+    (current, history, sorted_ids(page_notice_ids))
+}
+
+fn sorted_ids(set: HashSet<String>) -> Vec<String> {
+    let mut ids: Vec<String> = set.into_iter().collect();
+    ids.sort_unstable();
+    ids
+}
+
+fn all_checks_in_error(mapped: &[&str], states: &[table::CheckStateRow]) -> bool {
+    mapped.iter().all(|id| {
+        states
+            .iter()
+            .find(|s| s.id == *id)
+            .is_some_and(|s| s.last_check_status == engine::CHECK_STATUS_ERROR)
+    })
 }
 
 fn public_notice(
@@ -720,6 +879,116 @@ pub async fn run_domain_verifier() {
 #[cfg(not(feature = "enterprise"))]
 pub async fn run_domain_verifier() {}
 
+#[cfg(test)]
+mod fast_pass_tests {
+    use super::*;
+
+    fn row(id: &str, status: i32, completed: i64) -> table::CheckStateRow {
+        row_at(id, status, Some(completed))
+    }
+
+    fn row_at(id: &str, status: i32, completed: Option<i64>) -> table::CheckStateRow {
+        table::CheckStateRow {
+            id: id.into(),
+            org_id: "org".into(),
+            last_check_status: status,
+            consecutive_failures: 0,
+            last_triggered_at: 0,
+            last_completed_at: completed,
+        }
+    }
+
+    /// The double count Codex found: dispatching the next run used to move the
+    /// marker while the status still showed the previous result, so one DOWN
+    /// counted twice and `confirm_failures = 2` opened on a single failure.
+    #[test]
+    fn dispatch_without_completion_does_not_count_again() {
+        let (mut d, mut seen) = (HashMap::new(), HashMap::new());
+        let down = engine::CHECK_STATUS_DOWN;
+        assert!(observe_run(&mut d, &mut seen, &row("c", down, 100)));
+        // Next run dispatched (last_triggered_at moves), not yet completed.
+        let mut dispatched = row("c", down, 100);
+        dispatched.last_triggered_at = 999;
+        assert!(!observe_run(&mut d, &mut seen, &dispatched));
+        assert_eq!(d["c"], 1);
+    }
+
+    /// The latest completion falling out of the lookback window is not a new
+    /// result, and its return is not one either.
+    #[test]
+    fn no_completion_in_window_is_not_fresh() {
+        let (mut d, mut seen) = (HashMap::new(), HashMap::new());
+        let down = engine::CHECK_STATUS_DOWN;
+        assert!(!observe_run(&mut d, &mut seen, &row_at("c", down, None)));
+        assert!(!d.contains_key("c"));
+        assert!(observe_run(&mut d, &mut seen, &row("c", down, 100)));
+        assert!(!observe_run(&mut d, &mut seen, &row_at("c", down, None)));
+        assert!(!observe_run(&mut d, &mut seen, &row("c", down, 100)));
+        assert_eq!(d["c"], 1);
+    }
+
+    #[test]
+    fn down_streak_counts_runs_not_ticks() {
+        let (mut d, mut seen) = (HashMap::new(), HashMap::new());
+        let down = engine::CHECK_STATUS_DOWN;
+        assert!(observe_run(&mut d, &mut seen, &row("c", down, 100)));
+        for _ in 0..10 {
+            assert!(!observe_run(&mut d, &mut seen, &row("c", down, 100)));
+        }
+        assert_eq!(d["c"], 1);
+        assert!(observe_run(&mut d, &mut seen, &row("c", down, 200)));
+        assert_eq!(d["c"], 2);
+        observe_run(
+            &mut d,
+            &mut seen,
+            &row("c", engine::CHECK_STATUS_ERROR, 300),
+        );
+        assert!(!d.contains_key("c"));
+    }
+
+    #[test]
+    fn strictest_takes_max_and_requires_time_confirm_everywhere() {
+        let a = engine::Thresholds {
+            confirm_failures: 3,
+            confirm_recovery: 4,
+            confirm_after_micros: Some(10),
+        };
+        let b = engine::Thresholds {
+            confirm_failures: 7,
+            confirm_recovery: 2,
+            confirm_after_micros: None,
+        };
+        let s = strictest(a, b);
+        assert_eq!((s.confirm_failures, s.confirm_recovery), (7, 4));
+        assert_eq!(s.confirm_after_micros, None);
+        let c = engine::Thresholds {
+            confirm_after_micros: Some(30),
+            ..a
+        };
+        assert_eq!(strictest(a, c).confirm_after_micros, Some(30));
+    }
+
+    #[test]
+    fn notice_ids_serialize_in_a_stable_order() {
+        let ids = ["n3", "n1", "n2", "n9", "n0"];
+        let fwd: HashSet<String> = ids.iter().map(|s| s.to_string()).collect();
+        let rev: HashSet<String> = ids.iter().rev().map(|s| s.to_string()).collect();
+        let a = serde_json::to_string(&sorted_ids(fwd)).unwrap();
+        let b = serde_json::to_string(&sorted_ids(rev)).unwrap();
+        assert_eq!(a, b);
+        assert_eq!(a, r#"["n0","n1","n2","n3","n9"]"#);
+    }
+
+    #[test]
+    fn all_error_component_is_not_operational() {
+        let e = engine::CHECK_STATUS_ERROR;
+        let states = vec![row("a", e, 1), row("b", e, 1), row("c", 1, 1)];
+        assert!(all_checks_in_error(&["a", "b"], &states));
+        assert!(!all_checks_in_error(&["a", "c"], &states));
+        assert!(!all_checks_in_error(&["a", "missing"], &states));
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use sea_orm::{DatabaseBackend, MockDatabase};
diff --git a/src/usage_reporting/src/lib.rs b/src/usage_reporting/src/lib.rs
index 3170840a29..bf31554d2d 100644
--- a/src/usage_reporting/src/lib.rs
+++ b/src/usage_reporting/src/lib.rs
@@ -684,6 +684,7 @@ mod tests {
             ack_source: None,
             taken_over_from: None,
             delivery_attempted: None,
+            repeat_suppressed: None,
             trigger_source: None,
             triggered_by: None,
             recipient_count: None,
diff --git a/tests/api-testing/README.md b/tests/api-testing/README.md
index acd0946e49..5df6f73109 100644
--- a/tests/api-testing/README.md
+++ b/tests/api-testing/README.md
@@ -115,6 +115,7 @@ file should pass strict ruff.
 |---|---|
 | `framework` | Self-tests for `support/` framework. Run with `-m framework`. |
 | `enterprise` | Needs an enterprise build (e.g. the on-call suite, whose routes an OSS server answers 404). Run with `-m enterprise`; deselect with `-m "not enterprise"`. |
+| `slow` | Long-running test (e.g. the profiles 100k-stack ingest, ~2 min). Runs in the normal suite; deselect with `-m "not slow"`. |
 | `order(N)` | Run order pin (legacy — avoid in new tests). |
 
 ## Troubleshooting
diff --git a/tests/api-testing/pyproject.toml b/tests/api-testing/pyproject.toml
index fa9873c0cd..75ca6ad646 100644
--- a/tests/api-testing/pyproject.toml
+++ b/tests/api-testing/pyproject.toml
@@ -63,6 +63,7 @@ markers = [
     "order: mark test to run in a specific order",
     "framework: self-tests for the support/ framework (Phase 2)",
     "enterprise: needs an enterprise build with the feature flag on (on-call). Run with -m enterprise.",
+    "slow: long-running test (e.g. profiles 100k-stack ingest); runs in the normal suite. Deselect with -m \"not slow\".",
 ]
 
 [tool.ruff]
diff --git a/tests/api-testing/tests/profiles/__init__.py b/tests/api-testing/tests/profiles/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/api-testing/tests/profiles/conftest.py b/tests/api-testing/tests/profiles/conftest.py
new file mode 100644
index 0000000000..31c08059fb
--- /dev/null
+++ b/tests/api-testing/tests/profiles/conftest.py
@@ -0,0 +1,85 @@
+"""Fixtures for the Continuous Profiling (profiles) API tests."""
+
+from __future__ import annotations
+
+import logging
+from collections.abc import Callable, Generator
+
+import pytest
+
+from support.client import OpenObserveClient
+from support.factories import unique_name
+
+from .profiles_helpers import (
+    ALL_CPU_TOTAL,
+    CHECKOUT_TOTAL,
+    PAYMENTS,
+    US,
+    RefData,
+    cpu,
+    ingest_json,
+    now_us,
+    reference_model,
+    reference_t0_ns,
+    to_json,
+    wait_merge_total,
+    window,
+)
+
+log = logging.getLogger(__name__)
+
+
+def _delete_profiles_stream(client: OpenObserveClient, name: str) -> None:
+    try:
+        resp = client.streams.delete(name, type_="profiles")
+    except Exception as e:
+        log.warning("profiles stream cleanup failed for %s: %s", name, e)
+        return
+    if resp.status_code not in (200, 404):
+        log.warning("profiles stream cleanup failed for %s: %s %s", name, resp.status_code, resp.text[:200])
+
+
+@pytest.fixture
+def new_stream(client: OpenObserveClient) -> Generator[Callable[[str], str], None, None]:
+    """Factory for unique profiles stream names; every name handed out is deleted after the test."""
+    names: list[str] = []
+
+    def _make(prefix: str = "prof") -> str:
+        name = unique_name(prefix)
+        names.append(name)
+        return name
+
+    yield _make
+    for name in names:
+        _delete_profiles_stream(client, name)
+
+
+@pytest.fixture
+def prof_stream(new_stream: Callable[[str], str]) -> str:
+    return new_stream("prof")
+
+
+@pytest.fixture(scope="module")
+def ref(client: OpenObserveClient) -> Generator[RefData, None, None]:
+    """Reference dataset (feature §7) in its own stream, visible before any test reads it."""
+    stream = unique_name("prof_ref")
+    t0_ns = reference_t0_ns()
+    data = RefData(stream=stream, t0_us=t0_ns // 1000)
+    try:
+        resp = ingest_json(client, stream, to_json(reference_model(t0_ns)))
+        assert resp.status_code == 200, f"reference ingest failed: {resp.status_code} {resp.text}"
+        assert resp.json() == {}, f"reference ingest partially rejected: {resp.text}"
+        wait_merge_total(client, stream, data.win(**cpu(service_name="checkout")), CHECKOUT_TOTAL)
+        wait_merge_total(client, stream, data.win(**cpu()), ALL_CPU_TOTAL)
+        total, unit = PAYMENTS["inuse_space"]
+        wait_merge_total(client, stream, data.win(profile_type="inuse_space", profile_unit=unit), total)
+        yield data
+    finally:
+        _delete_profiles_stream(client, stream)
+
+
+@pytest.fixture
+def empty_window() -> dict:
+    """A one-hour window three days ago; no profile in these tests is ever stored there."""
+    end = now_us() - 3 * 24 * 3600 * US
+    return window(end - 3600 * US, end)
diff --git a/tests/api-testing/tests/profiles/profiles_helpers.py b/tests/api-testing/tests/profiles/profiles_helpers.py
new file mode 100644
index 0000000000..0b49257d21
--- /dev/null
+++ b/tests/api-testing/tests/profiles/profiles_helpers.py
@@ -0,0 +1,728 @@
+"""OTLP profiles builder (JSON + hand-encoded protobuf, as the Python proto package lacks v1development), query wrappers, reference dataset."""
+
+from __future__ import annotations
+
+import copy
+import json
+import sys
+import time
+from dataclasses import dataclass
+from typing import Any
+
+import requests
+
+from support.client import OpenObserveClient
+from support.wait import WaitTimeout, wait_until
+
+NS = 1_000_000_000
+US = 1_000_000
+MIN_US = 60 * US
+PARTIAL_MSG = "Some profiles were rejected due to out-of-window timestamps, malformed samples, or empty samples"
+BAD_CT_BODY = {"code": 3, "message": "Bad Request: Content-Type must be application/json or application/x-protobuf"}
+GRPC_EXPORT = "/opentelemetry.proto.collector.profiles.v1development.ProfilesService/Export"
+# Older than any ZO_INGEST_ALLOWED_UPTO in use (CI 48 h, local up to 4000 h).
+STALE_NS = 400 * 24 * 3600 * NS
+
+# A 1000-frame stack nests ~2000 JSON levels in merge/diff trees, past the default decoder limit.
+sys.setrecursionlimit(max(sys.getrecursionlimit(), 20_000))
+
+
+def now_ns() -> int:
+    return time.time_ns()
+
+
+def now_us() -> int:
+    return time.time_ns() // 1000
+
+
+class ProfilesBuilder:
+    """Collects one shared dictionary plus resources; `model()` returns a snake_case request dict."""
+
+    def __init__(self) -> None:
+        self.strings: list[str] = [""]
+        self._str: dict[str, int] = {"": 0}
+        self.functions: list[dict] = [{}]
+        self._fn: dict[tuple, int] = {}
+        self.locations: list[dict] = [{}]
+        self._loc: dict[str, int] = {}
+        self.stacks: list[dict] = [{"location_indices": []}]
+        self._stack: dict[tuple, int] = {}
+        self.links: list[dict] = [{}]
+        self.attributes: list[dict] = [{}]
+        self.mappings: list[dict] = [{}]
+        self.resources: list[dict] = []
+
+    def s(self, text: str) -> int:
+        if text not in self._str:
+            self._str[text] = len(self.strings)
+            self.strings.append(text)
+        return self._str[text]
+
+    def func(self, name: str | None, system_name: str | None = None) -> int:
+        key = (name, system_name)
+        if key not in self._fn:
+            entry: dict[str, int] = {}
+            if name:
+                entry["name_strindex"] = self.s(name)
+            if system_name:
+                entry["system_name_strindex"] = self.s(system_name)
+            self._fn[key] = len(self.functions)
+            self.functions.append(entry)
+        return self._fn[key]
+
+    def loc_fn(self, *names: str) -> int:
+        """Symbolized location; several names = inlined lines, in line order."""
+        key = "fn:" + "\x00".join(names)
+        if key not in self._loc:
+            self._loc[key] = len(self.locations)
+            self.locations.append({"lines": [{"function_index": self.func(n)} for n in names]})
+        return self._loc[key]
+
+    def loc_raw(self, **fields: Any) -> int:
+        self.locations.append(dict(fields))
+        return len(self.locations) - 1
+
+    def mapping(self, filename: str, memory_start: int, file_offset: int = 0, attrs: list[int] | None = None) -> int:
+        entry = {
+            "memory_start": memory_start,
+            "memory_limit": memory_start + 0x100000,
+            "file_offset": file_offset,
+            "filename_strindex": self.s(filename),
+        }
+        if attrs:
+            entry["attribute_indices"] = attrs
+        self.mappings.append(entry)
+        return len(self.mappings) - 1
+
+    def attr(self, key: str, value: Any) -> int:
+        self.attributes.append({"key_strindex": self.s(key), "value": any_value(value)})
+        return len(self.attributes) - 1
+
+    def stack(self, frames: list[str]) -> int:
+        """Stack of symbolized frames, leaf first."""
+        return self.stack_locs([self.loc_fn(f) for f in frames])
+
+    def stack_locs(self, locs: list[int]) -> int:
+        key = tuple(locs)
+        if key not in self._stack:
+            self._stack[key] = len(self.stacks)
+            self.stacks.append({"location_indices": list(locs)})
+        return self._stack[key]
+
+    def link(self, trace_hex: str, span_hex: str) -> int:
+        self.links.append({"trace_id": bytes.fromhex(trace_hex), "span_id": bytes.fromhex(span_hex)})
+        return len(self.links) - 1
+
+    def sample(
+        self,
+        frames: list[str] | None = None,
+        *,
+        stack: int | None = None,
+        values=(),
+        timestamps=(),
+        attrs: dict[str, Any] | None = None,
+        link: int = 0,
+    ) -> dict:
+        idx = stack if stack is not None else (self.stack(frames) if frames else 0)
+        out: dict[str, Any] = {"stack_index": idx, "values": list(values), "timestamps_unix_nano": list(timestamps)}
+        if attrs:
+            out["attribute_indices"] = [self.attr(k, v) for k, v in attrs.items()]
+        if link:
+            out["link_index"] = link
+        return out
+
+    def stacks_samples(self, stacks: list[tuple[list[str], int]]) -> list[dict]:
+        return [self.sample(frames, values=[value]) for frames, value in stacks]
+
+    def profile(
+        self,
+        samples: list[dict],
+        *,
+        type_: str = "cpu",
+        unit: str = "nanoseconds",
+        time_ns: int = 0,
+        duration_ns: int = 10 * NS,
+        period_type: tuple[str, str] | None = None,
+        period: int = 0,
+        profile_id: bytes | None = None,
+    ) -> dict:
+        out: dict[str, Any] = {
+            "sample_type": {"type_strindex": self.s(type_), "unit_strindex": self.s(unit)},
+            "samples": samples,
+            "time_unix_nano": time_ns,
+            "duration_nano": duration_ns,
+        }
+        if period_type:
+            out["period_type"] = {"type_strindex": self.s(period_type[0]), "unit_strindex": self.s(period_type[1])}
+        if period:
+            out["period"] = period
+        if profile_id is not None:
+            out["profile_id"] = profile_id
+        return out
+
+    def resource(
+        self,
+        profiles: list[dict],
+        attrs: dict[str, Any] | None = None,
+        *,
+        scope_name: str = "",
+        scope_version: str = "",
+    ) -> dict:
+        res = {
+            "resource": {"attributes": [{"key": k, "value": any_value(v)} for k, v in (attrs or {}).items()]},
+            "scope_profiles": [{"scope": {"name": scope_name, "version": scope_version}, "profiles": profiles}],
+        }
+        self.resources.append(res)
+        return res
+
+    def model(self) -> dict:
+        return copy.deepcopy(
+            {
+                "resource_profiles": self.resources,
+                "dictionary": {
+                    "mapping_table": self.mappings,
+                    "location_table": self.locations,
+                    "function_table": self.functions,
+                    "link_table": self.links,
+                    "string_table": self.strings,
+                    "attribute_table": self.attributes,
+                    "stack_table": self.stacks,
+                },
+            }
+        )
+
+
+def any_value(value: Any) -> dict:
+    if isinstance(value, bool):
+        return {"bool_value": value}
+    if isinstance(value, int):
+        return {"int_value": value}
+    if isinstance(value, list):
+        return {"array_value": {"values": [any_value(v) for v in value]}}
+    if isinstance(value, dict):
+        return value
+    return {"string_value": value}
+
+
+def simple_request(
+    stacks: list[tuple[list[str], int]],
+    *,
+    service: str = "svc-a",
+    type_: str = "cpu",
+    unit: str = "nanoseconds",
+    time_ns: int | None = None,
+    attrs: dict[str, Any] | None = None,
+) -> dict:
+    b = ProfilesBuilder()
+    t = time_ns if time_ns is not None else now_ns() - 60 * NS
+    b.resource(
+        [b.profile(b.stacks_samples(stacks), type_=type_, unit=unit, time_ns=t)],
+        {"service.name": service, **(attrs or {})},
+    )
+    return b.model()
+
+
+def _camel(key: str) -> str:
+    head, *rest = key.split("_")
+    return head + "".join(p.capitalize() for p in rest)
+
+
+def to_json(model: Any, key: str = "") -> Any:
+    """snake_case model -> OTLP/JSON (camelCase, hex trace/span/profile ids, int64 as strings)."""
+    if isinstance(model, dict):
+        return {_camel(k): to_json(v, k) for k, v in model.items()}
+    if isinstance(model, list):
+        return [to_json(v, key) for v in model]
+    if isinstance(model, bytes):
+        return model.hex()
+    if key in ("values", "timestamps_unix_nano", "time_unix_nano", "duration_nano", "int_value") and isinstance(
+        model, int
+    ):
+        return str(model)
+    return model
+
+
+def _varint(n: int) -> bytes:
+    n &= (1 << 64) - 1
+    out = bytearray()
+    while True:
+        b = n & 0x7F
+        n >>= 7
+        if n:
+            out.append(b | 0x80)
+        else:
+            out.append(b)
+            return bytes(out)
+
+
+def _tag(field: int, wire: int) -> bytes:
+    return _varint((field << 3) | wire)
+
+
+def _int(field: int, v: int) -> bytes:
+    return _tag(field, 0) + _varint(v) if v else b""
+
+
+def _len(field: int, data: bytes) -> bytes:
+    return _tag(field, 2) + _varint(len(data)) + data
+
+
+def _str(field: int, s: str) -> bytes:
+    return _len(field, s.encode()) if s else b""
+
+
+def _bytes(field: int, b: bytes) -> bytes:
+    return _len(field, b) if b else b""
+
+
+def _fixed64(field: int, v: int) -> bytes:
+    return _tag(field, 1) + (v & ((1 << 64) - 1)).to_bytes(8, "little") if v else b""
+
+
+def _packed(field: int, vals: list[int]) -> bytes:
+    return _len(field, b"".join(_varint(v) for v in vals)) if vals else b""
+
+
+def _packed_fixed64(field: int, vals: list[int]) -> bytes:
+    return _len(field, b"".join(v.to_bytes(8, "little") for v in vals)) if vals else b""
+
+
+def _pb_any(v: dict | None) -> bytes:
+    if not v:
+        return b""
+    if "string_value" in v:
+        return _len(1, v["string_value"].encode())
+    if "bool_value" in v:
+        return _tag(2, 0) + _varint(int(v["bool_value"]))
+    if "int_value" in v:
+        return _tag(3, 0) + _varint(v["int_value"])
+    if "array_value" in v:
+        return _len(5, b"".join(_len(1, _pb_any(x)) for x in v["array_value"]["values"]))
+    if "string_value_strindex" in v:
+        return _tag(8, 0) + _varint(v["string_value_strindex"])
+    raise ValueError(f"unsupported AnyValue {v}")
+
+
+def _pb_kv(kv: dict) -> bytes:
+    return (
+        _str(1, kv.get("key", ""))
+        + (_len(2, _pb_any(kv["value"])) if kv.get("value") else b"")
+        + _int(3, kv.get("key_strindex", 0))
+    )
+
+
+def _pb_value_type(vt: dict | None) -> bytes:
+    return _int(1, vt.get("type_strindex", 0)) + _int(2, vt.get("unit_strindex", 0)) if vt else b""
+
+
+def _pb_sample(s: dict) -> bytes:
+    return (
+        _int(1, s.get("stack_index", 0))
+        + _packed(2, s.get("attribute_indices", []))
+        + _int(3, s.get("link_index", 0))
+        + _packed(4, s.get("values", []))
+        + _packed_fixed64(5, s.get("timestamps_unix_nano", []))
+    )
+
+
+def _pb_profile(p: dict) -> bytes:
+    out = _len(1, _pb_value_type(p.get("sample_type"))) if p.get("sample_type") else b""
+    out += b"".join(_len(2, _pb_sample(s)) for s in p.get("samples", []))
+    out += _fixed64(3, p.get("time_unix_nano", 0)) + _int(4, p.get("duration_nano", 0))
+    out += _len(5, _pb_value_type(p["period_type"])) if p.get("period_type") else b""
+    out += _int(6, p.get("period", 0)) + _bytes(7, p.get("profile_id", b""))
+    return out + _packed(11, p.get("attribute_indices", []))
+
+
+def _pb_dictionary(d: dict) -> bytes:
+    out = b""
+    for m in d.get("mapping_table", []):
+        out += _len(
+            1,
+            _int(1, m.get("memory_start", 0))
+            + _int(2, m.get("memory_limit", 0))
+            + _int(3, m.get("file_offset", 0))
+            + _int(4, m.get("filename_strindex", 0))
+            + _packed(5, m.get("attribute_indices", [])),
+        )
+    for loc in d.get("location_table", []):
+        lines = b"".join(_len(3, _int(1, ln.get("function_index", 0))) for ln in loc.get("lines", []))
+        out += _len(
+            2,
+            _int(1, loc.get("mapping_index", 0))
+            + _int(2, loc.get("address", 0))
+            + lines
+            + _packed(4, loc.get("attribute_indices", [])),
+        )
+    for f in d.get("function_table", []):
+        out += _len(
+            3,
+            _int(1, f.get("name_strindex", 0))
+            + _int(2, f.get("system_name_strindex", 0))
+            + _int(3, f.get("filename_strindex", 0)),
+        )
+    for link in d.get("link_table", []):
+        out += _len(4, _bytes(1, link.get("trace_id", b"")) + _bytes(2, link.get("span_id", b"")))
+    for s in d.get("string_table", []):
+        out += _len(5, s.encode())
+    for a in d.get("attribute_table", []):
+        out += _len(
+            6,
+            _int(1, a.get("key_strindex", 0))
+            + (_len(2, _pb_any(a["value"])) if a.get("value") else b"")
+            + _int(3, a.get("unit_strindex", 0)),
+        )
+    for st in d.get("stack_table", []):
+        out += _len(7, _packed(1, st.get("location_indices", [])))
+    return out
+
+
+def to_proto(model: dict) -> bytes:
+    out = b""
+    for rp in model.get("resource_profiles", []):
+        res = b"".join(_len(1, _pb_kv(kv)) for kv in rp.get("resource", {}).get("attributes", []))
+        body = _len(1, res)
+        for sp in rp.get("scope_profiles", []):
+            scope = sp.get("scope", {})
+            sbody = _len(1, _str(1, scope.get("name", "")) + _str(2, scope.get("version", "")))
+            sbody += b"".join(_len(2, _pb_profile(p)) for p in sp.get("profiles", []))
+            body += _len(2, sbody)
+        out += _len(1, body)
+    if "dictionary" in model:
+        out += _len(2, _pb_dictionary(model["dictionary"]))
+    return out
+
+
+def decode_fields(data: bytes) -> dict[int, list]:
+    """Minimal protobuf reader for the export response: {field: [varint | bytes]}."""
+    fields: dict[int, list] = {}
+    i = 0
+    while i < len(data):
+        key, i = _read_varint(data, i)
+        field, wire = key >> 3, key & 7
+        if wire == 0:
+            val, i = _read_varint(data, i)
+        elif wire == 2:
+            ln, i = _read_varint(data, i)
+            val, i = data[i : i + ln], i + ln
+        else:
+            raise ValueError(f"unexpected wire type {wire}")
+        fields.setdefault(field, []).append(val)
+    return fields
+
+
+def _read_varint(data: bytes, i: int) -> tuple[int, int]:
+    shift = result = 0
+    while True:
+        b = data[i]
+        i += 1
+        result |= (b & 0x7F) << shift
+        if not b & 0x80:
+            return result, i
+        shift += 7
+
+
+def snappy_raw(data: bytes) -> bytes:
+    """Raw (unframed) snappy block made only of literal chunks; valid input for any snappy decoder."""
+    out = bytearray(_varint(len(data)))
+    for i in range(0, len(data), 65536):
+        chunk = data[i : i + 65536]
+        n = len(chunk) - 1
+        if n < 60:
+            out.append(n << 2)
+        elif n < 256:
+            out += bytes([60 << 2, n])
+        else:
+            out += bytes([61 << 2]) + n.to_bytes(2, "little")
+        out += chunk
+    return bytes(out)
+
+
+def ingest_json(
+    client: OpenObserveClient,
+    stream: str | None,
+    body: Any,
+    *,
+    path: str = "v1/profiles",
+    content_type: str = "application/json",
+    **kw: Any,
+) -> requests.Response:
+    data = body if isinstance(body, bytes | str) else json.dumps(body)
+    headers = {"Content-Type": content_type, **kw.pop("headers", {})}
+    if stream is not None:
+        headers["stream-name"] = stream
+    return client.post(path, data=data, headers=headers, **kw)
+
+
+def ingest_proto(client: OpenObserveClient, stream: str | None, body: bytes | dict, **kw: Any) -> requests.Response:
+    data = body if isinstance(body, bytes) else to_proto(body)
+    return ingest_json(client, stream, data, content_type="application/x-protobuf", **kw)
+
+
+def query(
+    client: OpenObserveClient, stream: str, endpoint: str, body: dict | None = None, *, method: str = "POST", **kw: Any
+) -> requests.Response:
+    return client.request(method, f"{stream}/profiles/{endpoint}", json=body, **kw)
+
+
+def merge(client: OpenObserveClient, stream: str, body: dict, **kw: Any) -> requests.Response:
+    return query(client, stream, "merge", body, **kw)
+
+
+def merge_ok(client: OpenObserveClient, stream: str, body: dict) -> dict:
+    resp = merge(client, stream, body)
+    assert resp.status_code == 200, f"merge {body} -> {resp.status_code} {resp.text[:500]}"
+    return resp.json()
+
+
+def wait_merge_total(
+    client: OpenObserveClient,
+    stream: str,
+    body: dict,
+    expected: int,
+    *,
+    timeout: float = 60,
+    request_timeout: float = 30,
+) -> dict:
+    """Poll merge until `total == expected`; times out loudly with the last body."""
+    last: dict = {}
+
+    def _ready() -> dict | None:
+        nonlocal last
+        resp = merge(client, stream, body, timeout=request_timeout)
+        last = {"status": resp.status_code, "body": resp.text[:300]}
+        if resp.status_code == 200 and resp.json().get("total") == expected:
+            return resp.json()
+        return None
+
+    try:
+        return wait_until(_ready, timeout=timeout, interval=0.5, msg=f"merge total {expected} on {stream}")
+    except WaitTimeout as e:
+        raise WaitTimeout(f"{e}; last merge response: {last}") from e
+
+
+def search_rows(
+    client: OpenObserveClient, stream: str, *, start_us: int, end_us: int, where: str = "", size: int = 2000
+) -> list[dict]:
+    sql = f'SELECT * FROM "{stream}"' + (f" WHERE {where}" if where else "") + " ORDER BY _timestamp ASC"
+    resp = client.post(
+        "_search?type=profiles",
+        json={"query": {"sql": sql, "start_time": start_us, "end_time": end_us, "from": 0, "size": size}},
+    )
+    assert resp.status_code == 200, f"_search on {stream} -> {resp.status_code} {resp.text[:300]}"
+    return resp.json().get("hits", [])
+
+
+def wait_rows(
+    client: OpenObserveClient,
+    stream: str,
+    count: int,
+    *,
+    start_us: int | None = None,
+    end_us: int | None = None,
+    where: str = "",
+    timeout: float = 60,
+) -> list[dict]:
+    """Poll `_search` until exactly `count` rows are visible."""
+    start = start_us if start_us is not None else now_us() - 6 * 3600 * US
+    end = end_us if end_us is not None else now_us() + 26 * 3600 * US
+    return wait_until(
+        lambda: (rows := search_rows(client, stream, start_us=start, end_us=end, where=where))
+        and len(rows) == count
+        and rows,
+        timeout=timeout,
+        msg=f"{count} rows in {stream} where {where!r}",
+    )
+
+
+def profiles_streams(client: OpenObserveClient) -> list[str]:
+    resp = client.get("streams?type=profiles")
+    assert resp.status_code == 200, resp.text
+    return [s["name"] for s in resp.json().get("list", [])]
+
+
+def count_nodes(node: dict) -> int:
+    return 1 + sum(count_nodes(c) for c in node.get("children") or [])
+
+
+def child(node: dict, name: str) -> dict:
+    matches = [c for c in node.get("children") or [] if c["name"] == name]
+    assert len(matches) == 1, (
+        f"expected one child {name!r} under {node['name']!r}, got {[c['name'] for c in node.get('children') or []]}"
+    )
+    return matches[0]
+
+
+def assert_tree_sums(node: dict) -> None:
+    kids = node.get("children") or []
+    assert node["total"] == node["self"] + sum(c["total"] for c in kids), (
+        f"node {node['name']} total != self + children"
+    )
+    for c in kids:
+        assert_tree_sums(c)
+
+
+def window(start_us: int, end_us: int, **extra: Any) -> dict:
+    return {"start_time": start_us, "end_time": end_us, **extra}
+
+
+def recent_window(**extra: Any) -> dict:
+    """A window that covers every per-test profile (now - 6h .. now + 26h)."""
+    return window(now_us() - 6 * 3600 * US, now_us() + 26 * 3600 * US, **extra)
+
+
+def cpu(**extra: Any) -> dict:
+    return {"profile_type": "cpu", "profile_unit": "nanoseconds", **extra}
+
+
+TRACE_ID = "0af7651916cd43dd8448eb211c80319c"
+SPAN_ID = "b7ad6b7169203331"
+XSS = "<img src=x onerror=window.__xss=1>"
+CHECKOUT_TOTAL = 12_000_000_000
+ALL_CPU_TOTAL = 21_015_000_000
+CATALOG_TOTAL = 5_515_000_000
+PAYMENTS = {
+    "cpu": (3_500_000_000, "nanoseconds"),
+    "alloc_space": (1_572_864, "bytes"),
+    "inuse_space": (6_291_456, "bytes"),
+}
+
+
+@dataclass(frozen=True)
+class RefData:
+    stream: str
+    t0_us: int
+
+    def win(self, **extra: Any) -> dict:
+        """T0 - 1m .. T0 + 9m, the window that holds every reference profile."""
+        return window(self.t0_us - MIN_US, self.t0_us + 9 * MIN_US, **extra)
+
+    def bucket(self, minutes: int) -> int:
+        """Start (us) of the one-minute bucket that holds T0 + `minutes`."""
+        return self.t0_us - 5 * US + minutes * MIN_US
+
+
+def reference_t0_ns() -> int:
+    minute = now_ns() // (60 * NS) * 60 * NS
+    return minute - 10 * 60 * NS + 5 * NS
+
+
+def reference_model(t0_ns: int) -> dict:
+    b = ProfilesBuilder()
+    m = 60 * NS
+
+    def res(svc, ver, env, inst, host):
+        return {
+            "service.name": svc,
+            "service.version": ver,
+            "deployment.environment": env,
+            "service.instance.id": inst,
+            "host.name": host,
+        }
+
+    order = ["handle_order", "main"]
+    c1 = [(["db_query", *order], 2 * NS), (["json_encode", *order], NS), (order, NS)]
+    b.resource(
+        [b.profile(b.stacks_samples(c1), time_ns=t0_ns)], res("checkout", "v1.4.0", "prod", "checkout-1", "host-a")
+    )
+
+    proc = ["process", "main"]
+    b.resource(
+        [
+            b.profile(
+                b.stacks_samples([(["charge_card", *proc], 1_200_000_000), (["validate", *proc], 800_000_000)]),
+                time_ns=t0_ns + 2 * m,
+            ),
+            b.profile(
+                b.stacks_samples([(["alloc_buffer", *proc], 1_048_576), (["alloc_json", *proc], 524_288)]),
+                type_="alloc_space",
+                unit="bytes",
+                time_ns=t0_ns + 2 * m,
+            ),
+            b.profile(
+                b.stacks_samples([(["cache_put", *proc], 2_097_152)]),
+                type_="inuse_space",
+                unit="bytes",
+                time_ns=t0_ns + 2 * m,
+            ),
+        ],
+        res("payments", "v1.4.0", "prod", "payments-1", "host-d"),
+    )
+
+    link = b.link(TRACE_ID, SPAN_ID)
+    c2 = b.stacks_samples(
+        [
+            (["db_query", *order], 4 * NS),
+            (["json_encode", *order], 3 * NS),
+            (order, 500_000_000),
+            ([XSS, *order], 100_000_000),
+        ]
+    )
+    c2.append(b.sample(["process_payment", *order], values=[250_000_000], link=link))
+    b.resource([b.profile(c2, time_ns=t0_ns + 4 * m)], res("checkout", "v1.5.0", "prod", "checkout-2", "host-b"))
+
+    b.resource(
+        [
+            b.profile(b.stacks_samples([(["charge_card", *proc], 1_500_000_000)]), time_ns=t0_ns + 5 * m),
+            b.profile(
+                b.stacks_samples([(["cache_put", *proc], 4_194_304)]),
+                type_="inuse_space",
+                unit="bytes",
+                time_ns=t0_ns + 5 * m,
+            ),
+        ],
+        res("payments", "v1.5.0", "prod", "payments-2", "host-e"),
+    )
+
+    b.resource(
+        [b.profile(b.stacks_samples([(["gc_sweep", "runtime_main"], 150_000_000)]), time_ns=t0_ns + 6 * m)],
+        res("checkout", "v1.5.0", "stage", "checkout-3", "host-c"),
+    )
+
+    k1 = [([f"wide_fn_{n:03d}", "wide_root", "catalog_main"], (n + 1) * 100_000) for n in range(300)]
+    k1.append(([f"deep_{i:04d}" for i in range(1100)], NS))
+    b.resource(
+        [b.profile(b.stacks_samples(k1), time_ns=t0_ns + 7 * m)],
+        res("catalog", "v1.5.0", "stage", "catalog-1", "host-f"),
+    )
+    return b.model()
+
+
+def ingest_ok(client: OpenObserveClient, stream: str | None, model: dict) -> None:
+    """JSON ingest that must be fully accepted (200 and an empty OTLP response)."""
+    resp = ingest_json(client, stream, to_json(model))
+    assert resp.status_code == 200, f"ingest -> {resp.status_code} {resp.text[:500]}"
+    assert resp.json() == {}, f"expected full success, got {resp.text[:500]}"
+
+
+def by_stack(rows: list[dict]) -> dict[str, dict]:
+    out = {r.get("stack", ""): r for r in rows}
+    assert len(out) == len(rows), f"duplicate stacks in {rows}"
+    return out
+
+
+MIB = 1_048_576
+
+
+def snapshot_model(minute_ns: int, threads: tuple[str, str] | None = None) -> dict:
+    """One instance, two inuse snapshots (1 MiB at +5 s, 3 MiB at +25 s) inside the minute starting at `minute_ns`."""
+    b = ProfilesBuilder()
+    profiles = []
+    for i, (offset, value) in enumerate(((5, MIB), (25, 3 * MIB))):
+        attrs = {"thread.name": threads[i]} if threads else None
+        sample = b.sample(["snap_leaf", "snap_root"], values=[value], attrs=attrs)
+        profiles.append(b.profile([sample], type_="inuse_space", unit="bytes", time_ns=minute_ns + offset * NS))
+    b.resource(profiles, {"service.name": "svc-snap", "service.instance.id": "snap-1", "host.name": "h1"})
+    return b.model()
+
+
+def native_model(frame_type: str | None = None) -> dict:
+    """Two unsymbolized frames of /usr/lib/libqa.so.1 (build id deadbeefcafe) under symbolized root `a9_root`, value 9."""
+    b = ProfilesBuilder()
+    build_id = b.attr("process.executable.build_id.htlhash", "deadbeefcafe")
+    mapping = b.mapping("/usr/lib/libqa.so.1", 0x1000, 0, attrs=[build_id])
+    loc_attrs = [b.attr("profile.frame.type", frame_type)] if frame_type else []
+    locs = [b.loc_raw(mapping_index=mapping, address=addr, attribute_indices=loc_attrs) for addr in (0x1110, 0x1120)]
+    stack = b.stack_locs([*locs, b.loc_fn("a9_root")])
+    b.resource([b.profile([b.sample(stack=stack, values=[9])], time_ns=now_ns() - 60 * NS)], {"service.name": "svc-a"})
+    return b.model()
diff --git a/tests/api-testing/tests/profiles/test_profiles_diff.py b/tests/api-testing/tests/profiles/test_profiles_diff.py
new file mode 100644
index 0000000000..5c2a934784
--- /dev/null
+++ b/tests/api-testing/tests/profiles/test_profiles_diff.py
@@ -0,0 +1,221 @@
+"""Profiles `diff` API: before/after call tree and share-change ranking (feature §3.6)."""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+import requests
+
+from support.client import OpenObserveClient
+
+from .profiles_helpers import (
+    MIB,
+    MIN_US,
+    NS,
+    US,
+    XSS,
+    RefData,
+    child,
+    cpu,
+    ingest_ok,
+    now_ns,
+    query,
+    snapshot_model,
+    wait_rows,
+    window,
+)
+
+GROUP_1875 = {"gc_sweep", "handle_order", "main", "runtime_main"}
+
+
+def _side(ref: RefData, version: str, **extra) -> dict:
+    return ref.win(**cpu(service_name="checkout", filters=[{"key": "service_version", "value": version}], **extra))
+
+
+def _diff(client: OpenObserveClient, stream: str, body: dict) -> requests.Response:
+    return query(client, stream, "diff", body)
+
+
+def _diff_ok(client: OpenObserveClient, stream: str, body: dict) -> dict:
+    resp = _diff(client, stream, body)
+    assert resp.status_code == 200, f"diff -> {resp.status_code} {resp.text[:500]}"
+    return resp.json()
+
+
+def _versions(client: OpenObserveClient, ref: RefData, before: str = "v1.4.0", after: str = "v1.5.0", **extra) -> dict:
+    return _diff_ok(client, ref.stream, {"baseline": _side(ref, before), "comparison": _side(ref, after), **extra})
+
+
+def _assert_400(resp: requests.Response, message: str) -> None:
+    assert resp.status_code == 400, f"{resp.status_code} {resp.text}"
+    assert resp.json()["message"] == message
+
+
+def test_dif01_checkout_versions_totals(client: OpenObserveClient, ref: RefData):
+    body = _versions(client, ref)
+    assert (body["baseline_total"], body["comparison_total"]) == (4_000_000_000, 8_000_000_000)
+    assert (body["unit"], body["profile_type"]) == ("nanoseconds", "cpu")
+    assert (body["truncated"], body["tree_truncated"]) == (False, False)
+
+
+def test_dif02_top_ordered_by_share_change(client: OpenObserveClient, ref: RefData):
+    top = _versions(client, ref)["top"]
+    names = [t["name"] for t in top]
+    assert len(top) == 8
+    assert top[0] == {
+        "name": "json_encode",
+        "before_self": 1_000_000_000,
+        "before_total": 1_000_000_000,
+        "after_self": 3_000_000_000,
+        "after_total": 3_000_000_000,
+    }
+    assert top[1] == {
+        "name": "process_payment",
+        "before_self": 0,
+        "before_total": 0,
+        "after_self": 250_000_000,
+        "after_total": 250_000_000,
+    }
+    # The four +-1.875 pt changes are f64 shares that need not tie exactly, so only the set is fixed.
+    assert set(names[2:6]) == GROUP_1875
+    assert names[6:] == [XSS, "db_query"]
+
+
+def test_dif03_node_values_both_sides(client: OpenObserveClient, ref: RefData):
+    root = _versions(client, ref)["root"]
+    assert (root["total"], root["before_total"]) == (8_000_000_000, 4_000_000_000)
+    order = child(child(root, "main"), "handle_order")
+    assert (order["total"], order["before_total"]) == (7_850_000_000, 4_000_000_000)
+    encode = child(order, "json_encode")
+    assert (encode["self"], encode["before_self"]) == (3_000_000_000, 1_000_000_000)
+    gc = child(child(root, "runtime_main"), "gc_sweep")
+    assert (gc["total"], gc["before_total"]) == (150_000_000, 0)
+
+
+def test_dif04_swap_sides(client: OpenObserveClient, ref: RefData):
+    body = _versions(client, ref, before="v1.5.0", after="v1.4.0")
+    assert (body["baseline_total"], body["comparison_total"]) == (8_000_000_000, 4_000_000_000)
+    assert body["top"][0]["name"] == "json_encode"
+    assert (body["top"][0]["before_total"], body["top"][0]["after_total"]) == (3_000_000_000, 1_000_000_000)
+
+
+def test_dif05_one_side_without_data(client: OpenObserveClient, ref: RefData):
+    body = _versions(client, ref, after="v9.9.9")
+    assert (body["baseline_total"], body["comparison_total"]) == (4_000_000_000, 0)
+
+
+def test_dif06_different_windows_per_side(client: OpenObserveClient, ref: RefData):
+    def minute(n: int) -> dict:
+        return window(ref.bucket(n), ref.bucket(n) + MIN_US, **cpu(service_name="checkout"))
+
+    body = _diff_ok(client, ref.stream, {"baseline": minute(0), "comparison": minute(4)})
+    assert (body["baseline_total"], body["comparison_total"]) == (4_000_000_000, 7_850_000_000)
+
+
+def test_dif07_max_nodes_cut_keeps_both_totals(client: OpenObserveClient, ref: RefData):
+    body = _versions(client, ref, max_nodes=3)
+    assert body["tree_truncated"] is True
+    assert (body["baseline_total"], body["comparison_total"]) == (4_000_000_000, 8_000_000_000)
+    assert [(c["name"], c["total"], c["before_total"]) for c in body["root"]["children"]] == [
+        ("other", 8_000_000_000, 4_000_000_000)
+    ]
+
+
+def test_dif08_per_side_max_nodes_ignored(client: OpenObserveClient, ref: RefData):
+    body = _diff_ok(
+        client, ref.stream, {"baseline": _side(ref, "v1.4.0", max_nodes=3), "comparison": _side(ref, "v1.5.0")}
+    )
+    assert body["tree_truncated"] is False
+
+
+@pytest.mark.parametrize(
+    "comparison",
+    [{"profile_type": "alloc_space", "profile_unit": "bytes"}, {"profile_type": "cpu", "profile_unit": "milliseconds"}],
+    ids=["dif09-type", "dif10-unit"],
+)
+def test_dif09_10_mismatched_type_or_unit(client: OpenObserveClient, ref: RefData, comparison: dict):
+    resp = _diff(
+        client, ref.stream, {"baseline": _side(ref, "v1.4.0"), "comparison": {**_side(ref, "v1.5.0"), **comparison}}
+    )
+    _assert_400(resp, "baseline and comparison must use the same profile_type and profile_unit")
+
+
+def test_dif11_comparison_missing_type(client: OpenObserveClient, ref: RefData):
+    comparison = _side(ref, "v1.5.0")
+    del comparison["profile_type"]
+    _assert_400(
+        _diff(client, ref.stream, {"baseline": _side(ref, "v1.4.0"), "comparison": comparison}),
+        "profile_type is required",
+    )
+
+
+def test_dif12_baseline_missing_unit(client: OpenObserveClient, ref: RefData):
+    baseline = _side(ref, "v1.4.0")
+    del baseline["profile_unit"]
+    _assert_400(
+        _diff(client, ref.stream, {"baseline": baseline, "comparison": _side(ref, "v1.5.0")}),
+        "profile_unit is required",
+    )
+
+
+def test_dif13_missing_baseline(client: OpenObserveClient, ref: RefData):
+    resp = _diff(client, ref.stream, {"comparison": _side(ref, "v1.5.0")})
+    assert resp.status_code == 400, resp.text
+    message = resp.json()["message"]
+    assert message.startswith("Failed to deserialize"), message
+    assert "missing field `baseline`" in message, message
+
+
+def test_dif14_bad_filter_on_one_side(client: OpenObserveClient, ref: RefData):
+    comparison = _side(ref, "v1.5.0")
+    comparison["filters"] = [{"key": "stack", "value": "x"}]
+    _assert_400(
+        _diff(client, ref.stream, {"baseline": _side(ref, "v1.4.0"), "comparison": comparison}),
+        "invalid filter key: stack",
+    )
+
+
+def test_dif15_bad_time_on_one_side(client: OpenObserveClient, ref: RefData):
+    baseline = _side(ref, "v1.4.0")
+    baseline["start_time"] = baseline["end_time"]
+    _assert_400(
+        _diff(client, ref.stream, {"baseline": baseline, "comparison": _side(ref, "v1.5.0")}),
+        "start_time must be less than end_time",
+    )
+
+
+def test_dif16_get_not_allowed(client: OpenObserveClient, ref: RefData):
+    resp = query(client, ref.stream, "diff", method="GET")
+    assert resp.status_code == 405, resp.text
+
+
+def test_dif17_inuse_diff_per_snapshot(client: OpenObserveClient, prof_stream: str):
+    minute = (now_ns() - 3 * 60 * NS) // (60 * NS) * 60 * NS
+    ingest_ok(client, prof_stream, snapshot_model(minute))
+    wait_rows(client, prof_stream, 2)
+    inuse = {"profile_type": "inuse_space", "profile_unit": "bytes"}
+    m = minute // 1000
+    body = _diff_ok(
+        client,
+        prof_stream,
+        {"baseline": window(m, m + 15 * US, **inuse), "comparison": window(m + 15 * US, m + 40 * US, **inuse)},
+    )
+    assert (body["baseline_total"], body["comparison_total"]) == (MIB, 3 * MIB)
+
+
+def test_dif18_unknown_stream(client: OpenObserveClient, ref: RefData):
+    stream = f"no_such_{uuid.uuid4().hex[:8]}"
+    resp = _diff(client, stream, {"baseline": _side(ref, "v1.4.0"), "comparison": _side(ref, "v1.5.0")})
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["code"] == 20002
+    assert resp.json()["message"] == f"Search stream not found: {stream}"
+
+
+def test_dif19_no_auth(client: OpenObserveClient, ref: RefData):
+    resp = requests.post(
+        client.url(f"{ref.stream}/profiles/diff"),
+        json={"baseline": _side(ref, "v1.4.0"), "comparison": _side(ref, "v1.5.0")},
+        timeout=30,
+    )
+    assert resp.status_code == 401, resp.text
diff --git a/tests/api-testing/tests/profiles/test_profiles_grpc.py b/tests/api-testing/tests/profiles/test_profiles_grpc.py
new file mode 100644
index 0000000000..8f51828239
--- /dev/null
+++ b/tests/api-testing/tests/profiles/test_profiles_grpc.py
@@ -0,0 +1,96 @@
+"""Profiles over OTLP/gRPC: raw-bytes unary call, since the Python proto package lacks the v1development schema."""
+
+from __future__ import annotations
+
+import uuid
+from collections.abc import Generator
+
+import grpc
+import pytest
+
+from support.client import OpenObserveClient
+from support.otlp_grpc import grpc_target, metadata
+
+from .profiles_helpers import (
+    GRPC_EXPORT,
+    NS,
+    PARTIAL_MSG,
+    ProfilesBuilder,
+    cpu,
+    decode_fields,
+    now_ns,
+    recent_window,
+    simple_request,
+    to_proto,
+    wait_merge_total,
+)
+
+A_STACKS = [(["g_leaf", "g_work", "g_main"], 300), (["g_work", "g_main"], 100)]
+
+
+@pytest.fixture(scope="module")
+def export() -> Generator[grpc.UnaryUnaryMultiCallable, None, None]:
+    channel = grpc.insecure_channel(grpc_target())
+    try:
+        yield channel.unary_unary(GRPC_EXPORT)
+    finally:
+        channel.close()
+
+
+def _call(export: grpc.UnaryUnaryMultiCallable, body: bytes, md: list[tuple[str, str]]) -> bytes:
+    return export(body, metadata=md, timeout=30)
+
+
+def _rpc_error(export: grpc.UnaryUnaryMultiCallable, body: bytes, md: list[tuple[str, str]]) -> grpc.RpcError:
+    with pytest.raises(grpc.RpcError) as info:
+        _call(export, body, md)
+    return info.value
+
+
+def test_grpc01_export_happy_path(client: OpenObserveClient, export, prof_stream: str):
+    resp = _call(export, to_proto(simple_request(A_STACKS)), metadata(prof_stream))
+    assert resp == b"", "a fully accepted export answers an empty ExportProfilesServiceResponse"
+    body = wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+    assert [t["name"] for t in body["top"]] == ["g_leaf", "g_work", "g_main"]
+
+
+def test_grpc02_missing_organization(export, prof_stream: str):
+    md = [kv for kv in metadata(prof_stream) if kv[0] != "organization"]
+    err = _rpc_error(export, to_proto(simple_request(A_STACKS)), md)
+    assert err.code() == grpc.StatusCode.INVALID_ARGUMENT, err
+    assert err.details().startswith("Please specify organization id with header key 'organization'"), err.details()
+
+
+def test_grpc03_validation_error_is_invalid_argument(export, prof_stream: str):
+    model = simple_request(A_STACKS)
+    model["dictionary"]["stack_table"][0] = {"location_indices": [1]}
+    err = _rpc_error(export, to_proto(model), metadata(prof_stream))
+    assert err.code() == grpc.StatusCode.INVALID_ARGUMENT, err
+    assert err.details() == "dictionary.stack_table[0] must be the zero value"
+
+
+def test_grpc04_partial_success(client: OpenObserveClient, export, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    bad = b.sample(["bad_leaf"], values=[1, 2], timestamps=[t])
+    b.resource([b.profile([bad, b.sample(["good_leaf"], values=[50])], time_ns=t)], {"service.name": "svc-g"})
+    resp = _call(export, to_proto(b.model()), metadata(prof_stream))
+    partial = decode_fields(decode_fields(resp)[1][0])
+    assert partial[1] == [1]
+    assert partial[2] == [PARTIAL_MSG.encode()]
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 50)
+
+
+def test_grpc05_no_stream_name_writes_default(client: OpenObserveClient, export):
+    service = f"svc-grpc-noheader-{uuid.uuid4().hex[:8]}"
+    md = [kv for kv in metadata("unused") if kv[0] != "stream-name"]
+    # `default` is shared and is not deleted: a deleted stream answers 503 "being deleted" to the next run's ingest.
+    resp = _call(export, to_proto(simple_request([(["gd_leaf", "gd_main"], 33)], service=service)), md)
+    assert resp == b""
+    wait_merge_total(client, "default", recent_window(**cpu(service_name=service)), 33)
+
+
+def test_grpc06_unauthenticated(export, prof_stream: str):
+    md = [kv for kv in metadata(prof_stream) if kv[0] != "authorization"]
+    err = _rpc_error(export, to_proto(simple_request(A_STACKS)), md)
+    assert err.code() == grpc.StatusCode.UNAUTHENTICATED, err
diff --git a/tests/api-testing/tests/profiles/test_profiles_ingest.py b/tests/api-testing/tests/profiles/test_profiles_ingest.py
new file mode 100644
index 0000000000..6b53488f2f
--- /dev/null
+++ b/tests/api-testing/tests/profiles/test_profiles_ingest.py
@@ -0,0 +1,563 @@
+"""Profiles ingestion: formats, auth, compression, stream naming and the stored row shape (feature §2.1-§2.4)."""
+
+from __future__ import annotations
+
+import gzip
+import json
+import os
+import uuid
+
+import pytest
+import requests
+
+from support.client import OpenObserveClient
+
+from .profiles_helpers import (
+    NS,
+    US,
+    ProfilesBuilder,
+    by_stack,
+    child,
+    cpu,
+    ingest_json,
+    ingest_ok,
+    ingest_proto,
+    merge_ok,
+    native_model,
+    now_ns,
+    now_us,
+    profiles_streams,
+    query,
+    recent_window,
+    simple_request,
+    snappy_raw,
+    to_json,
+    to_proto,
+    wait_merge_total,
+    wait_rows,
+)
+
+A_STACKS = [(["a_leaf", "a_work", "a_main"], 300), (["a_work", "a_main"], 100)]
+
+
+def _one_profile(b: ProfilesBuilder, samples: list[dict], attrs: dict | None = None, **profile_kw) -> dict:
+    b.resource(
+        [b.profile(samples, time_ns=profile_kw.pop("time_ns", now_ns() - 60 * NS), **profile_kw)],
+        {"service.name": "svc-a", **(attrs or {})},
+    )
+    return b.model()
+
+
+def _deep(n: int) -> list[str]:
+    return [f"deep_{i:04d}" for i in range(n)]
+
+
+def _depth_rows(client: OpenObserveClient, stream: str, frames: int) -> dict:
+    ingest_ok(client, stream, simple_request([(_deep(frames), 1)]))
+    return wait_rows(client, stream, 1)[0]
+
+
+def test_ing01_json_ingest(client: OpenObserveClient, prof_stream: str):
+    resp = ingest_json(client, prof_stream, to_json(simple_request(A_STACKS)))
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_ing02_v1development_path(client: OpenObserveClient, prof_stream: str):
+    resp = ingest_json(client, prof_stream, to_json(simple_request(A_STACKS)), path="v1development/profiles")
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_ing03_protobuf_ingest(client: OpenObserveClient, prof_stream: str):
+    resp = ingest_proto(client, prof_stream, simple_request(A_STACKS))
+    assert resp.status_code == 200, resp.text
+    assert resp.headers["content-type"].startswith("application/x-protobuf")
+    assert resp.content == b"", "a fully accepted proto export answers an empty ExportProfilesServiceResponse"
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_ing04_json_with_charset(client: OpenObserveClient, prof_stream: str):
+    resp = ingest_json(
+        client, prof_stream, to_json(simple_request(A_STACKS)), content_type="application/json; charset=utf-8"
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_ing05_gzip_body(client: OpenObserveClient, prof_stream: str):
+    body = gzip.compress(json.dumps(to_json(simple_request(A_STACKS))).encode())
+    resp = ingest_json(client, prof_stream, body, headers={"Content-Encoding": "gzip"})
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_ing06_snappy_body(client: OpenObserveClient, prof_stream: str):
+    body = snappy_raw(to_proto(simple_request(A_STACKS)))
+    resp = ingest_proto(client, prof_stream, body, headers={"Content-Encoding": "snappy"})
+    assert resp.status_code == 200, resp.text
+    assert resp.content == b""
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_ing07_no_stream_header_writes_default(client: OpenObserveClient):
+    service = f"svc-noheader-{uuid.uuid4().hex[:8]}"
+    # `default` is shared and is not deleted: a deleted stream answers 503 "being deleted" to the next run's ingest.
+    resp = ingest_json(client, None, to_json(simple_request([(["nh_leaf", "nh_main"], 77)], service=service)))
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, "default", recent_window(**cpu(service_name=service)), 77)
+
+
+@pytest.mark.skipif(
+    os.environ.get("ZO_FORMAT_STREAM_NAME_TO_LOWERCASE", "true").lower() == "false",
+    reason="stream names keep their case when ZO_FORMAT_STREAM_NAME_TO_LOWERCASE=false",
+)
+def test_ing08_upper_case_stream_name_lowered(client: OpenObserveClient, new_stream):
+    lower = new_stream("prof_up")
+    resp = ingest_json(client, lower.upper(), to_json(simple_request(A_STACKS)))
+    assert resp.status_code == 200, resp.text
+    wait_merge_total(client, lower, recent_window(**cpu()), 400)
+    names = profiles_streams(client)
+    assert lower in names
+    assert lower.upper() not in names
+
+
+def test_ing09_stored_row_shape(client: OpenObserveClient, prof_stream: str):
+    ingest_ok(client, prof_stream, simple_request(A_STACKS))
+    rows = by_stack(wait_rows(client, prof_stream, 2))
+    row = rows["a_leaf;a_work;a_main"]
+    assert row["value"] == 300
+    assert row["frame_count"] == 3
+    assert row["profile_type"] == "cpu"
+    assert row["profile_unit"] == "nanoseconds"
+    assert row["service_name"] == "svc-a"
+    assert row["extractor_version"] == "v1"
+    assert row["duration_nanos"] == 10 * NS
+    assert rows["a_work;a_main"]["value"] == 100
+    assert rows["a_work;a_main"]["frame_count"] == 2
+    schema = client.get(f"streams/{prof_stream}/schema?type=profiles")
+    assert schema.status_code == 200, schema.text
+    fields = {f["name"] for f in schema.json()["schema"]}
+    assert "event_id" not in fields
+    assert {"stack", "value", "frame_count", "profile_type", "profile_unit", "service_name"} <= fields
+
+
+def test_ing10_paired_values_and_timestamps(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns()
+    stamps = [t - 3 * NS + 111_000, t - 2 * NS + 222_000, t - NS + 333_000]
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["p_leaf"], values=[10, 20, 30], timestamps=stamps)]))
+    rows = wait_rows(client, prof_stream, 3)
+    assert [(r["_timestamp"], r["value"]) for r in rows] == [
+        (s // 1000, v) for s, v in zip(stamps, [10, 20, 30], strict=True)
+    ]
+
+
+def test_ing11_timestamps_only_value_one(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns()
+    stamps = [t - 2 * NS, t - NS]
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["t_leaf"], timestamps=stamps)]))
+    rows = wait_rows(client, prof_stream, 2)
+    assert [(r["_timestamp"], r["value"]) for r in rows] == [(s // 1000, 1) for s in stamps]
+
+
+def test_ing12_values_only_summed_at_profile_time(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 30 * NS + 123_456
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["v_leaf"], values=[5, 6, 7])], time_ns=t))
+    rows = wait_rows(client, prof_stream, 1)
+    assert rows[0]["value"] == 18
+    assert rows[0]["_timestamp"] == t // 1000
+
+
+def test_ing13_zero_profile_time_is_now(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    before = now_us()
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["z_leaf"], values=[3])], time_ns=0))
+    rows = wait_rows(client, prof_stream, 1)
+    assert abs(rows[0]["_timestamp"] - before) <= 60 * US, rows[0]
+
+
+def test_ing14_zero_sample_timestamp_uses_profile_time(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 40 * NS + 7_000
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["zt_leaf"], values=[7], timestamps=[0])], time_ns=t))
+    rows = wait_rows(client, prof_stream, 1)
+    assert rows[0]["value"] == 7
+    assert rows[0]["_timestamp"] == t // 1000
+
+
+def test_ing15_resource_attributes_to_columns(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    attrs = {
+        "host.name": "host-15",
+        "deployment.environment": "qa",
+        "process.pid": 4242,
+        "service.version": "v15",
+        "service.instance.id": "inst-15",
+        "k8s.pod.name": "pod-15",
+        "team.owner": "team-a",
+    }
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["r_leaf"], values=[1])], attrs))
+    row = wait_rows(client, prof_stream, 1)[0]
+    assert row["host_name"] == "host-15"
+    assert row["deployment_environment"] == "qa"
+    assert str(row["process_pid"]) == "4242"
+    assert row["service_version"] == "v15"
+    assert row["service_instance_id"] == "inst-15"
+    assert row["k8s_pod_name"] == "pod-15"
+    assert row["team_owner"] == "team-a"
+
+
+def test_ing16_empty_resource_attribute_skipped(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["e_leaf"], values=[1])], {"team.owner": ""}))
+    row = wait_rows(client, prof_stream, 1)[0]
+    assert "team_owner" not in row
+    fields = {f["name"] for f in client.get(f"streams/{prof_stream}/schema?type=profiles").json()["schema"]}
+    assert "team_owner" not in fields
+
+
+def test_ing17_resource_attrs_cannot_overwrite_reserved(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    attrs = {"stack": "evil", "value": "evil", "profile.type": "x"}
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["real_leaf", "real_root"], values=[9])], attrs))
+    row = wait_rows(client, prof_stream, 1)[0]
+    assert row["stack"] == "real_leaf;real_root"
+    assert row["value"] == 9
+    assert row["profile_type"] == "cpu"
+
+
+def test_ing18_sample_attributes_to_thread_columns(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    attrs = {"thread.id": 42, "thread.name": "worker-1", "cpu.logical_number": 3, "custom.tag": "x"}
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["th_leaf"], values=[1], attrs=attrs)]))
+    row = wait_rows(client, prof_stream, 1)[0]
+    assert row["thread_id"] == "42"
+    assert row["thread_name"] == "worker-1"
+    assert row["cpu_logical_number"] == "3"
+    assert row["custom_tag"] == "x"
+
+
+def test_ing19_thread_id_aliases(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    samples = [
+        b.sample(["os_leaf"], values=[1], attrs={"os.thread.id": "101"}),
+        b.sample(["us_leaf"], values=[1], attrs={"thread_id": "202"}),
+    ]
+    ingest_ok(client, prof_stream, _one_profile(b, samples))
+    rows = by_stack(wait_rows(client, prof_stream, 2))
+    assert rows["os_leaf"]["thread_id"] == "101"
+    assert rows["us_leaf"]["thread_id"] == "202"
+
+
+def test_ing20_trace_link_lowercased_only_on_linked_sample(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    link = b.link("0af7651916cd43dd8448eb211c80319c", "b7ad6b7169203331")
+    body = to_json(_one_profile(b, [b.sample(["linked"], values=[5], link=link), b.sample(["plain"], values=[6])]))
+    body["dictionary"]["linkTable"][link] = {
+        "traceId": "0AF7651916CD43DD8448EB211C80319C",
+        "spanId": "B7AD6B7169203331",
+    }
+    resp = ingest_json(client, prof_stream, body)
+    assert resp.status_code == 200, resp.text
+    rows = by_stack(wait_rows(client, prof_stream, 2))
+    assert rows["linked"]["trace_id"] == "0af7651916cd43dd8448eb211c80319c"
+    assert rows["linked"]["span_id"] == "b7ad6b7169203331"
+    assert "trace_id" not in rows["plain"]
+    assert "span_id" not in rows["plain"]
+
+
+def test_ing21_profile_duration_once_per_instance(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    samples = [b.sample([f"d_leaf_{i}"], values=[i + 1]) for i in range(3)]
+    ingest_ok(client, prof_stream, _one_profile(b, samples))
+    rows = wait_rows(client, prof_stream, 3)
+    assert [r.get("profile_duration_nanos") for r in rows].count(10 * NS) == 1
+    assert sum("profile_duration_nanos" in r for r in rows) == 1
+
+
+def test_ing22_profile_duration_per_instance_in_batch(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    for inst in ("a", "b"):
+        samples = [b.sample([f"{inst}_leaf_{i}"], values=[1]) for i in range(2)]
+        b.resource([b.profile(samples, time_ns=t)], {"service.name": "svc-a", "service.instance.id": f"inst-{inst}"})
+    ingest_ok(client, prof_stream, b.model())
+    rows = wait_rows(client, prof_stream, 4)
+    timed = sorted(r["service_instance_id"] for r in rows if r.get("profile_duration_nanos") == 10 * NS)
+    assert timed == ["inst-a", "inst-b"]
+
+
+def test_ing23_profile_id_hex_and_zero_omitted(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    pid = bytes(range(1, 17))
+    b.resource(
+        [
+            b.profile([b.sample(["pid_a"], values=[1])], time_ns=t, profile_id=pid),
+            b.profile([b.sample(["pid_b"], values=[1])], time_ns=t, profile_id=bytes(16)),
+        ],
+        {"service.name": "svc-a"},
+    )
+    ingest_ok(client, prof_stream, b.model())
+    rows = by_stack(wait_rows(client, prof_stream, 2))
+    assert rows["pid_a"]["profile_id"] == pid.hex()
+    assert "profile_id" not in rows["pid_b"]
+
+
+def test_ing24_period_fields(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    b.resource(
+        [
+            b.profile(
+                [b.sample(["per_ns"], values=[1])], time_ns=t, period_type=("cpu", "nanoseconds"), period=10_000_000
+            ),
+            b.profile([b.sample(["per_count"], values=[1])], time_ns=t, period_type=("samples", "count"), period=99),
+        ],
+        {"service.name": "svc-a"},
+    )
+    ingest_ok(client, prof_stream, b.model())
+    rows = by_stack(wait_rows(client, prof_stream, 2))
+    ns_row, count_row = rows["per_ns"], rows["per_count"]
+    assert (ns_row["period_nanos"], ns_row["period_type"], ns_row["period_unit"]) == (10_000_000, "cpu", "nanoseconds")
+    assert "period" not in ns_row
+    assert (count_row["period"], count_row["period_type"], count_row["period_unit"]) == (99, "samples", "count")
+    assert "period_nanos" not in count_row
+
+
+def test_ing25_scope_name_and_version(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    b.resource(
+        [b.profile([b.sample(["sc_leaf"], values=[1])], time_ns=now_ns() - 60 * NS)],
+        {"service.name": "svc-a"},
+        scope_name="pyroscope",
+        scope_version="1.2",
+    )
+    ingest_ok(client, prof_stream, b.model())
+    row = wait_rows(client, prof_stream, 1)[0]
+    assert row["otel_scope_name"] == "pyroscope"
+    assert row["otel_scope_version"] == "1.2"
+
+
+def _service_fallback(client: OpenObserveClient, stream: str, attrs: dict) -> str:
+    b = ProfilesBuilder()
+    b.resource([b.profile([b.sample(["fb_leaf"], values=[1])], time_ns=now_ns() - 60 * NS)], attrs)
+    ingest_ok(client, stream, b.model())
+    return wait_rows(client, stream, 1)[0]["service_name"]
+
+
+def test_ing26_missing_service_uses_executable(client: OpenObserveClient, prof_stream: str):
+    assert _service_fallback(client, prof_stream, {"process.executable.name": "mybin"}) == "unknown_service:mybin"
+    w = recent_window()
+    meta = query(
+        client, prof_stream, "meta", method="GET", params={"start_time": w["start_time"], "end_time": w["end_time"]}
+    )
+    assert meta.status_code == 200, meta.text
+    assert meta.json()["services"] == ["unknown_service:mybin"]
+
+
+def test_ing27_missing_service_no_executable(client: OpenObserveClient, prof_stream: str):
+    assert _service_fallback(client, prof_stream, {}) == "unknown_service"
+
+
+def test_ing28_empty_service_name_uses_executable(client: OpenObserveClient, prof_stream: str):
+    attrs = {"service.name": "", "process.executable.name": "emptysvcbin"}
+    assert _service_fallback(client, prof_stream, attrs) == "unknown_service:emptysvcbin"
+
+
+def test_ing29_deep_stack_truncated(client: OpenObserveClient, prof_stream: str):
+    row = _depth_rows(client, prof_stream, 1100)
+    frames = row["stack"].split(";")
+    assert row["frame_count"] == 1000
+    assert len(frames) == 1000
+    assert frames[0] == "deep_0000"
+    assert frames[-2:] == ["deep_0998", "[truncated]"]
+
+
+def test_ing30_exactly_1000_frames_kept(client: OpenObserveClient, prof_stream: str):
+    row = _depth_rows(client, prof_stream, 1000)
+    assert row["frame_count"] == 1000
+    assert row["stack"] == ";".join(_deep(1000))
+
+
+def test_ing31_1001_frames_truncated(client: OpenObserveClient, prof_stream: str):
+    row = _depth_rows(client, prof_stream, 1001)
+    assert row["frame_count"] == 1000
+    assert row["stack"] == ";".join(_deep(999) + ["[truncated]"])
+
+
+def test_ing32_inlined_lines_become_frames(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    stack = b.stack_locs([b.loc_fn("inner", "outer"), b.loc_fn("main32")])
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(stack=stack, values=[4])]))
+    row = wait_rows(client, prof_stream, 1)[0]
+    assert row["stack"] == "inner;outer;main32"
+    assert row["frame_count"] == 3
+
+
+def test_ing33_function_without_name_uses_system_name(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    loc = b.loc_raw(lines=[{"function_index": b.func(None, "sys_fn")}])
+    stack = b.stack_locs([loc, b.loc_fn("main33")])
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(stack=stack, values=[4])]))
+    assert wait_rows(client, prof_stream, 1)[0]["stack"] == "sys_fn;main33"
+
+
+def test_ing34_unsymbolized_frames_file_and_build_id(client: OpenObserveClient, prof_stream: str):
+    ingest_ok(client, prof_stream, native_model())
+    row = wait_rows(client, prof_stream, 1)[0]
+    assert row["stack"] == "libqa.so.1@deadbeefcafe+0x110;libqa.so.1@deadbeefcafe+0x120;a9_root"
+    root = merge_ok(client, prof_stream, recent_window(**cpu()))["root"]
+    native = child(child(root, "a9_root"), "[libqa.so.1]")
+    assert (native["self"], native["total"]) == (9, 9)
+    assert not native.get("children")
+
+
+def test_ing35_unsymbolized_frames_with_frame_type(client: OpenObserveClient, prof_stream: str):
+    ingest_ok(client, prof_stream, native_model("native"))
+    row = wait_rows(client, prof_stream, 1)[0]
+    assert row["stack"] == "libqa.so.1@deadbeefcafe+0x110/native;libqa.so.1@deadbeefcafe+0x120/native;a9_root"
+    root = merge_ok(client, prof_stream, recent_window(**cpu()))["root"]
+    assert child(child(root, "a9_root"), "[libqa.so.1]")["self"] == 9
+
+
+def test_ing36_location_without_mapping_folds_to_unknown(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    stack = b.stack_locs([b.loc_raw(address=0xABC), b.loc_fn("root36")])
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(stack=stack, values=[6])]))
+    assert wait_rows(client, prof_stream, 1)[0]["stack"] == "0xabc;root36"
+    root = merge_ok(client, prof_stream, recent_window(**cpu()))["root"]
+    assert child(child(root, "root36"), "[unknown]")["self"] == 6
+
+
+def test_ing37_empty_stack_credits_root(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(stack=0, values=[5]), b.sample(["es_leaf"], values=[10])]))
+    rows = by_stack(wait_rows(client, prof_stream, 2))
+    assert (rows[""]["value"], rows[""]["frame_count"]) == (5, 0)
+    body = wait_merge_total(client, prof_stream, recent_window(**cpu()), 15)
+    assert body["root"]["self"] == 5
+    assert [t["name"] for t in body["top"]] == ["es_leaf"]
+
+
+def test_ing38_profile_without_samples_not_rejected(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    b.resource([b.profile([], time_ns=now_ns())], {"service.name": "svc-a"})
+    resp = ingest_json(client, prof_stream, to_json(b.model()))
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    assert prof_stream not in profiles_streams(client)
+
+
+def test_ing39_empty_request_bodies(client: OpenObserveClient, prof_stream: str):
+    for body in ({}, {"resourceProfiles": []}):
+        resp = ingest_json(client, prof_stream, body)
+        assert resp.status_code == 200, f"{body} -> {resp.text}"
+        assert resp.json() == {}
+    assert prof_stream not in profiles_streams(client)
+
+
+def test_ing40_ingestion_passcode_auth(client: OpenObserveClient, prof_stream: str):
+    resp = client.get("passcode")
+    assert resp.status_code == 200, resp.text
+    data = resp.json()["data"]
+    body = json.dumps(to_json(simple_request(A_STACKS)))
+    resp = requests.post(
+        client.url("v1/profiles"),
+        data=body,
+        auth=(data["user"], data["passcode"]),
+        headers={"Content-Type": "application/json", "stream-name": prof_stream},
+        timeout=30,
+    )
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_ing41_no_auth(client: OpenObserveClient, prof_stream: str):
+    resp = requests.post(
+        client.url("v1/profiles"),
+        data=json.dumps(to_json(simple_request(A_STACKS))),
+        headers={"Content-Type": "application/json", "stream-name": prof_stream},
+        timeout=30,
+    )
+    assert resp.status_code == 401, resp.text
+    assert prof_stream not in profiles_streams(client)
+
+
+def test_ing42_wrong_password(client: OpenObserveClient, prof_stream: str):
+    resp = requests.post(
+        client.url("v1/profiles"),
+        data=json.dumps(to_json(simple_request(A_STACKS))),
+        auth=(client.email, "wrong-password"),
+        headers={"Content-Type": "application/json", "stream-name": prof_stream},
+        timeout=30,
+    )
+    assert resp.status_code == 401, resp.text
+    assert prof_stream not in profiles_streams(client)
+
+
+def test_ing43_values_sum_saturates(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["sat_leaf"], values=[9223372036854775807, 1])]))
+    assert wait_rows(client, prof_stream, 1)[0]["value"] == 9223372036854775807
+
+
+def test_ing44_negative_value_kept(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    ingest_ok(client, prof_stream, _one_profile(b, [b.sample(["neg_leaf"], values=[-5])]))
+    assert wait_rows(client, prof_stream, 1)[0]["value"] == -5
+
+
+# Product bug: profiles never apply ZO_COLS_PER_RECORD_LIMIT; strict xfail turns red once o2-enterprise#3123 fixes it, then drop the marker.
+@pytest.mark.xfail(strict=True, reason="Known product bug o2-enterprise#3123: profiles ignore ZO_COLS_PER_RECORD_LIMIT")
+def test_ing45_too_many_columns_rejected(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    attrs = {f"extra.attr_{i:04d}": f"v{i}" for i in range(1010)}
+    resp = ingest_json(client, prof_stream, to_json(_one_profile(b, [b.sample(["wide_leaf"], values=[1])], attrs)))
+    assert resp.status_code == 400, resp.text[:500]
+    assert resp.json()["code"] == 3
+    assert "ZO_COLS_PER_RECORD_LIMIT" in resp.json()["message"]
+
+
+def test_ing47_first_write_to_new_stream_succeeds(client: OpenObserveClient, prof_stream: str):
+    assert prof_stream not in profiles_streams(client)
+    resp = ingest_proto(client, prof_stream, simple_request(A_STACKS))
+    assert resp.status_code == 200, f"first write to a new stream must not fail (#15956): {resp.text}"
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_ing48_two_profile_types_in_one_resource(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    b.resource(
+        [
+            b.profile(b.stacks_samples([(["cpu_leaf", "m_root"], 700)]), time_ns=t),
+            b.profile(
+                b.stacks_samples([(["alloc_leaf", "m_root"], 4096)]), type_="alloc_space", unit="bytes", time_ns=t
+            ),
+        ],
+        {"service.name": "svc-a"},
+    )
+    ingest_ok(client, prof_stream, b.model())
+    w = recent_window()
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 700)
+    alloc = wait_merge_total(client, prof_stream, recent_window(profile_type="alloc_space", profile_unit="bytes"), 4096)
+    assert alloc["unit"] == "bytes"
+    assert [t["name"] for t in alloc["top"]] == ["alloc_leaf", "m_root"]
+    meta = query(
+        client, prof_stream, "meta", method="GET", params={"start_time": w["start_time"], "end_time": w["end_time"]}
+    )
+    assert meta.status_code == 200, meta.text
+    assert meta.json()["profile_types"] == [
+        {"type": "alloc_space", "unit": "bytes"},
+        {"type": "cpu", "unit": "nanoseconds"},
+    ]
diff --git a/tests/api-testing/tests/profiles/test_profiles_limits.py b/tests/api-testing/tests/profiles/test_profiles_limits.py
new file mode 100644
index 0000000000..7320b86e17
--- /dev/null
+++ b/tests/api-testing/tests/profiles/test_profiles_limits.py
@@ -0,0 +1,50 @@
+"""Profiles result-size limit: more than 99 999 unique stacks marks merge and diff `truncated` (feature §3.5, §3.7)."""
+
+from __future__ import annotations
+
+import pytest
+
+from support.client import OpenObserveClient
+
+from .profiles_helpers import (
+    NS,
+    ProfilesBuilder,
+    child,
+    cpu,
+    ingest_proto,
+    now_ns,
+    query,
+    recent_window,
+    wait_merge_total,
+)
+
+LIGHT_STACKS = 100_000
+HEAVY_VALUE = 1_000_000
+TOTAL = LIGHT_STACKS + HEAVY_VALUE
+RESULT_SIZE = 99_999
+
+
+@pytest.mark.slow
+def test_lim01_more_unique_stacks_than_result_size(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    samples = [b.sample([f"lim_{i:06d}", "lim_root"], values=[1]) for i in range(LIGHT_STACKS)]
+    samples.append(b.sample(["heavy_leaf", "lim_root"], values=[HEAVY_VALUE]))
+    b.resource([b.profile(samples, time_ns=now_ns() - 60 * NS)], {"service.name": "svc-lim"})
+    resp = ingest_proto(client, prof_stream, b.model(), timeout=180)
+    assert resp.status_code == 200, resp.text[:500]
+    assert resp.content == b""
+
+    # A debug build needs ~35 s to merge 100k unique stacks.
+    body = wait_merge_total(client, prof_stream, recent_window(**cpu()), TOTAL, timeout=240, request_timeout=180)
+    assert body["truncated"] is True
+    assert body["total"] == TOTAL
+    assert body["merged_total"] == HEAVY_VALUE + RESULT_SIZE - 1
+    assert child(child(body["root"], "lim_root"), "heavy_leaf")["self"] == HEAVY_VALUE
+    assert body["top"][0] == {"name": "heavy_leaf", "self": HEAVY_VALUE, "total": HEAVY_VALUE}
+
+    side = recent_window(**cpu())
+    resp = query(client, prof_stream, "diff", {"baseline": side, "comparison": side}, timeout=240)
+    assert resp.status_code == 200, resp.text[:500]
+    diff = resp.json()
+    assert diff["truncated"] is True
+    assert diff["baseline_total"] == diff["comparison_total"] == TOTAL
diff --git a/tests/api-testing/tests/profiles/test_profiles_merge.py b/tests/api-testing/tests/profiles/test_profiles_merge.py
new file mode 100644
index 0000000000..da1fb549c5
--- /dev/null
+++ b/tests/api-testing/tests/profiles/test_profiles_merge.py
@@ -0,0 +1,379 @@
+"""Profiles `merge` API: call tree, top functions, max_nodes cut, depth cap, native folding, filters, errors (feature §3.5)."""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+import requests
+
+from support.client import OpenObserveClient
+
+from .profiles_helpers import (
+    ALL_CPU_TOTAL,
+    CATALOG_TOTAL,
+    CHECKOUT_TOTAL,
+    MIB,
+    NS,
+    PAYMENTS,
+    SPAN_ID,
+    TRACE_ID,
+    XSS,
+    ProfilesBuilder,
+    RefData,
+    assert_tree_sums,
+    child,
+    count_nodes,
+    cpu,
+    ingest_ok,
+    merge,
+    merge_ok,
+    native_model,
+    now_ns,
+    query,
+    recent_window,
+    simple_request,
+    snapshot_model,
+    wait_merge_total,
+    wait_rows,
+)
+
+MAX_MAX_NODES = 16_384
+CHECKOUT_TOP = [
+    {"name": "db_query", "self": 6_000_000_000, "total": 6_000_000_000},
+    {"name": "json_encode", "self": 4_000_000_000, "total": 4_000_000_000},
+    {"name": "handle_order", "self": 1_500_000_000, "total": 11_850_000_000},
+    {"name": "process_payment", "self": 250_000_000, "total": 250_000_000},
+    {"name": "gc_sweep", "self": 150_000_000, "total": 150_000_000},
+    {"name": XSS, "self": 100_000_000, "total": 100_000_000},
+    {"name": "main", "self": 0, "total": 11_850_000_000},
+    {"name": "runtime_main", "self": 0, "total": 150_000_000},
+]
+
+
+def _checkout(ref: RefData, **extra) -> dict:
+    return ref.win(**cpu(service_name="checkout", **extra))
+
+
+def _catalog(ref: RefData, **extra) -> dict:
+    return ref.win(**cpu(service_name="catalog", **extra))
+
+
+def _names(node: dict) -> list[str]:
+    return sorted(c["name"] for c in node.get("children") or [])
+
+
+def _walk(node: dict):
+    yield node
+    for c in node.get("children") or []:
+        yield from _walk(c)
+
+
+def _assert_400(resp: requests.Response, message: str) -> None:
+    assert resp.status_code == 400, f"{resp.status_code} {resp.text}"
+    assert resp.json()["message"] == message
+
+
+def _ingest_stacks(client: OpenObserveClient, stream: str, stacks: list[tuple[list[str], int]], total: int) -> dict:
+    ingest_ok(client, stream, simple_request(stacks))
+    return wait_merge_total(client, stream, recent_window(**cpu()), total)
+
+
+def test_mrg01_checkout_totals(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, _checkout(ref))
+    assert body["total"] == body["merged_total"] == CHECKOUT_TOTAL
+    assert body["truncated"] is False
+    assert body["tree_truncated"] is False
+    assert (body["unit"], body["profile_type"]) == ("nanoseconds", "cpu")
+
+
+def test_mrg02_tree_shape(client: OpenObserveClient, ref: RefData):
+    root = merge_ok(client, ref.stream, _checkout(ref))["root"]
+    assert (root["name"], root["total"], root["self"]) == ("total", CHECKOUT_TOTAL, 0)
+    assert _names(root) == ["main", "runtime_main"]
+    assert child(root, "main")["total"] == 11_850_000_000
+    assert child(root, "runtime_main")["total"] == 150_000_000
+    order = child(child(root, "main"), "handle_order")
+    assert (order["total"], order["self"]) == (11_850_000_000, 1_500_000_000)
+    totals = {c["name"]: c["total"] for c in order["children"]}
+    assert totals == {
+        "db_query": 6_000_000_000,
+        "json_encode": 4_000_000_000,
+        "process_payment": 250_000_000,
+        XSS: 100_000_000,
+    }
+    assert child(child(root, "runtime_main"), "gc_sweep")["self"] == 150_000_000
+    assert_tree_sums(root)
+
+
+def test_mrg03_top_exact_and_ordered(client: OpenObserveClient, ref: RefData):
+    top = merge_ok(client, ref.stream, _checkout(ref))["top"]
+    assert top == CHECKOUT_TOP
+
+
+def test_mrg04_top_tie_break(client: OpenObserveClient, prof_stream: str):
+    body = _ingest_stacks(client, prof_stream, [(["a"], 5), (["b"], 5), (["bc", "b"], 4), (["c"], 5)], 19)
+    assert [(t["name"], t["self"], t["total"]) for t in body["top"]] == [
+        ("b", 5, 9),
+        ("a", 5, 5),
+        ("c", 5, 5),
+        ("bc", 4, 4),
+    ]
+
+
+def test_mrg05_recursion_counted_once(client: OpenObserveClient, prof_stream: str):
+    body = _ingest_stacks(client, prof_stream, [(["f", "g", "f", "main"], 10)], 10)
+    assert {t["name"]: (t["self"], t["total"]) for t in body["top"]} == {"f": (10, 10), "g": (0, 10), "main": (0, 10)}
+
+
+def test_mrg06_get_equals_post(client: OpenObserveClient, ref: RefData):
+    post = merge_ok(client, ref.stream, _checkout(ref))
+    resp = query(client, ref.stream, "merge", method="GET", params=_checkout(ref))
+    assert resp.status_code == 200, resp.text
+    get = resp.json()
+    assert (get["root"], get["total"], get["top"]) == (post["root"], post["total"], post["top"])
+
+
+@pytest.mark.parametrize("ptype", list(PAYMENTS))
+def test_mrg07_payments_per_type(client: OpenObserveClient, ref: RefData, ptype: str):
+    total, unit = PAYMENTS[ptype]
+    body = merge_ok(client, ref.stream, ref.win(service_name="payments", profile_type=ptype, profile_unit=unit))
+    assert (body["total"], body["unit"], body["profile_type"]) == (total, unit, ptype)
+
+
+def test_mrg08_all_services_cpu(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, ref.win(**cpu()))
+    assert body["total"] == ALL_CPU_TOTAL
+    assert _names(body["root"]) == ["[truncated]", "catalog_main", "main", "runtime_main"]
+
+
+def test_mrg09_filters_are_anded(client: OpenObserveClient, ref: RefData):
+    v15 = {"key": "service_version", "value": "v1.5.0"}
+    assert merge_ok(client, ref.stream, _checkout(ref, filters=[v15]))["total"] == 8_000_000_000
+    prod = {"key": "deployment_environment", "value": "prod"}
+    assert merge_ok(client, ref.stream, _checkout(ref, filters=[v15, prod]))["total"] == 7_850_000_000
+
+
+def test_mrg10_dotted_key_default_op(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, _checkout(ref, filters=[{"key": "service.version", "value": "v1.4.0"}]))
+    assert body["total"] == 4_000_000_000
+
+
+def test_mrg11_get_filters_list(client: OpenObserveClient, ref: RefData):
+    params = _checkout(ref, filters="service_version=v1.4.0,deployment_environment=prod")
+    resp = query(client, ref.stream, "merge", method="GET", params=params)
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["total"] == 4_000_000_000
+
+
+def test_mrg12_two_values_of_one_label_is_empty(client: OpenObserveClient, ref: RefData):
+    filters = [{"key": "service_version", "value": "v1.4.0"}, {"key": "service_version", "value": "v1.5.0"}]
+    body = merge_ok(client, ref.stream, _checkout(ref, filters=filters))
+    assert (body["total"], body["top"]) == (0, [])
+
+
+def test_mrg13_trace_and_span_filter(client: OpenObserveClient, ref: RefData):
+    filters = [{"key": "trace_id", "value": TRACE_ID}, {"key": "span_id", "value": SPAN_ID}]
+    body = merge_ok(client, ref.stream, _checkout(ref, filters=filters))
+    assert body["total"] == 250_000_000
+    node, path = body["root"], []
+    while node.get("children"):
+        assert len(node["children"]) == 1, node["children"]
+        node = node["children"][0]
+        path.append(node["name"])
+    assert path == ["main", "handle_order", "process_payment"]
+    assert node["self"] == 250_000_000
+
+
+def test_mrg14_quoted_filter_value_is_safe(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, _checkout(ref, filters=[{"key": "service_version", "value": "v1' OR '1'='1"}]))
+    assert (body["total"], body["top"]) == (0, [])
+
+
+def test_mrg15_max_nodes_50(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, _catalog(ref, max_nodes=50))
+    assert count_nodes(body["root"]) == 50
+    assert (body["tree_truncated"], body["truncated"], body["total"]) == (True, False, CATALOG_TOTAL)
+    others = [n for n in _walk(body["root"]) if n["name"] == "other"]
+    assert others, "a cut tree folds dropped siblings into an `other` node"
+    for node in _walk(body["root"]):
+        assert [c["name"] for c in node.get("children") or []].count("other") <= 1
+    for node in others:
+        assert node["self"] == node["total"]
+        assert not node.get("children")
+    assert_tree_sums(body["root"])
+
+
+def test_mrg16_max_nodes_3(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, _catalog(ref, max_nodes=3))
+    # Both root children have children, and keeping one also reserves a slot for its own `other`: 4 > 3.
+    assert [(c["name"], c["total"]) for c in body["root"]["children"]] == [("other", CATALOG_TOTAL)]
+    assert (body["tree_truncated"], body["total"]) == (True, CATALOG_TOTAL)
+    assert_tree_sums(body["root"])
+
+
+@pytest.mark.parametrize("max_nodes", [0, 1])
+def test_mrg17_max_nodes_clamped_to_minimal_tree(client: OpenObserveClient, ref: RefData, max_nodes: int):
+    body = merge_ok(client, ref.stream, _catalog(ref, max_nodes=max_nodes))
+    assert body["tree_truncated"] is True
+    assert [(c["name"], c["total"]) for c in body["root"]["children"]] == [("other", CATALOG_TOTAL)]
+
+
+def test_mrg18_max_nodes_clamped_to_maximum(client: OpenObserveClient, prof_stream: str):
+    body = _ingest_stacks(client, prof_stream, [([f"mx_{i:05d}", "mx_root"], 1) for i in range(20_000)], 20_000)
+    assert count_nodes(body["root"]) == 2048
+    clamped = merge_ok(client, prof_stream, recent_window(**cpu(max_nodes=999_999)))
+    assert count_nodes(clamped["root"]) == MAX_MAX_NODES
+    assert clamped["tree_truncated"] is True
+    assert clamped["total"] == 20_000
+    assert_tree_sums(clamped["root"])
+
+
+def test_mrg18_full_tree_under_maximum_not_cut(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, _catalog(ref, max_nodes=999_999))
+    assert count_nodes(body["root"]) == 1303
+    assert body["tree_truncated"] is False
+
+
+def test_mrg19_default_max_nodes_2048(client: OpenObserveClient, prof_stream: str):
+    body = _ingest_stacks(client, prof_stream, [([f"wide_fn_{i:04d}", "wide_root"], 1) for i in range(3000)], 3000)
+    assert count_nodes(body["root"]) == 2048
+    assert body["tree_truncated"] is True
+    assert len(body["top"]) == 3001
+
+
+def test_mrg20_deep_stack_chain(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, _catalog(ref))
+    node = child(body["root"], "[truncated]")
+    assert node["total"] == 1_000_000_000
+    for i in range(998, -1, -1):
+        node = child(node, f"deep_{i:04d}")
+    assert (node["self"], node.get("children")) == (1_000_000_000, None)
+    assert body["top"][0] == {"name": "deep_0000", "self": 1_000_000_000, "total": 1_000_000_000}
+    assert "[truncated]" not in {t["name"] for t in body["top"]}
+
+
+def test_mrg21_wide_set(client: OpenObserveClient, ref: RefData):
+    body = merge_ok(client, ref.stream, _catalog(ref))
+    wide = child(child(body["root"], "catalog_main"), "wide_root")
+    assert len(wide["children"]) == 300
+    assert wide["total"] == 4_515_000_000
+    assert len(body["top"]) == 1301
+
+
+def test_mrg22_native_frames_folded(client: OpenObserveClient, prof_stream: str):
+    ingest_ok(client, prof_stream, native_model())
+    body = wait_merge_total(client, prof_stream, recent_window(**cpu()), 9)
+    folded = child(child(body["root"], "a9_root"), "[libqa.so.1]")
+    assert (folded["self"], folded.get("children")) == (9, None)
+    assert body["top"] == [{"name": "[libqa.so.1]", "self": 9, "total": 9}, {"name": "a9_root", "self": 0, "total": 9}]
+
+
+def test_mrg23_native_frames_from_two_binaries(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    lib_a = b.mapping("/opt/libA.so", 0x1000)
+    lib_b = b.mapping("/opt/libB.so", 0x9000)
+    locs = [b.loc_raw(mapping_index=lib_a, address=0x1100), b.loc_raw(mapping_index=lib_b, address=0x9100)]
+    stack = b.stack_locs([*locs, b.loc_fn("root23")])
+    b.resource([b.profile([b.sample(stack=stack, values=[4])], time_ns=now_ns() - 60 * NS)], {"service.name": "svc-a"})
+    ingest_ok(client, prof_stream, b.model())
+    body = wait_merge_total(client, prof_stream, recent_window(**cpu()), 4)
+    lib_b_node = child(child(body["root"], "root23"), "[libB.so]")
+    assert child(lib_b_node, "[libA.so]")["self"] == 4
+
+
+def test_mrg25_zero_value_stacks_skipped(client: OpenObserveClient, prof_stream: str):
+    body = _ingest_stacks(client, prof_stream, [(["zero_leaf", "zr"], 0), (["five_leaf", "zr"], 5)], 5)
+    assert _names(child(body["root"], "zr")) == ["five_leaf"]
+    assert {t["name"] for t in body["top"]} == {"five_leaf", "zr"}
+
+
+def test_mrg26_empty_stack_credited_to_root(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    b.resource(
+        [b.profile([b.sample(stack=0, values=[5]), b.sample(["es_leaf"], values=[10])], time_ns=now_ns() - 60 * NS)],
+        {"service.name": "svc-a"},
+    )
+    ingest_ok(client, prof_stream, b.model())
+    body = wait_merge_total(client, prof_stream, recent_window(**cpu()), 15)
+    assert body["root"]["self"] == 5
+    assert _names(body["root"]) == ["es_leaf"]
+
+
+def test_mrg27_inuse_snapshots_averaged(client: OpenObserveClient, prof_stream: str):
+    minute = (now_ns() - 3 * 60 * NS) // (60 * NS) * 60 * NS
+    ingest_ok(client, prof_stream, snapshot_model(minute))
+    wait_rows(client, prof_stream, 2)
+    body = merge_ok(client, prof_stream, recent_window(profile_type="inuse_space", profile_unit="bytes"))
+    assert (body["total"], body["unit"]) == (2 * MIB, "bytes")
+
+
+def test_mrg28_empty_window(client: OpenObserveClient, ref: RefData, empty_window: dict):
+    body = merge_ok(client, ref.stream, {**empty_window, **cpu(service_name="checkout")})
+    assert (body["total"], body["top"]) == (0, [])
+    assert "children" not in body["root"]
+
+
+MRG29_CASES = [
+    ("type", {"profile_type": None}, "profile_type is required"),
+    ("unit", {"profile_unit": None}, "profile_unit is required"),
+    ("start-eq-end", {"start_time": "END"}, "start_time must be less than end_time"),
+    ("no-start", {"start_time": None}, "start_time and end_time are required (microseconds)"),
+    ("op", {"filters": [{"key": "host_name", "op": "!=", "value": "x"}]}, "only filter op '=' is supported"),
+    ("key-stack", {"filters": [{"key": "stack", "value": "x"}]}, "invalid filter key: stack"),
+    ("key-unsafe", {"filters": [{"key": "a;b", "value": "x"}]}, "invalid filter key: a;b"),
+    ("key-129", {"filters": [{"key": "a" * 129, "value": "x"}]}, f"invalid filter key: {'a' * 129}"),
+    ("timeout", {"timeout": 0}, "Invalid timeout parameter"),
+]
+
+
+@pytest.mark.parametrize(
+    ("change", "message"), [c[1:] for c in MRG29_CASES], ids=[f"mrg29-{c[0]}" for c in MRG29_CASES]
+)
+def test_mrg29_validation_errors(client: OpenObserveClient, ref: RefData, change: dict, message: str):
+    body = _checkout(ref)
+    for key, value in change.items():
+        if value is None:
+            del body[key]
+        else:
+            body[key] = body["end_time"] if value == "END" else value
+    _assert_400(merge(client, ref.stream, body), message)
+
+
+def test_mrg29_unknown_filter_column(client: OpenObserveClient, ref: RefData):
+    resp = merge(client, ref.stream, _checkout(ref, filters=[{"key": "no_such_col", "value": "x"}]))
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["code"] == 20004
+    assert "unknown field 'no_such_col'" in resp.json()["message"]
+
+
+def test_mrg29_malformed_json(client: OpenObserveClient, ref: RefData):
+    resp = client.post(
+        f"{ref.stream}/profiles/merge", data='{"start_time":', headers={"Content-Type": "application/json"}
+    )
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["message"].startswith("Failed to parse the request body as JSON"), resp.text
+
+
+def test_mrg30_negative_max_nodes(client: OpenObserveClient, ref: RefData):
+    resp = merge(client, ref.stream, _checkout(ref, max_nodes=-1))
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["message"].startswith("Failed to deserialize the JSON body"), resp.text
+
+
+def test_mrg32_unknown_stream(client: OpenObserveClient, ref: RefData):
+    stream = f"no_such_{uuid.uuid4().hex[:8]}"
+    resp = merge(client, stream, _checkout(ref))
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["code"] == 20002
+    assert resp.json()["message"] == f"Search stream not found: {stream}"
+
+
+def test_mrg33_wrong_method(client: OpenObserveClient, ref: RefData):
+    resp = query(client, ref.stream, "merge", _checkout(ref), method="PUT")
+    assert resp.status_code == 405, resp.text
+
+
+def test_mrg34_no_auth(client: OpenObserveClient, ref: RefData):
+    resp = requests.post(client.url(f"{ref.stream}/profiles/merge"), json=_checkout(ref), timeout=30)
+    assert resp.status_code == 401, resp.text
diff --git a/tests/api-testing/tests/profiles/test_profiles_meta_tag_values.py b/tests/api-testing/tests/profiles/test_profiles_meta_tag_values.py
new file mode 100644
index 0000000000..dd277b9257
--- /dev/null
+++ b/tests/api-testing/tests/profiles/test_profiles_meta_tag_values.py
@@ -0,0 +1,261 @@
+"""Profiles `meta` and `tag_values` query APIs on the reference dataset (feature §3.2, §3.3)."""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+import requests
+
+from support.client import OpenObserveClient
+
+from .profiles_helpers import (
+    MIN_US,
+    TRACE_ID,
+    US,
+    ProfilesBuilder,
+    RefData,
+    ingest_ok,
+    now_ns,
+    query,
+    recent_window,
+    wait_rows,
+)
+
+SERVICES = ["catalog", "checkout", "payments"]
+ALL_TYPES = [
+    {"type": "alloc_space", "unit": "bytes"},
+    {"type": "cpu", "unit": "nanoseconds"},
+    {"type": "inuse_space", "unit": "bytes"},
+]
+CPU_ONLY = [{"type": "cpu", "unit": "nanoseconds"}]
+EXPECTED_LABELS = {
+    "deployment_environment",
+    "host_name",
+    "service_instance_id",
+    "service_version",
+    "span_id",
+    "trace_id",
+}
+NOT_LABELS = {
+    "stack",
+    "value",
+    "service_name",
+    "profile_type",
+    "profile_unit",
+    "frame_count",
+    "extractor_version",
+    "profile_duration_nanos",
+    "duration_nanos",
+    "_timestamp",
+}
+
+
+def _params(w: dict, **extra) -> dict:
+    return {"start_time": w["start_time"], "end_time": w["end_time"], **extra}
+
+
+def _meta(client: OpenObserveClient, stream: str, params: dict) -> requests.Response:
+    return query(client, stream, "meta", method="GET", params=params)
+
+
+def _meta_ok(client: OpenObserveClient, stream: str, params: dict) -> dict:
+    resp = _meta(client, stream, params)
+    assert resp.status_code == 200, resp.text
+    return resp.json()
+
+
+def _tags(client: OpenObserveClient, stream: str, params: dict) -> requests.Response:
+    return query(client, stream, "tag_values", method="GET", params=params)
+
+
+def _tag_values(client: OpenObserveClient, ref: RefData, **params) -> dict:
+    resp = _tags(client, ref.stream, _params(ref.win(), **params))
+    assert resp.status_code == 200, resp.text
+    return resp.json()
+
+
+def _assert_400(resp: requests.Response, message: str) -> None:
+    assert resp.status_code == 400, f"{resp.status_code} {resp.text}"
+    assert resp.json()["message"] == message
+
+
+def test_meta01_lists_services_types_labels(client: OpenObserveClient, ref: RefData):
+    body = _meta_ok(client, ref.stream, _params(ref.win()))
+    assert body["services"] == SERVICES
+    assert body["profile_types"] == ALL_TYPES
+    assert body["data_sources"] == []
+    labels = set(body["label_names"])
+    assert EXPECTED_LABELS <= labels, labels
+    assert not labels & NOT_LABELS, labels & NOT_LABELS
+    assert body["label_names"] == sorted(body["label_names"])
+
+
+@pytest.mark.parametrize(("service", "types"), [("checkout", CPU_ONLY), ("payments", ALL_TYPES), ("catalog", CPU_ONLY)])
+def test_meta02_types_scoped_to_service(client: OpenObserveClient, ref: RefData, service: str, types: list):
+    body = _meta_ok(client, ref.stream, _params(ref.win(), service_name=service))
+    assert body["profile_types"] == types
+    assert body["services"] == SERVICES
+
+
+def test_meta03_unknown_service(client: OpenObserveClient, ref: RefData):
+    body = _meta_ok(client, ref.stream, _params(ref.win(), service_name="nope"))
+    assert body["profile_types"] == []
+    assert body["services"] == SERVICES
+
+
+def test_meta04_empty_window_keeps_schema_labels(client: OpenObserveClient, ref: RefData, empty_window: dict):
+    full = _meta_ok(client, ref.stream, _params(ref.win()))
+    body = _meta_ok(client, ref.stream, _params(empty_window))
+    assert body["services"] == []
+    assert body["profile_types"] == []
+    assert body["label_names"] == full["label_names"]
+
+
+def test_meta05_narrow_window(client: OpenObserveClient, ref: RefData):
+    c2 = ref.t0_us + 4 * MIN_US
+    body = _meta_ok(client, ref.stream, {"start_time": c2 - US, "end_time": c2 + 30 * US})
+    assert body["services"] == ["checkout"]
+    assert body["profile_types"] == CPU_ONLY
+
+
+@pytest.mark.parametrize(
+    ("params", "message"),
+    [
+        ({"end_time": 2_000_000}, "start_time is required"),
+        ({"start_time": 1_000_000}, "end_time is required"),
+        ({"start_time": "abc", "end_time": 2_000_000}, "Invalid start_time parameter"),
+        ({"start_time": 2_000_000, "end_time": 2_000_000}, "start_time must be less than end_time"),
+        ({"start_time": 3_000_000, "end_time": 2_000_000}, "start_time must be less than end_time"),
+        ({"start_time": 0, "end_time": 2_000_000}, "start_time and end_time are required (microseconds)"),
+    ],
+    ids=["meta06-no-start", "meta07-no-end", "meta08-bad-start", "meta09-equal", "meta10-reversed", "meta11-zero"],
+)
+def test_meta06_11_time_errors(client: OpenObserveClient, ref: RefData, params: dict, message: str):
+    _assert_400(_meta(client, ref.stream, params), message)
+
+
+def test_meta12_timeout_zero(client: OpenObserveClient, ref: RefData):
+    _assert_400(_meta(client, ref.stream, _params(ref.win(), timeout=0)), "Invalid timeout parameter")
+
+
+def test_meta13_unknown_stream_is_empty(client: OpenObserveClient, ref: RefData):
+    body = _meta_ok(client, f"no_such_{uuid.uuid4().hex[:8]}", _params(ref.win()))
+    assert (body["services"], body["profile_types"], body["label_names"], body["data_sources"]) == ([], [], [], [])
+
+
+def test_meta15_no_auth(client: OpenObserveClient, ref: RefData):
+    resp = requests.get(client.url(f"{ref.stream}/profiles/meta"), params=_params(ref.win()), timeout=30)
+    assert resp.status_code == 401, resp.text
+
+
+def test_tag01_values_of_service_version(client: OpenObserveClient, ref: RefData):
+    body = _tag_values(client, ref, tag="service_version")
+    assert body["tag"] == "service_version"
+    assert body["values"] == ["v1.4.0", "v1.5.0"]
+
+
+def test_tag02_narrowed_by_other_filter(client: OpenObserveClient, ref: RefData):
+    body = _tag_values(client, ref, tag="deployment_environment", filters="service_version=v1.4.0")
+    assert body["values"] == ["prod"]
+
+
+def test_tag03_own_tag_filter_ignored(client: OpenObserveClient, ref: RefData):
+    assert _tag_values(client, ref, tag="service_version", filters="service_version=v1.4.0")["values"] == [
+        "v1.4.0",
+        "v1.5.0",
+    ]
+
+
+def test_tag04_dotted_tag_normalised(client: OpenObserveClient, ref: RefData):
+    body = _tag_values(client, ref, tag="service.version")
+    assert body["tag"] == "service_version"
+    assert body["values"] == ["v1.4.0", "v1.5.0"]
+
+
+def test_tag05_field_alias(client: OpenObserveClient, ref: RefData):
+    body = _tag_values(client, ref, field="host_name")
+    assert body["tag"] == "host_name"
+    assert body["values"] == [f"host-{c}" for c in "abcdef"]
+
+
+def test_tag06_narrowed_by_service_and_type(client: OpenObserveClient, ref: RefData):
+    body = _tag_values(
+        client, ref, tag="host_name", service_name="payments", profile_type="inuse_space", profile_unit="bytes"
+    )
+    assert body["values"] == ["host-d", "host-e"]
+
+
+@pytest.mark.parametrize(
+    "tag",
+    ["service_name", "profile_type", "otel_scope_name"],
+    ids=["tag07-service_name", "tag08-profile_type", "tag08-otel_scope_name"],
+)
+def test_tag07_08_meta_dimensions_rejected(client: OpenObserveClient, ref: RefData, tag: str):
+    _assert_400(
+        _tags(client, ref.stream, _params(ref.win(), tag=tag)),
+        f"tag {tag} is provided by /profiles/meta; use tag_values only for Tags Filter keys",
+    )
+
+
+def test_tag09_missing_tag(client: OpenObserveClient, ref: RefData):
+    _assert_400(_tags(client, ref.stream, _params(ref.win())), "tag is required")
+
+
+@pytest.mark.parametrize(
+    "tag",
+    ["stack", "value", "_timestamp", "a;b", "a" * 129],
+    ids=["tag10-stack", "tag10-value", "tag10-_timestamp", "tag11-semicolon", "tag11-129-chars"],
+)
+def test_tag10_11_reserved_or_unsafe_tag(client: OpenObserveClient, ref: RefData, tag: str):
+    _assert_400(
+        _tags(client, ref.stream, _params(ref.win(), tag=tag)),
+        f"tag must be a filterable profile tag column, got: {tag}",
+    )
+
+
+def test_tag12_unknown_column(client: OpenObserveClient, ref: RefData):
+    resp = _tags(client, ref.stream, _params(ref.win(), tag="no_such_col"))
+    assert resp.status_code == 400, resp.text
+    body = resp.json()
+    assert body["code"] == 20004, body
+    assert "unknown field 'no_such_col'" in body["message"], body
+
+
+def test_tag13_missing_start_time(client: OpenObserveClient, ref: RefData):
+    _assert_400(
+        _tags(client, ref.stream, {"tag": "host_name", "end_time": ref.win()["end_time"]}), "start_time is required"
+    )
+
+
+def test_tag14_bad_filter_key(client: OpenObserveClient, ref: RefData):
+    _assert_400(
+        _tags(client, ref.stream, _params(ref.win(), tag="host_name", filters="stack=x")), "invalid filter key: stack"
+    )
+
+
+def test_tag15_unknown_stream(client: OpenObserveClient, ref: RefData):
+    stream = f"no_such_{uuid.uuid4().hex[:8]}"
+    resp = _tags(client, stream, _params(ref.win(), tag="host_name"))
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["code"] == 20002
+    assert resp.json()["message"] == f"Search stream not found: {stream}"
+
+
+def test_tag16_trace_id_values(client: OpenObserveClient, ref: RefData):
+    assert _tag_values(client, ref, tag="trace_id")["values"] == [TRACE_ID]
+
+
+def test_tag17_percent_encoded_filter_value(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60_000_000_000
+    for owner, host in (("a,b=c%d", "host-enc"), ("plain", "host-plain")):
+        b.resource(
+            [b.profile([b.sample([f"{host}_leaf"], values=[1])], time_ns=t)],
+            {"service.name": "svc-enc", "team.owner": owner, "host.name": host},
+        )
+    ingest_ok(client, prof_stream, b.model())
+    wait_rows(client, prof_stream, 2)
+    resp = _tags(client, prof_stream, _params(recent_window(), tag="host_name", filters="team_owner=a%2Cb%3Dc%25d"))
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["values"] == ["host-enc"]
diff --git a/tests/api-testing/tests/profiles/test_profiles_series.py b/tests/api-testing/tests/profiles/test_profiles_series.py
new file mode 100644
index 0000000000..52472a3b27
--- /dev/null
+++ b/tests/api-testing/tests/profiles/test_profiles_series.py
@@ -0,0 +1,361 @@
+"""Profiles `series` API: buckets, per-instance rate, inuse averaging, group_by and step rules (feature §3.4)."""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+import requests
+
+from support.client import OpenObserveClient
+
+from .profiles_helpers import (
+    CHECKOUT_TOTAL,
+    MIB,
+    NS,
+    SPAN_ID,
+    TRACE_ID,
+    US,
+    ProfilesBuilder,
+    RefData,
+    cpu,
+    ingest_ok,
+    merge_ok,
+    now_ns,
+    now_us,
+    query,
+    recent_window,
+    snapshot_model,
+    wait_merge_total,
+    wait_rows,
+    window,
+)
+
+INUSE = {"profile_type": "inuse_space", "profile_unit": "bytes"}
+
+
+def _series(client: OpenObserveClient, stream: str, body: dict) -> requests.Response:
+    return query(client, stream, "series", body)
+
+
+def _series_ok(client: OpenObserveClient, stream: str, body: dict) -> dict:
+    resp = _series(client, stream, body)
+    assert resp.status_code == 200, f"series {body} -> {resp.status_code} {resp.text[:500]}"
+    return resp.json()
+
+
+def _points(body: dict) -> list[tuple[int, float]]:
+    return [(p["timestamp"], p["value"]) for p in body["series"]]
+
+
+def _assert_400(resp: requests.Response, message: str) -> None:
+    assert resp.status_code == 400, f"{resp.status_code} {resp.text}"
+    assert resp.json()["message"] == message
+
+
+def _checkout(ref: RefData, **extra) -> dict:
+    return ref.win(**cpu(**{"service_name": "checkout", "step": "60", **extra}))
+
+
+def _snapshot_stream(client: OpenObserveClient, stream: str, threads: tuple[str, str] | None = None) -> int:
+    minute = (now_ns() - 3 * 60 * NS) // (60 * NS) * 60 * NS
+    ingest_ok(client, stream, snapshot_model(minute, threads))
+    return minute // 1000
+
+
+def test_ser01_checkout_cpu_step_60(client: OpenObserveClient, ref: RefData):
+    body = _series_ok(client, ref.stream, _checkout(ref))
+    assert (body["unit"], body["profile_type"], body["step_secs"]) == ("nanoseconds", "cpu", 60)
+    assert _points(body) == [(ref.bucket(0), 4.0e9), (ref.bucket(4), 7.85e9), (ref.bucket(6), 0.15e9)]
+    assert "groups" not in body
+    merged = merge_ok(client, ref.stream, ref.win(**cpu(service_name="checkout")))
+    assert sum(v for _, v in _points(body)) == merged["total"] == CHECKOUT_TOTAL
+
+
+def test_ser02_rate_per_second_of_profiled_time(client: OpenObserveClient, ref: RefData):
+    rates = [p["rate"] for p in _series_ok(client, ref.stream, _checkout(ref))["series"]]
+    assert rates == pytest.approx([4.0e8, 7.85e8, 1.5e7], rel=1e-9)
+
+
+def test_ser03_get_equals_post(client: OpenObserveClient, ref: RefData):
+    post = _series_ok(client, ref.stream, _checkout(ref))
+    resp = query(client, ref.stream, "series", method="GET", params=_checkout(ref))
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["series"] == post["series"]
+    assert resp.json()["step_secs"] == 60
+
+
+def test_ser04_query_params_fill_post_body(client: OpenObserveClient, ref: RefData):
+    body = _checkout(ref)
+    del body["profile_unit"]
+    resp = query(client, ref.stream, "series", body, params={"profile_unit": "nanoseconds"})
+    assert resp.status_code == 200, resp.text
+    assert resp.json()["unit"] == "nanoseconds"
+    assert resp.json()["series"] == _series_ok(client, ref.stream, _checkout(ref))["series"]
+
+
+def test_ser05_process_level_filter_keeps_rate(client: OpenObserveClient, ref: RefData):
+    body = _series_ok(client, ref.stream, _checkout(ref, filters=[{"key": "service_version", "value": "v1.5.0"}]))
+    assert _points(body) == [(ref.bucket(4), 7.85e9), (ref.bucket(6), 0.15e9)]
+    assert [p["rate"] for p in body["series"]] == pytest.approx([7.85e8, 1.5e7], rel=1e-9)
+
+
+def test_ser06_trace_filter_drops_rate(client: OpenObserveClient, ref: RefData):
+    filters = [{"key": "trace_id", "value": TRACE_ID}, {"key": "span_id", "value": SPAN_ID}]
+    body = _series_ok(client, ref.stream, _checkout(ref, filters=filters))
+    assert _points(body) == [(ref.bucket(4), 2.5e8)]
+    assert "rate" not in body["series"][0]
+
+
+def test_ser07_inuse_per_bucket_no_rate(client: OpenObserveClient, ref: RefData):
+    body = _series_ok(client, ref.stream, ref.win(service_name="payments", step="60", **INUSE))
+    assert body["unit"] == "bytes"
+    assert _points(body) == [(ref.bucket(2), 2 * MIB), (ref.bucket(5), 4 * MIB)]
+    assert all("rate" not in p for p in body["series"])
+
+
+def test_ser08_inuse_two_instances_in_one_bucket_summed(client: OpenObserveClient, ref: RefData):
+    t2, t5 = ref.t0_us + 2 * 60 * US, ref.t0_us + 5 * 60 * US
+    # Buckets are epoch-aligned, so pick a step with no bucket edge between the two profiles (e.g. at UTC midnight).
+    steps = [s for s in range(600, 86_400) if t2 // (s * US) == t5 // (s * US)]
+    assert steps, f"no step in 600..86399 s keeps {t2} and {t5} in one bucket"
+    step = steps[0]
+    body = _series_ok(client, ref.stream, ref.win(service_name="payments", step=str(step), **INUSE))
+    assert [v for _, v in _points(body)] == [6 * MIB]
+
+
+def test_ser09_inuse_snapshots_of_one_instance_averaged(client: OpenObserveClient, prof_stream: str):
+    bucket = _snapshot_stream(client, prof_stream)
+    wait_rows(client, prof_stream, 2)
+    body = _series_ok(client, prof_stream, recent_window(step="60", **INUSE))
+    assert _points(body) == [(bucket, 2 * MIB)]
+
+
+def test_ser19_inuse_group_by_uses_ungrouped_snapshot_count(client: OpenObserveClient, prof_stream: str):
+    bucket = _snapshot_stream(client, prof_stream, threads=("A", "B"))
+    wait_rows(client, prof_stream, 2)
+    body = _series_ok(client, prof_stream, recent_window(step="60", group_by="thread_name", **INUSE))
+    assert _points(body) == [(bucket, 2 * MIB)]
+    groups = {g["value"]: g for g in body["groups"]}
+    assert set(groups) == {"A", "B"}
+    assert groups["A"]["total"] == MIB / 2
+    assert groups["B"]["total"] == 3 * MIB / 2
+
+
+def test_ser10_group_by_service_version(client: OpenObserveClient, ref: RefData):
+    body = _series_ok(client, ref.stream, _checkout(ref, group_by="service_version"))
+    assert [(g["value"], g["total"], g["others"]) for g in body["groups"]] == [
+        ("v1.5.0", 8.0e9, False),
+        ("v1.4.0", 4.0e9, False),
+    ]
+    for g in body["groups"]:
+        assert sum(p["value"] for p in g["series"]) == g["total"]
+    assert sum(v for _, v in _points(body)) == CHECKOUT_TOTAL
+
+
+def test_ser11_group_by_dotted_key(client: OpenObserveClient, ref: RefData):
+    dotted = _series_ok(client, ref.stream, _checkout(ref, group_by="service.version"))
+    plain = _series_ok(client, ref.stream, _checkout(ref, group_by="service_version"))
+    assert dotted["groups"] == plain["groups"]
+
+
+@pytest.mark.parametrize("limit", [1, 0], ids=["ser12-limit-1", "ser13-limit-0-clamps"])
+def test_ser12_13_group_limit_folds_others(client: OpenObserveClient, ref: RefData, limit: int):
+    body = _series_ok(client, ref.stream, ref.win(**cpu(step="60", group_by="service_name", group_limit=limit)))
+    assert [(g["value"], g["total"], g["others"]) for g in body["groups"]] == [
+        ("checkout", 12.0e9, False),
+        ("", 9.015e9, True),
+    ]
+
+
+def test_ser14_group_limit_default_and_max(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    for i in range(52):
+        b.resource(
+            [b.profile([b.sample(["gl_leaf"], values=[(i + 1) * 10])], time_ns=t)],
+            {"service.name": "svc-gl", "service.version": f"v{i:02d}", "service.instance.id": f"gl-{i}"},
+        )
+    ingest_ok(client, prof_stream, b.model())
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 13_780)
+    default = _series_ok(client, prof_stream, recent_window(**cpu(group_by="service_version")))
+    assert [g["value"] for g in default["groups"]] == [f"v{i:02d}" for i in range(51, 41, -1)] + [""]
+    assert (default["groups"][-1]["others"], default["groups"][-1]["total"]) == (True, 9030.0)
+    capped = _series_ok(client, prof_stream, recent_window(**cpu(group_by="service_version", group_limit=51)))
+    assert [g["value"] for g in capped["groups"]] == [f"v{i:02d}" for i in range(51, 1, -1)] + [""]
+    assert [g["others"] for g in capped["groups"]] == [False] * 50 + [True]
+    assert capped["groups"][-1]["total"] == 30.0
+
+
+def test_ser15_rows_missing_label_form_empty_group(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    b.resource(
+        [b.profile([b.sample(["pod_leaf"], values=[5])], time_ns=t)], {"service.name": "svc-p", "k8s.pod.name": "pod-1"}
+    )
+    b.resource([b.profile([b.sample(["nopod_leaf"], values=[7])], time_ns=t)], {"service.name": "svc-p"})
+    ingest_ok(client, prof_stream, b.model())
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 12)
+    body = _series_ok(client, prof_stream, recent_window(**cpu(group_by="k8s_pod_name")))
+    assert [(g["value"], g["total"], g["others"]) for g in body["groups"]] == [("", 7.0, False), ("pod-1", 5.0, False)]
+
+
+def test_ser16_group_ties_ordered_by_value(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    for version in ("v-b", "v-a"):
+        b.resource(
+            [b.profile([b.sample(["tie_leaf"], values=[9])], time_ns=t)],
+            {"service.name": "svc-t", "service.version": version, "service.instance.id": version},
+        )
+    ingest_ok(client, prof_stream, b.model())
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 18)
+    body = _series_ok(client, prof_stream, recent_window(**cpu(group_by="service_version")))
+    assert [(g["value"], g["total"]) for g in body["groups"]] == [("v-a", 9.0), ("v-b", 9.0)]
+
+
+def test_ser17_group_by_unknown_column(client: OpenObserveClient, ref: RefData):
+    _assert_400(
+        _series(client, ref.stream, _checkout(ref, group_by="nonexistent_col")),
+        "unknown group_by column: nonexistent_col",
+    )
+
+
+@pytest.mark.parametrize("key", ["a;b", "stack"], ids=["ser18-unsafe", "ser18-reserved"])
+def test_ser18_group_by_unsafe_or_reserved(client: OpenObserveClient, ref: RefData, key: str):
+    _assert_400(_series(client, ref.stream, _checkout(ref, group_by=key)), f"invalid group_by: {key}")
+
+
+@pytest.mark.parametrize(("step", "secs"), [("60", 60), ("1 minute", 60), ("10 seconds", 10)])
+def test_ser20_explicit_step_forms(client: OpenObserveClient, ref: RefData, step: str, secs: int):
+    body = _series_ok(client, ref.stream, _checkout(ref, step=step))
+    assert body["step_secs"] == secs
+    assert sum(v for _, v in _points(body)) == CHECKOUT_TOTAL
+
+
+def test_ser20_auto_step_forms_agree(client: OpenObserveClient, ref: RefData):
+    base = ref.win(**cpu(service_name="checkout"))
+    auto = _series_ok(client, ref.stream, {**base, "step": "auto"})
+    assert auto["step_secs"] > 0
+    for variant in ({**base, "step": ""}, base):
+        body = _series_ok(client, ref.stream, variant)
+        assert (body["step_secs"], body["series"]) == (auto["step_secs"], auto["series"])
+
+
+@pytest.mark.parametrize(
+    ("step", "message"),
+    [("bad", "Invalid step: bad"), ("0", "step must be positive"), ("-5", "Invalid step: -5")],
+    ids=["ser21-bad", "ser22-zero", "ser23-negative"],
+)
+def test_ser21_23_invalid_step(client: OpenObserveClient, ref: RefData, step: str, message: str):
+    _assert_400(_series(client, ref.stream, _checkout(ref, step=step)), message)
+
+
+def _bucket_cap_message(n: int) -> str:
+    return (
+        f"step too fine for time range: estimated {n} histogram buckets exceeds max 99999; "
+        "increase step or narrow the time range"
+    )
+
+
+def test_ser24_bucket_cap(client: OpenObserveClient, ref: RefData):
+    end = now_us()
+    resp = _series(client, ref.stream, window(end - 7 * 24 * 3600 * US, end, **cpu(step="1")))
+    _assert_400(resp, _bucket_cap_message(604800))
+
+
+def test_ser25_bucket_cap_boundary(client: OpenObserveClient, ref: RefData):
+    end = now_us()
+    ok = _series_ok(client, ref.stream, window(end - 99_999 * US, end, **cpu(step="1", service_name="checkout")))
+    assert sum(v for _, v in _points(ok)) == CHECKOUT_TOTAL
+    _assert_400(
+        _series(client, ref.stream, window(end - 100_000 * US, end, **cpu(step="1"))), _bucket_cap_message(100000)
+    )
+
+
+@pytest.mark.parametrize(
+    ("drop", "message"),
+    [
+        ("profile_type", "profile_type is required"),
+        ("profile_unit", "profile_unit is required"),
+        ("start_time", "start_time and end_time are required (microseconds)"),
+    ],
+    ids=["ser26-type", "ser27-unit", "ser28-start-time"],
+)
+def test_ser26_28_missing_fields(client: OpenObserveClient, ref: RefData, drop: str, message: str):
+    body = _checkout(ref)
+    del body[drop]
+    _assert_400(_series(client, ref.stream, body), message)
+
+
+def test_ser29_start_equals_end(client: OpenObserveClient, ref: RefData):
+    _assert_400(
+        _series(client, ref.stream, window(ref.t0_us, ref.t0_us, **cpu())), "start_time must be less than end_time"
+    )
+
+
+def test_ser30_filter_op_not_equal(client: OpenObserveClient, ref: RefData):
+    resp = _series(client, ref.stream, _checkout(ref, filters=[{"key": "host_name", "op": "!=", "value": "x"}]))
+    _assert_400(resp, "only filter op '=' is supported")
+
+
+@pytest.mark.parametrize("key", ["stack", "a;b", "a" * 129], ids=["ser31-reserved", "ser31-unsafe", "ser31-129-chars"])
+def test_ser31_invalid_filter_key(client: OpenObserveClient, ref: RefData, key: str):
+    _assert_400(
+        _series(client, ref.stream, _checkout(ref, filters=[{"key": key, "value": "x"}])), f"invalid filter key: {key}"
+    )
+
+
+def test_ser32_filter_unknown_column(client: OpenObserveClient, ref: RefData):
+    resp = _series(client, ref.stream, _checkout(ref, filters=[{"key": "no_such_col", "value": "x"}]))
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["code"] == 20004
+    assert "unknown field 'no_such_col'" in resp.json()["message"]
+
+
+@pytest.mark.parametrize("timeout", [0, -5])
+def test_ser33_invalid_timeout(client: OpenObserveClient, ref: RefData, timeout: int):
+    _assert_400(_series(client, ref.stream, _checkout(ref, timeout=timeout)), "Invalid timeout parameter")
+
+
+def test_ser34_malformed_json_body(client: OpenObserveClient, ref: RefData):
+    resp = client.post(
+        f"{ref.stream}/profiles/series", data='{"start_time":', headers={"Content-Type": "application/json"}
+    )
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["message"].startswith("Failed to parse the request body as JSON"), resp.text
+
+
+def test_ser35_unknown_stream(client: OpenObserveClient, ref: RefData):
+    stream = f"no_such_{uuid.uuid4().hex[:8]}"
+    resp = _series(client, stream, _checkout(ref))
+    assert resp.status_code == 400, resp.text
+    assert resp.json()["code"] == 20002
+    assert resp.json()["message"] == f"Search stream not found: {stream}"
+
+
+def test_ser36_empty_window(client: OpenObserveClient, ref: RefData, empty_window: dict):
+    body = _series_ok(client, ref.stream, {**empty_window, **cpu(service_name="checkout", step="60")})
+    assert body["series"] == []
+
+
+def test_ser37_data_source_filter(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    b.resource(
+        [b.profile([b.sample(["py_leaf"], values=[11])], time_ns=t)], {"service.name": "svc-ds"}, scope_name="pyroscope"
+    )
+    b.resource(
+        [b.profile([b.sample(["eb_leaf"], values=[22])], time_ns=t)],
+        {"service.name": "svc-ds"},
+        scope_name="ebpf-profiler",
+    )
+    ingest_ok(client, prof_stream, b.model())
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 33)
+    body = _series_ok(client, prof_stream, recent_window(**cpu(data_source="pyroscope")))
+    assert sum(v for _, v in _points(body)) == 11
+
+
+def test_ser38_no_auth(client: OpenObserveClient, ref: RefData):
+    resp = requests.post(client.url(f"{ref.stream}/profiles/series"), json=_checkout(ref), timeout=30)
+    assert resp.status_code == 401, resp.text
diff --git a/tests/api-testing/tests/profiles/test_profiles_validation.py b/tests/api-testing/tests/profiles/test_profiles_validation.py
new file mode 100644
index 0000000000..d412c20318
--- /dev/null
+++ b/tests/api-testing/tests/profiles/test_profiles_validation.py
@@ -0,0 +1,490 @@
+"""Profiles ingest validation: Content-Type, decode errors, dictionary rules, partial success, time window (feature §2.1-§2.3)."""
+
+from __future__ import annotations
+
+import base64
+
+import pytest
+
+from support.client import OpenObserveClient
+
+from .profiles_helpers import (
+    BAD_CT_BODY,
+    NS,
+    PARTIAL_MSG,
+    STALE_NS,
+    ProfilesBuilder,
+    cpu,
+    decode_fields,
+    ingest_json,
+    ingest_proto,
+    now_ns,
+    profiles_streams,
+    recent_window,
+    simple_request,
+    to_json,
+    to_proto,
+    wait_merge_total,
+    wait_rows,
+)
+
+A_STACKS = [(["a_leaf", "a_work", "a_main"], 300), (["a_work", "a_main"], 100)]
+SAMPLE0 = "resource_profiles[0].scope_profiles[0].profiles[0].samples[0]"
+PROFILE0 = "resource_profiles[0].scope_profiles[0].profiles[0]"
+
+
+def _assert_invalid(resp, message: str) -> None:
+    assert resp.status_code == 400, f"{resp.status_code} {resp.text[:500]}"
+    assert resp.json() == {"code": 3, "message": message}
+
+
+def _json_error(resp) -> str:
+    assert resp.status_code == 400, f"{resp.status_code} {resp.text[:500]}"
+    body = resp.json()
+    assert body["code"] == 3, body
+    return body["message"]
+
+
+def _proto_status(resp) -> tuple[int, str]:
+    assert resp.status_code == 400, f"{resp.status_code} {resp.content[:300]!r}"
+    assert resp.headers["content-type"].startswith("application/x-protobuf")
+    fields = decode_fields(resp.content)
+    return fields[1][0], fields[2][0].decode()
+
+
+def _base() -> dict:
+    return to_json(simple_request(A_STACKS))
+
+
+def _compacted() -> dict:
+    """Collector 0.153 shape: no zero sentinels, index 0 holds real entries."""
+    return {
+        "resourceProfiles": [
+            {
+                "resource": {"attributes": [{"key": "service.name", "value": {"stringValue": "svc-c"}}]},
+                "scopeProfiles": [
+                    {
+                        "profiles": [
+                            {
+                                "sampleType": {"typeStrindex": 0, "unitStrindex": 1},
+                                "timeUnixNano": str(now_ns() - 60 * NS),
+                                "durationNano": str(10 * NS),
+                                "samples": [{"stackIndex": 0, "values": ["300"]}, {"stackIndex": 1, "values": ["100"]}],
+                            }
+                        ]
+                    }
+                ],
+            }
+        ],
+        "dictionary": {
+            "stringTable": ["cpu", "nanoseconds", "c_leaf", "c_work", "c_main"],
+            "functionTable": [{"nameStrindex": 2}, {"nameStrindex": 3}, {"nameStrindex": 4}],
+            "locationTable": [{"lines": [{"functionIndex": i}]} for i in range(3)],
+            "stackTable": [{"locationIndices": [0, 1, 2]}, {"locationIndices": [1, 2]}],
+        },
+    }
+
+
+def _samples(body: dict) -> list[dict]:
+    return body["resourceProfiles"][0]["scopeProfiles"][0]["profiles"][0]["samples"]
+
+
+@pytest.mark.parametrize(
+    "content_type",
+    ["text/plain", "application/protobuf", None],
+    ids=["val01-text-plain", "val02-protobuf-without-x", "val03-missing"],
+)
+def test_val01_03_bad_content_type(client: OpenObserveClient, prof_stream: str, content_type: str | None):
+    headers = {"stream-name": prof_stream}
+    if content_type:
+        headers["Content-Type"] = content_type
+    resp = client.post("v1/profiles", data=to_proto(simple_request(A_STACKS)), headers=headers)
+    assert resp.status_code == 400, resp.text
+    assert resp.json() == BAD_CT_BODY
+    assert prof_stream not in profiles_streams(client)
+
+
+def test_val04_garbage_protobuf(client: OpenObserveClient, prof_stream: str):
+    code, message = _proto_status(ingest_proto(client, prof_stream, b"\xff\xff\x07"))
+    assert code == 3
+    assert message.startswith("Invalid proto: "), message
+
+
+def test_val05_truncated_protobuf(client: OpenObserveClient, prof_stream: str):
+    code, message = _proto_status(ingest_proto(client, prof_stream, to_proto(simple_request(A_STACKS))[:-3]))
+    assert code == 3
+    assert message.startswith("Invalid proto: "), message
+    assert prof_stream not in profiles_streams(client)
+
+
+@pytest.mark.parametrize(
+    "raw",
+    ['{"resourceProfiles":[', '{"resourceProfiles":"x"}', "[]"],
+    ids=["val06-malformed", "val07-wrong-type", "val08-array"],
+)
+def test_val06_08_invalid_json(client: OpenObserveClient, prof_stream: str, raw: str):
+    message = _json_error(ingest_json(client, prof_stream, raw))
+    assert message.startswith("Invalid json: "), message
+
+
+SENTINELS = {
+    "mapping_table": ("mappingTable", {"memoryStart": "4096"}),
+    "location_table": ("locationTable", {"address": "1"}),
+    "function_table": ("functionTable", {"nameStrindex": 1}),
+    "link_table": ("linkTable", {"traceId": "01" * 16, "spanId": "02" * 8}),
+    "string_table": ("stringTable", "not-empty"),
+    "attribute_table": ("attributeTable", {"keyStrindex": 1, "value": {"stringValue": "x"}}),
+    "stack_table": ("stackTable", {"locationIndices": [1]}),
+}
+
+
+@pytest.mark.parametrize("table", list(SENTINELS), ids=[f"val09-{t}" for t in SENTINELS])
+def test_val09_canonical_sentinel_per_table(client: OpenObserveClient, prof_stream: str, table: str):
+    body = _base()
+    key, entry = SENTINELS[table]
+    body["dictionary"][key][0] = entry
+    _assert_invalid(ingest_json(client, prof_stream, body), f"dictionary.{table}[0] must be the zero value")
+
+
+def test_val10_sentinel_order_function_before_stack(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["functionTable"][0] = {"nameStrindex": 1}
+    body["dictionary"]["stackTable"][0] = {"locationIndices": [1]}
+    _assert_invalid(ingest_json(client, prof_stream, body), "dictionary.function_table[0] must be the zero value")
+
+
+def test_val11_fully_compacted_dictionary_accepted(client: OpenObserveClient, prof_stream: str):
+    resp = ingest_json(client, prof_stream, _compacted())
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    rows = wait_rows(client, prof_stream, 2)
+    assert sorted((r["stack"], r["value"]) for r in rows) == [("c_leaf;c_work;c_main", 300), ("c_work;c_main", 100)]
+    assert {(r["profile_type"], r["profile_unit"]) for r in rows} == {("cpu", "nanoseconds")}
+
+
+def test_val12_only_string_zero_set_is_not_compacted(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["stringTable"][0] = "cpu"
+    _assert_invalid(ingest_json(client, prof_stream, body), "dictionary.string_table[0] must be the zero value")
+
+
+def test_val13_string_and_stack_without_location_not_compacted(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["stringTable"][0] = "cpu"
+    body["dictionary"]["stackTable"][0] = {"locationIndices": [1]}
+    body["dictionary"]["functionTable"][0] = {"nameStrindex": 1}
+    _assert_invalid(ingest_json(client, prof_stream, body), "dictionary.function_table[0] must be the zero value")
+
+
+def test_val14_stack_and_location_without_string_not_compacted(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["stackTable"][0] = {"locationIndices": [1]}
+    body["dictionary"]["locationTable"][0] = {"lines": [{"functionIndex": 1}]}
+    _assert_invalid(ingest_json(client, prof_stream, body), "dictionary.location_table[0] must be the zero value")
+
+
+def test_val15_compacted_index_checked_before_rebase(client: OpenObserveClient, prof_stream: str):
+    body = _compacted()
+    _samples(body)[0]["stackIndex"] = 2
+    _assert_invalid(
+        ingest_json(client, prof_stream, body), f"{SAMPLE0}.stack_index: index 2 is outside dictionary table length 2"
+    )
+
+
+@pytest.mark.parametrize("index", [99, -1, 3], ids=["val16-99", "val17-negative", "val18-equal-len"])
+def test_val16_18_stack_index_out_of_range(client: OpenObserveClient, prof_stream: str, index: int):
+    body = _base()
+    assert len(body["dictionary"]["stackTable"]) == 3
+    _samples(body)[0]["stackIndex"] = index
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        f"{SAMPLE0}.stack_index: index {index} is outside dictionary table length 3",
+    )
+
+
+def test_val19_stack_index_last_entry_ok(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    _samples(body)[0]["stackIndex"] = 2
+    resp = ingest_json(client, prof_stream, body)
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_val20_index_zero_with_empty_table(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["linkTable"] = []
+    _samples(body)[0]["linkIndex"] = 0
+    resp = ingest_json(client, prof_stream, body)
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
+
+
+def test_val21_function_index_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    assert len(body["dictionary"]["functionTable"]) == 4
+    body["dictionary"]["locationTable"][1]["lines"][0]["functionIndex"] = 77
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        "dictionary.location_table[1].lines[0].function_index: index 77 is outside dictionary table length 4",
+    )
+
+
+def test_val22_link_index_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["linkTable"].append({"traceId": "01" * 16, "spanId": "02" * 8})
+    _samples(body)[1]["linkIndex"] = 5
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        f"{PROFILE0}.samples[1].link_index: index 5 is outside dictionary table length 2",
+    )
+
+
+def test_val23_location_indices_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    assert len(body["dictionary"]["locationTable"]) == 4
+    body["dictionary"]["stackTable"][1]["locationIndices"][0] = 50
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        "dictionary.stack_table[1].location_indices[0]: index 50 is outside dictionary table length 4",
+    )
+
+
+def test_val24_type_strindex_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    assert len(body["dictionary"]["stringTable"]) == 6
+    body["resourceProfiles"][0]["scopeProfiles"][0]["profiles"][0]["sampleType"]["typeStrindex"] = 99
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        f"{PROFILE0}.sample_type.type_strindex: index 99 is outside dictionary table length 6",
+    )
+
+
+def test_val25_period_type_unit_strindex_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["resourceProfiles"][0]["scopeProfiles"][0]["profiles"][0]["periodType"] = {
+        "typeStrindex": 4,
+        "unitStrindex": 99,
+    }
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        f"{PROFILE0}.period_type.unit_strindex: index 99 is outside dictionary table length 6",
+    )
+
+
+def test_val26_mapping_index_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["locationTable"][1]["mappingIndex"] = 7
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        "dictionary.location_table[1].mapping_index: index 7 is outside dictionary table length 1",
+    )
+
+
+def test_val27_mapping_filename_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["mappingTable"].append({"memoryStart": "4096", "filenameStrindex": 999})
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        "dictionary.mapping_table[1].filename_strindex: index 999 is outside dictionary table length 6",
+    )
+
+
+def test_val28_sample_attribute_index_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    _samples(body)[0]["attributeIndices"] = [5]
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        f"{SAMPLE0}.attribute_indices[0]: index 5 is outside dictionary table length 1",
+    )
+
+
+def test_val29_nested_array_string_strindex_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["dictionary"]["attributeTable"].append(
+        {"keyStrindex": 1, "value": {"arrayValue": {"values": [{"stringValueStrindex": 999}]}}}
+    )
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        "dictionary.attribute_table[1].value.array_value.values[0].string_value_strindex: "
+        "index 999 is outside dictionary table length 6",
+    )
+
+
+def test_val30_resource_key_strindex_out_of_range(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    body["resourceProfiles"][0]["resource"]["attributes"].insert(0, {"keyStrindex": 999, "value": {"stringValue": "x"}})
+    _assert_invalid(
+        ingest_json(client, prof_stream, body),
+        "resource_profiles[0].resource.attributes[0].key_strindex: index 999 is outside dictionary table length 6",
+    )
+
+
+def _partial(client: OpenObserveClient, stream: str, model: dict, rejected: str) -> None:
+    resp = ingest_json(client, stream, to_json(model))
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {"partialSuccess": {"rejectedProfiles": rejected, "errorMessage": PARTIAL_MSG}}
+
+
+def test_val31_length_mismatch_rejects_sample_keeps_good(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    bad = b.sample(["bad_leaf"], values=[1, 2], timestamps=[t, t + 1, t + 2])
+    b.resource([b.profile([bad, b.sample(["good_leaf"], values=[50])], time_ns=t)], {"service.name": "svc-a"})
+    _partial(client, prof_stream, b.model(), "1")
+    rows = wait_rows(client, prof_stream, 1)
+    assert (rows[0]["stack"], rows[0]["value"]) == ("good_leaf", 50)
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 50)
+
+
+def test_val32_sample_with_no_values_or_timestamps(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    b.resource(
+        [b.profile([b.sample(["empty_leaf"]), b.sample(["good_leaf"], values=[50])], time_ns=now_ns() - 60 * NS)],
+        {"service.name": "svc-a"},
+    )
+    _partial(client, prof_stream, b.model(), "1")
+    rows = wait_rows(client, prof_stream, 1)
+    assert (rows[0]["stack"], rows[0]["value"]) == ("good_leaf", 50)
+
+
+def test_val33_rejected_counts_profiles_not_samples(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    x = b.profile([b.sample(["x1"], values=[1], timestamps=[t, t]), b.sample(["x2"])], time_ns=t)
+    y = b.profile([b.sample(["y_leaf"], values=[8])], time_ns=t)
+    b.resource([x, y], {"service.name": "svc-a"})
+    _partial(client, prof_stream, b.model(), "1")
+    rows = wait_rows(client, prof_stream, 1)
+    assert (rows[0]["stack"], rows[0]["value"]) == ("y_leaf", 8)
+
+
+def test_val34_two_bad_profiles(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    profiles = [b.profile([b.sample([f"bad_{i}"]), b.sample([f"ok_{i}"], values=[i + 1])], time_ns=t) for i in range(2)]
+    b.resource(profiles, {"service.name": "svc-a"})
+    _partial(client, prof_stream, b.model(), "2")
+    rows = wait_rows(client, prof_stream, 2)
+    assert sorted((r["stack"], r["value"]) for r in rows) == [("ok_0", 1), ("ok_1", 2)]
+
+
+def _paired(ts: list[int], values: list[int]) -> dict:
+    b = ProfilesBuilder()
+    b.resource(
+        [b.profile([b.sample(["win_leaf"], values=values, timestamps=ts)], time_ns=now_ns())], {"service.name": "svc-a"}
+    )
+    return b.model()
+
+
+def test_val35_all_samples_far_future(client: OpenObserveClient, prof_stream: str):
+    _partial(client, prof_stream, _paired([now_ns() + 48 * 3600 * NS], [5]), "1")
+    assert prof_stream not in profiles_streams(client)
+
+
+def test_val36_future_inside_window(client: OpenObserveClient, prof_stream: str):
+    ts = now_ns() + 23 * 3600 * NS
+    resp = ingest_json(client, prof_stream, to_json(_paired([ts], [5])))
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    rows = wait_rows(client, prof_stream, 1)
+    assert (rows[0]["_timestamp"], rows[0]["value"]) == (ts // 1000, 5)
+
+
+def test_val37_past_out_of_window(client: OpenObserveClient, prof_stream: str):
+    _partial(client, prof_stream, _paired([now_ns() - STALE_NS], [5]), "1")
+    assert prof_stream not in profiles_streams(client)
+
+
+def test_val38_past_inside_window(client: OpenObserveClient, prof_stream: str):
+    ts = now_ns() - 4 * 3600 * NS
+    resp = ingest_json(client, prof_stream, to_json(_paired([ts], [5])))
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    rows = wait_rows(client, prof_stream, 1)
+    assert (rows[0]["_timestamp"], rows[0]["value"]) == (ts // 1000, 5)
+
+
+def test_val39_mixed_observations_keep_in_window(client: OpenObserveClient, prof_stream: str):
+    now = now_ns()
+    _partial(client, prof_stream, _paired([now, now + 48 * 3600 * NS], [1, 2]), "1")
+    rows = wait_rows(client, prof_stream, 1)
+    assert (rows[0]["_timestamp"], rows[0]["value"]) == (now // 1000, 1)
+    assert rows[0]["profile_duration_nanos"] == 10 * NS
+
+
+def test_val40_proto_partial_success_shape(client: OpenObserveClient, prof_stream: str):
+    b = ProfilesBuilder()
+    t = now_ns() - 60 * NS
+    bad = b.sample(["bad_leaf"], values=[1, 2], timestamps=[t])
+    b.resource([b.profile([bad, b.sample(["good_leaf"], values=[50])], time_ns=t)], {"service.name": "svc-a"})
+    resp = ingest_proto(client, prof_stream, b.model())
+    assert resp.status_code == 200, resp.text
+    assert resp.headers["content-type"].startswith("application/x-protobuf")
+    partial = decode_fields(decode_fields(resp.content)[1][0])
+    assert partial[1] == [1]
+    assert partial[2] == [PARTIAL_MSG.encode()]
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 50)
+
+
+def _linked_body(trace_id: str) -> dict:
+    b = ProfilesBuilder()
+    link = b.link("01" * 16, "02" * 8)
+    b.resource(
+        [b.profile([b.sample(["link_leaf"], values=[3], link=link)], time_ns=now_ns() - 60 * NS)],
+        {"service.name": "svc-a"},
+    )
+    body = to_json(b.model())
+    body["dictionary"]["linkTable"][link]["traceId"] = trace_id
+    return body
+
+
+@pytest.mark.parametrize(
+    "trace_id", ["0af7651916cd43dd8448eb211c80319", "zz" * 16], ids=["val41-odd-length", "val42-non-hex"]
+)
+def test_val41_42_bad_trace_id(client: OpenObserveClient, prof_stream: str, trace_id: str):
+    message = _json_error(ingest_json(client, prof_stream, _linked_body(trace_id)))
+    assert message.startswith("Invalid json: "), message
+    assert prof_stream not in profiles_streams(client)
+
+
+def test_val43_short_trace_id_stored_as_is(client: OpenObserveClient, prof_stream: str):
+    resp = ingest_json(client, prof_stream, _linked_body("abcd1234"))
+    assert resp.status_code == 200, resp.text
+    assert wait_rows(client, prof_stream, 1)[0]["trace_id"] == "abcd1234"
+
+
+def test_val44_stringified_integers_coerced(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    for sample in _samples(body):
+        sample["stackIndex"] = str(sample["stackIndex"])
+    profile = body["resourceProfiles"][0]["scopeProfiles"][0]["profiles"][0]
+    assert isinstance(profile["timeUnixNano"], str)
+    _samples(body)[0]["values"] = ["5"]
+    resp = ingest_json(client, prof_stream, body)
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 105)
+
+
+def test_val45_omitted_defaults(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    del body["resourceProfiles"][0]["scopeProfiles"][0]["profiles"][0]["durationNano"]
+    assert all("mappingIndex" not in loc for loc in body["dictionary"]["locationTable"])
+    resp = ingest_json(client, prof_stream, body)
+    assert resp.status_code == 200, resp.text
+    rows = wait_rows(client, prof_stream, 2)
+    assert {r["duration_nanos"] for r in rows} == {0}
+    assert all("profile_duration_nanos" not in r for r in rows)
+
+
+def test_val46_original_payload_ignored(client: OpenObserveClient, prof_stream: str):
+    body = _base()
+    profile = body["resourceProfiles"][0]["scopeProfiles"][0]["profiles"][0]
+    profile["originalPayloadFormat"] = "pprofext"
+    profile["originalPayload"] = base64.b64encode(b"\x1f\x8b raw pprof bytes").decode()
+    resp = ingest_json(client, prof_stream, body)
+    assert resp.status_code == 200, resp.text
+    assert resp.json() == {}
+    wait_merge_total(client, prof_stream, recent_window(**cpu()), 400)
diff --git a/tests/ui-testing/ci-matrix/ci_matrix.json b/tests/ui-testing/ci-matrix/ci_matrix.json
index 952648374e..a341065134 100644
--- a/tests/ui-testing/ci-matrix/ci_matrix.json
+++ b/tests/ui-testing/ci-matrix/ci_matrix.json
@@ -637,5 +637,20 @@
       "slo-alerts.spec.js"
     ],
     "disabled": []
+  },
+  {
+    "testfolder": "Profiles",
+    "actual_folder": "Profiles",
+    "browser": "chrome",
+    "run_files": [
+      "profiles-navigation-entry.spec.js",
+      "profiles-query-controls.spec.js",
+      "profiles-chart-breakdown.spec.js",
+      "profiles-views.spec.js",
+      "profiles-flame-graph.spec.js",
+      "profiles-compare.spec.js",
+      "profiles-states-edge.spec.js"
+    ],
+    "disabled": []
   }
 ]
diff --git a/tests/ui-testing/ci-matrix/smoke_config.json b/tests/ui-testing/ci-matrix/smoke_config.json
index c3310ebe61..a242959537 100644
--- a/tests/ui-testing/ci-matrix/smoke_config.json
+++ b/tests/ui-testing/ci-matrix/smoke_config.json
@@ -173,6 +173,12 @@
       "tests/ui-testing/pages/reportsPages/**",
       "tests/ui-testing/pages/dashboardPages/**"
     ],
+    "Profiles": [
+      "web/src/plugins/profiles/**",
+      "web/src/services/profiles.*",
+      "web/src/components/common/FlameGraphView.vue",
+      "tests/ui-testing/pages/profilesPages/**"
+    ],
     "RUM": [
       "web/src/components/rum/**",
       "web/src/views/RUM/**",
diff --git a/tests/ui-testing/pages/alertsPages/alertCreationWizard.js b/tests/ui-testing/pages/alertsPages/alertCreationWizard.js
index b94b425e49..189bbfc9f2 100644
--- a/tests/ui-testing/pages/alertsPages/alertCreationWizard.js
+++ b/tests/ui-testing/pages/alertsPages/alertCreationWizard.js
@@ -5,7 +5,6 @@
  * - Real-time alerts with conditions
  * - Scheduled alerts with SQL/PromQL queries
  * - Multi-condition alerts with AND/OR logic
- * - Alerts with deduplication configuration
  */
 
 import { expect } from '@playwright/test';
@@ -180,7 +179,7 @@ export class AlertCreationWizard {
 
     /**
      * Create a real-time alert using Alerts 2.0 wizard UI
-     * Wizard steps for real-time: Step 1 (Setup) -> Step 2 (Conditions) -> Step 4 (Settings) -> Step 6 (Advanced) -> Submit
+     * Wizard steps for real-time: Step 1 (Setup) -> Step 2 (Conditions) -> Step 4 (Settings) -> Step 5 (Advanced) -> Submit
      * @param {string} streamName - Name of the stream
      * @param {string} column - Column name for condition
      * @param {string} value - Value for condition
@@ -414,7 +413,7 @@ export class AlertCreationWizard {
 
     /**
      * Create a scheduled alert with SQL query using Alerts 2.0 wizard UI
-     * Wizard steps for scheduled: Step 1 (Setup) -> Step 2 (Conditions/SQL) -> Step 3 (Compare) -> Step 4 (Settings) -> Step 5 (Dedup) -> Step 6 (Advanced) -> Submit
+     * Wizard steps for scheduled: Step 1 (Setup) -> Step 2 (Conditions/SQL) -> Step 3 (Compare) -> Step 4 (Settings) -> Step 5 (Advanced) -> Submit
      * @param {string} streamName - Name of the stream
      * @param {string} destinationName - Name of the destination
      * @param {string} randomValue - Random string for unique naming
@@ -775,208 +774,6 @@ export class AlertCreationWizard {
         return randomAlertName;
     }
 
-    /**
-     * Create a scheduled alert with deduplication configuration
-     * @param {string} streamName - Name of the stream
-     * @param {string} destinationName - Name of the destination
-     * @param {string} randomValue - Random string for unique naming
-     * @param {Object} dedupConfig - Deduplication configuration
-     * @param {number} [dedupConfig.timeWindowMinutes] - Time window in minutes
-     * @param {string[]} [dedupConfig.fingerprintFields] - Fields for fingerprinting
-     */
-    async createScheduledAlertWithDeduplication(streamName, destinationName, randomValue, dedupConfig = {}) {
-        const randomAlertName = 'auto_dedup_alert_' + randomValue;
-        this.currentAlertName = randomAlertName;
-
-        testLogger.info('Creating scheduled alert with deduplication', {
-            streamName,
-            destinationName,
-            alertName: randomAlertName,
-            dedupConfig
-        });
-
-        // ==================== ALERT SETUP ====================
-        await this.page.locator(this.locators.addAlertButton).click();
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        testLogger.info('Add alert dialog opened');
-
-        await this.fillAlertNameField(randomAlertName);
-        testLogger.info('Filled alert name', { alertName: randomAlertName });
-
-        // Select stream type (logs) via OSelect popover pattern (§4)
-        await this.page.locator(this.locators.streamTypeDropdown).click();
-        await expect(this.page.locator(this.locators.streamTypePopover)).toBeVisible({ timeout: 10000 });
-        await this.page.locator(`${this.locators.streamTypeOption}[data-test-value="logs"]`).click();
-        // Deterministic wait: stream-name dropdown becomes enabled once `formData.stream_type` is set (§10)
-        await expect(this.page.locator(this.locators.streamNameDropdown)).toBeEnabled({ timeout: 10000 });
-        testLogger.info('Selected stream type: logs');
-
-        // Select stream name
-        await this.selectStreamByName(streamName);
-        testLogger.info('Selected stream name', { streamName });
-
-        // Select Scheduled alert type via dropdown (v3 UI)
-        await this._selectAlertType('Scheduled');
-        testLogger.info('Selected scheduled alert type');
-
-        // ==================== CONDITIONS (SQL) ====================
-        const sqlTab = this.page.locator('[data-test="step2-query-tabs"] button:has-text("SQL")');
-        await sqlTab.waitFor({ state: 'visible', timeout: 10000 });
-        await sqlTab.click();
-        await this.page.waitForTimeout(1000);
-        testLogger.info('Switched to SQL tab');
-
-        const viewEditorBtn = this.page.locator(this.locators.viewEditorButton);
-        await viewEditorBtn.waitFor({ state: 'visible', timeout: 10000 });
-        await viewEditorBtn.click();
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        await this.page.waitForTimeout(1000);
-        testLogger.info('Opened SQL Editor dialog');
-
-        await this._replaceSqlEditorQuery(`SELECT kubernetes_labels_name FROM "${streamName}" where kubernetes_labels_name = 'ziox-querier'`);
-
-        await this.page.locator(this.locators.runQueryButton).click();
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        await this.page.waitForTimeout(2000);
-        testLogger.info('Ran SQL query');
-
-        // Close the query-editor drawer via ITS back button — scope to the
-        // query-editor-dialog container, since an unscoped add-alert-back-btn matches
-        // the wizard's own back arrow and leaves the drawer open to intercept clicks
-        // on the threshold row below. Assert the drawer detaches before proceeding.
-        const editorDialog = this.page.locator('[data-test="query-editor-dialog"]').first();
-        const dialogBackBtn = editorDialog.locator('[data-test="add-alert-back-btn"]').first();
-        await dialogBackBtn.waitFor({ state: 'visible', timeout: 10000 });
-        await dialogBackBtn.click();
-        await expect(editorDialog).not.toBeAttached({ timeout: 10000 });
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        await this.page.waitForTimeout(500);
-
-        testLogger.info('Closed SQL Editor dialog — portal cleaned up');
-
-        // ==================== ALERT SETTINGS ====================
-        // Threshold row via stable data-test hooks (same as createScheduledAlertWithSQL) —
-        // the old `.alert-condition-row`/`.alert-v3-select` class chain no longer exists
-        // on current builds (removed with the alert wizard revamp).
-        // OSelect forwards data-test to an inner -trigger button; the wrapper div itself
-        // is not clickable. Target the trigger so the popover actually opens.
-        const thresholdOperatorSelect = this.page.locator('[data-test="alert-trigger-operator-select"]').first();
-        await thresholdOperatorSelect.waitFor({ state: 'visible', timeout: 10000 });
-        testLogger.info('Threshold section visible');
-
-        // Open via the OSelect helper (clicks the inner -trigger until aria-expanded),
-        // not a raw click — the reka-ui trigger can open-then-close on a single click.
-        await openOSelectDropdown(this.page, thresholdOperatorSelect);
-        await this.page.locator('[data-test="alert-trigger-operator-select-option"][data-test-value=">="]').first().click();
-        testLogger.info('Set threshold operator: >=');
-
-        const thresholdInput = this.page.locator('[data-test="alert-trigger-threshold-input-field"]').first();
-        await thresholdInput.waitFor({ state: 'visible', timeout: 5000 });
-        await thresholdInput.fill('1');
-        testLogger.info('Set threshold value: 1');
-
-        const periodInput = this.page.locator('[data-test="alert-settings-period-input-field"]').first();
-        await this.page.waitForTimeout(500);
-        if (await periodInput.isVisible({ timeout: 3000 })) {
-            await periodInput.fill('15');
-            testLogger.info('Set period: 15 minutes');
-        }
-
-        const destinationDropdown = this.page.locator('[data-test="alert-destinations-select"]');
-        await destinationDropdown.waitFor({ state: 'visible', timeout: 5000 });
-        await openOSelectDropdown(this.page, destinationDropdown);
-        await this.page.waitForTimeout(1000);
-
-        // Use popover selector for destination
-        const visibleDestMenuDedupItems = this.page.locator('[data-test$="-popover"] [data-test$="-option"]');
-        await expect(visibleDestMenuDedupItems.first()).toBeVisible({ timeout: 5000 });
-
-        let destFoundDedup = false;
-        const destOptionDedup = visibleDestMenuDedupItems.filter({ hasText: destinationName }).first();
-        if (await destOptionDedup.isVisible({ timeout: 3000 }).catch(() => false)) {
-            await destOptionDedup.click();
-            destFoundDedup = true;
-            testLogger.info('Selected destination via popover', { destinationName });
-        }
-
-        if (!destFoundDedup) {
-            // Fallback: select first available destination
-            await visibleDestMenuDedupItems.first().click();
-            testLogger.warn('Selected first available destination (fallback)', { requestedDestination: destinationName });
-        }
-        await this.page.waitForTimeout(500);
-        await this.page.locator('body').click({ position: { x: 10, y: 10 } });
-        testLogger.info('Selected destination', { destinationName });
-
-        // ==================== DEDUPLICATION (Advanced tab) ====================
-        await this._switchToAdvancedTab();
-
-        const dedupContainer = this.page.locator(this.locators.stepDeduplication);
-        await expect(dedupContainer).toBeVisible({ timeout: 5000 });
-        testLogger.info('Deduplication container visible in Advanced tab');
-
-        // Configure fingerprint fields if provided
-        if (dedupConfig.fingerprintFields && dedupConfig.fingerprintFields.length > 0) {
-            const fingerprintSelect = this.page.locator(this.locators.stepDeduplicationFingerprintSelect);
-            await fingerprintSelect.waitFor({ state: 'visible', timeout: 5000 });
-
-            for (const field of dedupConfig.fingerprintFields) {
-                await fingerprintSelect.click();
-                await this.page.waitForTimeout(500);
-                await fingerprintSelect.locator('input').fill(field);
-                await this.page.waitForTimeout(500);
-
-                const fieldOption = this.page.getByRole('option', { name: field }).first();
-                if (await fieldOption.isVisible({ timeout: 2000 })) {
-                    await fieldOption.click();
-                } else {
-                    await this.page.keyboard.press('Enter');
-                }
-                await this.page.waitForTimeout(300);
-            }
-            await this.page.locator('body').click({ position: { x: 10, y: 10 } });
-            testLogger.info('Configured fingerprint fields', { fields: dedupConfig.fingerprintFields });
-        } else {
-            testLogger.info('Skipping fingerprint fields (auto-detect)');
-        }
-
-        // Configure time window if provided
-        if (dedupConfig.timeWindowMinutes !== undefined) {
-            const timeWindowInput = this.page.locator(this.locators.stepDeduplicationTimeWindowInput);
-            await timeWindowInput.waitFor({ state: 'visible', timeout: 5000 });
-            await timeWindowInput.clear();
-            await timeWindowInput.fill(String(dedupConfig.timeWindowMinutes));
-            testLogger.info('Set time window', { minutes: dedupConfig.timeWindowMinutes });
-        } else {
-            testLogger.info('Skipping time window (auto-detect)');
-        }
-
-        // ==================== SUBMIT ALERT ====================
-        // The submit button sits inside a scroll container that clips it from the viewport
-        // — worse here because the Advanced/deduplication tab lengthens the form. Playwright's
-        // .click() (even force:true) doesn't bypass scroll-container clipping, so the click
-        // silently misses, the alert never saves, and the success toast never appears (the
-        // exact alpha1 failure). Use a native DOM click via evaluate() — the same reliable
-        // submit the non-dedup scheduled-alert path (createScheduledAlertWithSQL) uses.
-        await this.page.locator(this.locators.alertSubmitButton).waitFor({ state: 'attached', timeout: 10000 });
-        await this.page.evaluate((selector) => {
-            const btn = document.querySelector(selector);
-            if (btn) btn.click();
-        }, this.locators.alertSubmitButton);
-        // OToast renders the message in 3 elements (sr-only ARIA span, sr-only title div,
-        // visible message div) — scope to the visible `o-toast-message` data-test to avoid
-        // strict-mode violation per AGENT_RULES §2.
-        await expect(
-            this.page
-                .locator('[data-test="o-toast-message"]')
-                .filter({ hasText: this.locators.alertSuccessMessage })
-                .first()
-        ).toBeVisible({ timeout: 30000 });
-        testLogger.info('Successfully created scheduled alert with deduplication', { alertName: randomAlertName });
-
-        return randomAlertName;
-    }
-
     /**
      * Test condition operator toggle (AND to OR) during alert creation
      * @param {string} streamName - Name of the stream
@@ -1159,39 +956,6 @@ export class AlertCreationWizard {
         testLogger.info('Deleted condition', { index });
     }
 
-    /**
-     * Verify deduplication step is visible (only for scheduled alerts)
-     */
-    async verifyDeduplicationStepVisible() {
-        const dedupContainer = this.page.locator(this.locators.stepDeduplication);
-        await expect(dedupContainer).toBeVisible({ timeout: 5000 });
-
-        const fingerprintSelect = this.page.locator(this.locators.stepDeduplicationFingerprintSelect);
-        await expect(fingerprintSelect).toBeVisible({ timeout: 3000 });
-
-        const timeWindowInput = this.page.locator(this.locators.stepDeduplicationTimeWindowInput);
-        await expect(timeWindowInput).toBeVisible({ timeout: 3000 });
-
-        testLogger.info('Deduplication step verified - all elements visible');
-        return true;
-    }
-
-    /**
-     * Get current deduplication configuration from the UI
-     */
-    async getDeduplicationConfig() {
-        const timeWindowInput = this.page.locator(this.locators.stepDeduplicationTimeWindowInput);
-        const timeWindowValue = await timeWindowInput.inputValue();
-
-        const fingerprintSelect = this.page.locator(this.locators.stepDeduplicationFingerprintSelect);
-        const chips = await fingerprintSelect.locator('[data-test*="chip"], [data-test*="badge"]').allTextContents();
-
-        return {
-            timeWindowMinutes: timeWindowValue ? parseInt(timeWindowValue, 10) : null,
-            fingerprintFields: chips
-        };
-    }
-
     getCurrentAlertName() {
         return this.currentAlertName;
     }
@@ -1264,262 +1028,11 @@ export class AlertCreationWizard {
         testLogger.info('Entered SQL query', { query });
     }
 
-    /**
-     * Create a scheduled alert with deduplication for validation testing
-     * Uses custom columns (city) and configures for quick evaluation cycles
-     * @param {string} streamName - Name of the stream (with custom columns)
-     * @param {string} column - Column name for condition (e.g., 'city')
-     * @param {string} value - Value for condition (e.g., 'bangalore')
-     * @param {string} destinationName - Name of the destination (validation destination)
-     * @param {string} randomValue - Random string for unique naming
-     * @param {Object} dedupConfig - Deduplication configuration
-     * @param {number} [dedupConfig.timeWindowMinutes] - Time window in minutes (default: 5)
-     * @param {string[]} [dedupConfig.fingerprintFields] - Fields for fingerprinting (default: [column])
-     */
-    async createScheduledAlertWithDedupForValidation(streamName, column, value, destinationName, randomValue, dedupConfig = {}) {
-        const randomAlertName = 'auto_dedup_val_' + randomValue;
-        this.currentAlertName = randomAlertName;
-
-        // Default dedup config for validation testing
-        const timeWindowMinutes = dedupConfig.timeWindowMinutes || 5;
-        const fingerprintFields = dedupConfig.fingerprintFields || [column];
-
-        testLogger.info('Creating scheduled alert with deduplication for validation', {
-            streamName,
-            column,
-            value,
-            destinationName,
-            alertName: randomAlertName,
-            dedupConfig: { timeWindowMinutes, fingerprintFields }
-        });
-
-        // ==================== ALERT SETUP ====================
-        await this.page.locator(this.locators.addAlertButton).click();
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        testLogger.info('Add alert dialog opened');
-
-        await this.fillAlertNameField(randomAlertName);
-        testLogger.info('Filled alert name', { alertName: randomAlertName });
-
-        // Select stream type (logs) via OSelect popover pattern (§4)
-        await this.page.locator(this.locators.streamTypeDropdown).click();
-        await expect(this.page.locator(this.locators.streamTypePopover)).toBeVisible({ timeout: 10000 });
-        await this.page.locator(`${this.locators.streamTypeOption}[data-test-value="logs"]`).click();
-        // Deterministic wait: stream-name dropdown becomes enabled once `formData.stream_type` is set (§10)
-        await expect(this.page.locator(this.locators.streamNameDropdown)).toBeEnabled({ timeout: 10000 });
-        testLogger.info('Selected stream type: logs');
-
-        // Select stream name
-        await this.selectStreamByName(streamName);
-        testLogger.info('Selected stream name', { streamName });
-
-        // Select Scheduled alert type via dropdown (v3 UI)
-        await this._selectAlertType('Scheduled');
-        testLogger.info('Selected scheduled alert type');
-
-        // ==================== CONDITIONS (SQL) ====================
-        const sqlTab = this.page.locator('[data-test="step2-query-tabs"] button:has-text("SQL")');
-        await sqlTab.waitFor({ state: 'visible', timeout: 10000 });
-        await sqlTab.click();
-        await this.page.waitForTimeout(1000);
-        testLogger.info('Switched to SQL tab');
-
-        const viewEditorBtn = this.page.locator(this.locators.viewEditorButton);
-        await viewEditorBtn.waitFor({ state: 'visible', timeout: 10000 });
-        await viewEditorBtn.click();
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        await this.page.waitForTimeout(1000);
-        testLogger.info('Opened SQL Editor dialog');
-
-        // Use SQL query that selects data matching our condition
-        const sqlQuery = `SELECT ${column} FROM "${streamName}" WHERE ${column} = '${value}'`;
-        await this._replaceSqlEditorQuery(sqlQuery);
-
-        await this.page.locator(this.locators.runQueryButton).click();
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        await this.page.waitForTimeout(2000);
-        testLogger.info('Ran SQL query');
-
-        // Close dialog — try back button, then close button
-        try {
-            const closeButton = this.page.locator('[data-test="add-alert-back-btn"]').first();
-            await closeButton.click({ force: true, timeout: 10000 });
-        } catch (error) {
-            testLogger.warn('Close button force-click failed, trying dialog close button', { error: error.message });
-            const dialogCloseBtn = this.page.locator('[data-test="o-dialog-close-btn"]').first();
-            if (await dialogCloseBtn.isVisible({ timeout: 2000 }).catch(() => false)) {
-                await dialogCloseBtn.click();
-            }
-            await this.page.waitForTimeout(500);
-        }
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        await this.page.waitForTimeout(1000);
-
-        // Verify SQL editor dialog is closed by waiting for it to be hidden
-        const sqlEditorDialog = this.page.locator(this.locators.sqlEditorDialog);
-        const dialogHidden = await sqlEditorDialog.isHidden({ timeout: 5000 }).catch(() => true);
-        if (!dialogHidden) {
-            testLogger.warn('SQL Editor dialog still visible, clicking close button');
-            await this.page.locator('[data-test="o-dialog-close-btn"]').first().click().catch(() => {});
-            await this.page.waitForTimeout(1000);
-        }
-        testLogger.info('Closed SQL Editor dialog');
-
-        // ==================== COMPARE WITH PAST (Advanced tab) ====================
-        await this._switchToAdvancedTab();
-
-        // Add time range comparison
-        const addTimeRangeBtn = this.page.locator(this.locators.multiTimeRangeAddButton);
-        if (await addTimeRangeBtn.isVisible({ timeout: 3000 })) {
-            await addTimeRangeBtn.click();
-            await this.page.waitForTimeout(1000);
-            await this.page.locator('[data-test="date-time-btn"]').click();
-            await this.page.locator('[data-test="date-time-relative-30-m-btn"]').click();
-            // The auto-apply picker stays open after a pick, and its wider popover can cover the tab bar below.
-            const dateTimeMenu = this.page.locator('#date-time-menu');
-            await this.page.keyboard.press('Escape');
-            await dateTimeMenu.waitFor({ state: 'hidden', timeout: 3000 }).catch(() => {});
-            testLogger.info('Added 30-minute time range comparison');
-        } else {
-            testLogger.info('Time range button not visible, skipping');
-        }
-
-        // ==================== ALERT SETTINGS (back in Alert Rules tab) ====================
-        await this._switchToAlertRulesTab();
-
-        // The SQL query-editor drawer often doesn't close via its close button, and while it stays
-        // open reka disables pointer events on the rest of the page — so the threshold-operator
-        // click below is intercepted (by the drawer, its overlay, or ultimately <html>). Dismiss it
-        // with Escape until it is no longer open, which lets reka restore page interaction.
-        for (let i = 0; i < 5; i++) {
-            if ((await this.page.locator('[data-test="query-editor-dialog"][data-state="open"]').count()) === 0) break;
-            await this.page.keyboard.press('Escape').catch(() => {});
-            await this.page.waitForTimeout(400);
-        }
-        // Fallback: if it still won't close, re-enable page pointer events and hide any residue so
-        // the operator is reachable anyway.
-        await this.page.evaluate(() => {
-            document.body.style.pointerEvents = 'auto';
-            document.querySelectorAll(
-                '[data-test="query-editor-dialog"], [data-test="o-drawer-overlay"], div[data-reka-dialog-overlay], div[data-reka-portalled]'
-            ).forEach((el) => { el.style.display = 'none'; });
-        }).catch(() => {});
-        await this.page.waitForTimeout(300);
-
-        // Threshold row via stable data-test hooks — the old `.alert-condition-row`/
-        // `.alert-v3-select` class chain no longer exists on current builds.
-        // OSelect forwards data-test to an inner -trigger button; the wrapper div itself
-        // is not clickable. Target the trigger so the popover actually opens.
-        const thresholdOperatorSelect = this.page.locator('[data-test="alert-trigger-operator-select"]').first();
-        await thresholdOperatorSelect.waitFor({ state: 'visible', timeout: 10000 });
-        // Open via the OSelect helper (clicks the inner -trigger until aria-expanded),
-        // not a raw click — the reka-ui trigger can open-then-close on a single click.
-        await openOSelectDropdown(this.page, thresholdOperatorSelect);
-        await this.page.locator('[data-test="alert-trigger-operator-select-option"][data-test-value=">="]').first().click();
-        testLogger.info('Set threshold operator: >=');
-
-        const thresholdInput = this.page.locator('[data-test="alert-trigger-threshold-input-field"]').first();
-        await thresholdInput.waitFor({ state: 'visible', timeout: 10000 });
-        await thresholdInput.fill('1');
-        testLogger.info('Set threshold value: 1');
-
-        // Set shortest period (1 minute) for faster testing
-        const periodInput = this.page.locator('[data-test="alert-settings-period-input-field"]').first();
-        await this.page.waitForTimeout(500);
-        if (await periodInput.isVisible({ timeout: 5000 })) {
-            await periodInput.fill('1');
-            testLogger.info('Set period: 1 minute (shortest)');
-        }
-
-        const destinationDropdown = this.page.locator('[data-test="alert-destinations-select"]');
-        await destinationDropdown.waitFor({ state: 'visible', timeout: 10000 });
-        await openOSelectDropdown(this.page, destinationDropdown);
-        await this.page.waitForTimeout(1000);
-
-        // Use popover selector for destination
-        const visibleDestMenuItems = this.page.locator('[data-test$="-popover"] [data-test$="-option"]');
-        await expect(visibleDestMenuItems.first()).toBeVisible({ timeout: 5000 });
-
-        let destFound = false;
-        const destOption = visibleDestMenuItems.filter({ hasText: destinationName }).first();
-        if (await destOption.isVisible({ timeout: 3000 }).catch(() => false)) {
-            await destOption.click();
-            destFound = true;
-            testLogger.info('Selected destination via popover', { destinationName });
-        }
-
-        if (!destFound) {
-            // Try scrolling to find the destination
-            try {
-                await this.commonActions.scrollAndFindOption(destinationName, 'template');
-                testLogger.info('Found destination by scrolling', { destinationName });
-            } catch (scrollError) {
-                await visibleDestMenuItems.first().click();
-                testLogger.warn('Selected first available destination (fallback)', { requestedDestination: destinationName });
-            }
-        }
-        await this.page.waitForTimeout(500);
-        await this.page.locator('body').click({ position: { x: 10, y: 10 } });
-        testLogger.info('Selected destination', { destinationName });
-
-        // ==================== DEDUPLICATION (Advanced tab) ====================
-        await this._switchToAdvancedTab();
-
-        const dedupContainer = this.page.locator(this.locators.stepDeduplication);
-        await expect(dedupContainer).toBeVisible({ timeout: 5000 });
-        testLogger.info('Deduplication container visible in Advanced tab');
-
-        // Configure fingerprint fields
-        if (fingerprintFields && fingerprintFields.length > 0) {
-            const fingerprintSelect = this.page.locator(this.locators.stepDeduplicationFingerprintSelect);
-            await fingerprintSelect.waitFor({ state: 'visible', timeout: 5000 });
-
-            for (const field of fingerprintFields) {
-                await fingerprintSelect.click();
-                await this.page.waitForTimeout(500);
-                await fingerprintSelect.locator('input').fill(field);
-                await this.page.waitForTimeout(500);
-
-                const fieldOption = this.page.getByRole('option', { name: field }).first();
-                if (await fieldOption.isVisible({ timeout: 2000 })) {
-                    await fieldOption.click();
-                } else {
-                    await this.page.keyboard.press('Enter');
-                }
-                await this.page.waitForTimeout(300);
-            }
-            await this.page.locator('body').click({ position: { x: 10, y: 10 } });
-            testLogger.info('Configured fingerprint fields', { fields: fingerprintFields });
-        }
-
-        // Configure time window
-        const timeWindowInput = this.page.locator(this.locators.stepDeduplicationTimeWindowInput);
-        await timeWindowInput.waitFor({ state: 'visible', timeout: 5000 });
-        await timeWindowInput.clear();
-        await timeWindowInput.fill(String(timeWindowMinutes));
-        testLogger.info('Set dedup time window', { minutes: timeWindowMinutes });
-
-        // ==================== SUBMIT ALERT ====================
-        await this.page.locator(this.locators.alertSubmitButton).click();
-        // OToast renders the message in 3 elements (sr-only ARIA span, sr-only title div,
-        // visible message div) — scope to the visible `o-toast-message` data-test to avoid
-        // strict-mode violation per AGENT_RULES §2.
-        await expect(
-            this.page
-                .locator('[data-test="o-toast-message"]')
-                .filter({ hasText: this.locators.alertSuccessMessage })
-                .first()
-        ).toBeVisible({ timeout: 30000 });
-        testLogger.info('Successfully created scheduled alert with deduplication for validation', { alertName: randomAlertName });
-
-        return randomAlertName;
-    }
-
     /**
      * Create a scheduled alert with aggregation enabled in Builder mode
      * PR #10470 moved aggregation from Step 4 (AlertSettings) to Step 2 (QueryConfig)
      *
-     * Wizard flow: Step 1 (Setup) -> Step 2 (Conditions + Aggregation) -> Step 3 (Compare) -> Step 4 (Settings) -> Step 5 (Dedup) -> Step 6 (Advanced) -> Submit
+     * Wizard flow: Step 1 (Setup) -> Step 2 (Conditions + Aggregation) -> Step 3 (Compare) -> Step 4 (Settings) -> Step 5 (Advanced) -> Submit
      *
      * @param {string} streamName - Name of the log stream
      * @param {string} destinationName - Name of the destination
@@ -1703,7 +1216,7 @@ export class AlertCreationWizard {
         await this.page.locator('body').click({ position: { x: 10, y: 10 } });
         testLogger.info('Configured alert settings');
 
-        // Remaining advanced features (CompareWithPast, Dedup) are in Advanced tab
+        // Remaining advanced features (CompareWithPast) are in Advanced tab
         // but we skip them for this test
 
         // ==================== SUBMIT ====================
@@ -1923,7 +1436,7 @@ export class AlertCreationWizard {
         await this.page.locator('body').click({ position: { x: 10, y: 10 } });
         testLogger.info('Selected destination', { destinationName });
 
-        // Remaining advanced features (CompareWithPast, Dedup) are in Advanced tab
+        // Remaining advanced features (CompareWithPast) are in Advanced tab
         // but we skip them for this test
 
         // ==================== SUBMIT ALERT ====================
diff --git a/tests/ui-testing/pages/alertsPages/alertManagement.js b/tests/ui-testing/pages/alertsPages/alertManagement.js
index 4e6803410f..d25864b91c 100644
--- a/tests/ui-testing/pages/alertsPages/alertManagement.js
+++ b/tests/ui-testing/pages/alertsPages/alertManagement.js
@@ -792,111 +792,17 @@ export class AlertManagement {
     }
 
     // =========================================================================
-    // ALERT EDIT — DEDUPLICATION REGRESSION HELPERS
+    // ALERT EDIT HELPERS
     // =========================================================================
 
-    /**
-     * Wait for the alert list page to be ready (canonical landmark).
-     * @param {number} timeout
-     */
-    async waitForAlertListReady(timeout = 30000) {
-        await this.page.locator(this.locators.alertListPage).waitFor({ state: 'visible', timeout });
-    }
-
-    /**
-     * Open the alert edit screen by clicking the alert's update (pencil) button.
-     * The list row exposes `[data-test="alert-list-{name}-update-alert"]` (AlertList.vue:312).
-     * @param {string} alertName
-     */
-    async openAlertEditByName(alertName) {
-        const updateBtn = this.page.locator(`[data-test="alert-list-${alertName}-update-alert"]`).first();
-        await expect(updateBtn).toBeVisible({ timeout: 10000 });
-        await updateBtn.click();
-        // Wait for the AddAlert form to render — `add-alert-submit-btn` is the canonical landmark.
-        await this.page.locator(this.locators.alertSubmitButton).waitFor({ state: 'visible', timeout: 15000 });
-        testLogger.info('Opened alert edit view', { alertName });
-    }
-
     /**
      * Activate the Advanced tab in the AddAlert v3 wizard.
-     * Deduplication lives in this tab (AddAlert.vue line ~273).
      */
     async openAdvancedTab() {
         const advancedTab = this.page.locator(this.locators.addAlertTabAdvanced);
         await expect(advancedTab).toBeVisible({ timeout: 10000 });
         await advancedTab.click();
-        // Wait for the dedup fingerprint OSelect wrapper to mount in the Advanced tab.
-        await this.page.locator(this.locators.dedupFingerprintFieldsSelect).waitFor({ state: 'visible', timeout: 10000 });
-        testLogger.info('Switched to Advanced tab — deduplication panel visible');
-    }
-
-    /**
-     * Read currently selected fingerprint field values from the OSelect trigger.
-     * OSelect exposes `data-test-selected-value` (comma-joined for multiple).
-     * @returns {Promise<string[]>}
-     */
-    async getSelectedFingerprintFields() {
-        const trigger = this.page.locator(this.locators.dedupFingerprintFieldsTrigger);
-        await expect(trigger).toBeVisible({ timeout: 5000 });
-        const raw = await trigger.getAttribute('data-test-selected-value');
-        if (!raw) return [];
-        return raw.split(',').map(v => v.trim()).filter(Boolean);
-    }
-
-    /**
-     * Remove all currently selected fingerprint fields by opening the OSelect popover
-     * and clicking each previously selected option to toggle it OFF (multi-select).
-     * Returns the number of fields removed.
-     */
-    async removeAllFingerprintFields() {
-        const trigger = this.page.locator(this.locators.dedupFingerprintFieldsTrigger);
-        await expect(trigger).toBeVisible({ timeout: 5000 });
-
-        const selectedBefore = await this.getSelectedFingerprintFields();
-        testLogger.info('Removing fingerprint fields — initial selection', { selected: selectedBefore });
-
-        if (selectedBefore.length === 0) {
-            testLogger.warn('No fingerprint fields selected to remove');
-            return 0;
-        }
-
-        await trigger.click();
-        const popover = this.page.locator(this.locators.dedupFingerprintFieldsPopover);
-        await expect(popover).toBeVisible({ timeout: 5000 });
-
-        let removed = 0;
-        for (const value of selectedBefore) {
-            // Per-value option uses `data-test-value="<value>"`
-            const option = popover.locator(`[data-test="alert-dedup-fingerprint-fields-option"][data-test-value="${value}"]`).first();
-            await expect(option).toBeVisible({ timeout: 5000 });
-            await option.click();
-            removed += 1;
-            // Wait for the trigger's selected-value attribute to no longer include this value.
-            await expect.poll(async () => {
-                const current = await trigger.getAttribute('data-test-selected-value');
-                if (!current) return [];
-                return current.split(',').map(v => v.trim()).filter(Boolean);
-            }, { timeout: 5000 }).not.toContain(value);
-            testLogger.info('Deselected fingerprint option', { value, removed });
-        }
-
-        // Close the popover via keyboard — Escape is the canonical dismissal.
-        await this.page.keyboard.press('Escape');
-        await popover.waitFor({ state: 'hidden', timeout: 5000 });
-
-        return removed;
-    }
-
-    /**
-     * Submit the AddAlert form (Save button) and wait for the success toast.
-     * @returns {Promise<void>}
-     */
-    async submitAlertEdit() {
-        const submitBtn = this.page.locator(this.locators.alertSubmitButton);
-        await expect(submitBtn).toBeEnabled({ timeout: 10000 });
-        await submitBtn.click();
-        // OToast variant=success carries data-test="o-toast-success"; data-test-message holds the text.
-        await this.page.locator(this.locators.oToastSuccess).first().waitFor({ state: 'visible', timeout: 15000 });
-        testLogger.info('Alert update submitted — success toast visible');
+        await this.page.locator(this.locators.advancedTemplateOverrideSelect).waitFor({ state: 'visible', timeout: 10000 });
+        testLogger.info('Switched to Advanced tab');
     }
 }
diff --git a/tests/ui-testing/pages/alertsPages/alertsPage.js b/tests/ui-testing/pages/alertsPages/alertsPage.js
index 070645fcc5..7610c740ab 100644
--- a/tests/ui-testing/pages/alertsPages/alertsPage.js
+++ b/tests/ui-testing/pages/alertsPages/alertsPage.js
@@ -106,14 +106,7 @@ export class AlertsPage {
             multiTimeRangeDeleteButton: '[data-test="multi-time-range-alerts-delete-btn"]',
             goToViewEditorButton: '[data-test="go-to-view-editor-btn"]',
 
-            // Step 5: Deduplication (Scheduled only — in Advanced tab). Use data-test
-            // hooks from Deduplication.vue; the old `.step-deduplication .alert-v3-select`
-            // class chain no longer exists on newer builds (e.g. alpha pre-cloud).
-            stepDeduplication: '[data-test="alert-dedup-fingerprint-fields"]',
-            stepDeduplicationFingerprintSelect: '[data-test="alert-dedup-fingerprint-fields"]',
-            stepDeduplicationTimeWindowInput: '[data-test="alert-dedup-time-window-field"]',
-
-            // Step 6: Advanced settings
+            // Step 5: Advanced settings
             contextAttributesAddButton: '[data-test="alert-variables-add-btn"]',
             contextAttributeKeyInput: '[data-test="alert-variables-key-input"]',
             contextAttributeValueInput: '[data-test="alert-variables-value-input"]',
@@ -334,16 +327,6 @@ export class AlertsPage {
             addAlertTabCondition: '[data-test="add-alert-tab-condition"]',
             addAlertTabAdvanced: '[data-test="add-alert-tab-advanced"]',
 
-            // v3 Deduplication step (Advanced tab)
-            // OSelect wrapper has data-test, popover auto-derived suffix `-popover`,
-            // options auto-derived suffix `-option` with `data-test-value="<value>"` per item.
-            dedupFingerprintFieldsSelect: '[data-test="alert-dedup-fingerprint-fields"]',
-            dedupFingerprintFieldsTrigger: '[data-test="alert-dedup-fingerprint-fields-trigger"]',
-            dedupFingerprintFieldsPopover: '[data-test="alert-dedup-fingerprint-fields-popover"]',
-            dedupFingerprintFieldsOption: '[data-test="alert-dedup-fingerprint-fields-option"]',
-            dedupTimeWindowInput: '[data-test="alert-dedup-time-window"]',
-            dedupTimeWindowInputField: '[data-test="alert-dedup-time-window-field"]',
-
             // OToast (alerts module - success / error variants)
             oToastSuccess: '[data-test-variant="success"]',
             oToastError: '[data-test-variant="error"]',
@@ -758,18 +741,6 @@ export class AlertsPage {
         return result;
     }
 
-    async createScheduledAlertWithDeduplication(streamName, destinationName, randomValue, dedupConfig = {}) {
-        const result = await this.creationWizard.createScheduledAlertWithDeduplication(streamName, destinationName, randomValue, dedupConfig);
-        this.currentAlertName = result;
-        return result;
-    }
-
-    async createScheduledAlertWithDedupForValidation(streamName, column, value, destinationName, randomValue, dedupConfig = {}) {
-        const result = await this.creationWizard.createScheduledAlertWithDedupForValidation(streamName, column, value, destinationName, randomValue, dedupConfig);
-        this.currentAlertName = result;
-        return result;
-    }
-
     /**
      * Create a scheduled alert with PromQL query for metrics streams
      * Tests fix for bug #9967 - cannot save alert when selecting PromQL mode
@@ -806,14 +777,6 @@ export class AlertsPage {
         return this.creationWizard.deleteCondition(index);
     }
 
-    async verifyDeduplicationStepVisible() {
-        return this.creationWizard.verifyDeduplicationStepVisible();
-    }
-
-    async getDeduplicationConfig() {
-        return this.creationWizard.getDeduplicationConfig();
-    }
-
     // ==================== DELEGATE TO MANAGEMENT ====================
 
     async updateAlert(alertName) {
@@ -908,32 +871,12 @@ export class AlertsPage {
         return this.management.verifyAlertTriggerInValidationStream(alertName, validationStreamName, logsPage, waitTimeMs);
     }
 
-    // ==================== ALERT EDIT — DEDUP REGRESSION ====================
-
-    async waitForAlertListReady(timeout) {
-        return this.management.waitForAlertListReady(timeout);
-    }
-
-    async openAlertEditByName(alertName) {
-        return this.management.openAlertEditByName(alertName);
-    }
+    // ==================== ALERT EDIT ====================
 
     async openAdvancedTab() {
         return this.management.openAdvancedTab();
     }
 
-    async getSelectedFingerprintFields() {
-        return this.management.getSelectedFingerprintFields();
-    }
-
-    async removeAllFingerprintFields() {
-        return this.management.removeAllFingerprintFields();
-    }
-
-    async submitAlertEdit() {
-        return this.management.submitAlertEdit();
-    }
-
     // ==================== ALERT DETAIL PAGE ====================
 
     /**
@@ -4321,7 +4264,7 @@ export class AlertsPage {
      * Navigate through wizard steps by clicking Continue button multiple times
      * @param {number} times - Number of times to click Continue
      */
-    async navigateThroughWizardSteps(times = 5) {
+    async navigateThroughWizardSteps(times = 4) {
         for (let i = 0; i < times; i++) {
             const clicked = await this.clickContinueButton();
             if (!clicked) break;
diff --git a/tests/ui-testing/pages/apiCleanup.js b/tests/ui-testing/pages/apiCleanup.js
index 38a90e388d..0da1f27f20 100644
--- a/tests/ui-testing/pages/apiCleanup.js
+++ b/tests/ui-testing/pages/apiCleanup.js
@@ -3650,93 +3650,6 @@ class APICleanup {
         }
     }
 
-    /**
-     * ==========================================
-     * CORRELATION SETTINGS CLEANUP METHODS
-     * ==========================================
-     */
-
-    /**
-     * Clean up test semantic groups created by correlation settings tests
-     * Uses the alerts deduplication config API (same as frontend)
-     * Test groups created by ensureSemanticGroupsExist(): k8s-cluster, k8s-namespace, k8s-deployment, service
-     * @param {Array<string>} groupIds - Array of semantic group IDs to delete (default: test group IDs)
-     */
-    async cleanupCorrelationSettings(groupIds = ['k8s-cluster', 'k8s-namespace', 'k8s-deployment', 'service']) {
-        testLogger.info('Starting correlation settings cleanup', { groupIds });
-
-        try {
-            // First, fetch the current deduplication config
-            const getResponse = await this._fetch(`${this.baseUrl}/api/${this.org}/alerts/deduplication/config`, {
-                method: 'GET',
-                headers: {
-                    'Authorization': this.authHeader,
-                    'Content-Type': 'application/json'
-                }
-            });
-
-            if (!getResponse.ok) {
-                if (getResponse.status === 404) {
-                    testLogger.info('Deduplication config not found (nothing to clean up)');
-                    return;
-                }
-                testLogger.warn('Failed to fetch deduplication config', { status: getResponse.status });
-                return;
-            }
-
-            const config = await getResponse.json();
-            const currentGroups = config.semantic_field_groups || [];
-            testLogger.info('Current semantic groups in dedup config', { count: currentGroups.length });
-
-            if (currentGroups.length === 0) {
-                testLogger.info('No semantic groups to clean up');
-                return;
-            }
-
-            // Filter out the test groups
-            const remainingGroups = currentGroups.filter(g => !groupIds.includes(g.id));
-            const removedCount = currentGroups.length - remainingGroups.length;
-
-            if (removedCount === 0) {
-                testLogger.info('No test semantic groups found to clean up');
-                return;
-            }
-
-            testLogger.info('Removing test semantic groups', {
-                total: currentGroups.length,
-                removing: removedCount,
-                remaining: remainingGroups.length
-            });
-
-            // Update the config with remaining groups
-            const updatePayload = {
-                ...config,
-                semantic_field_groups: remainingGroups,
-                // Also clean up fingerprint groups that reference removed semantic groups
-                alert_fingerprint_groups: (config.alert_fingerprint_groups || [])
-                    .filter(id => !groupIds.includes(id))
-            };
-
-            const updateResponse = await this._fetch(`${this.baseUrl}/api/${this.org}/alerts/deduplication/config`, {
-                method: 'POST',
-                headers: {
-                    'Authorization': this.authHeader,
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify(updatePayload)
-            });
-
-            if (updateResponse.ok) {
-                testLogger.info('Correlation settings cleanup completed', { removedGroups: removedCount });
-            } else {
-                testLogger.warn('Failed to update deduplication config', { status: updateResponse.status });
-            }
-
-        } catch (error) {
-            testLogger.error('Correlation settings cleanup failed', { error: error.message });
-        }
-    }
-
     /**
      * IAM leftovers a CRASHED run orphaned: roles, groups, users and service accounts
      * under `prefix`.
diff --git a/tests/ui-testing/pages/commonActions.js b/tests/ui-testing/pages/commonActions.js
index 84ebe331db..0d0fa2dcf2 100644
--- a/tests/ui-testing/pages/commonActions.js
+++ b/tests/ui-testing/pages/commonActions.js
@@ -657,92 +657,6 @@ export class CommonActions {
         return `Basic ${credentials}`;
     }
 
-    /**
-     * Count alert notifications in validation stream
-     * Used for deduplication testing to verify suppression of duplicate alerts
-     * @param {string} validationStreamName - Name of the validation stream to query
-     * @param {string} alertName - Alert name to search for (partial match)
-     * @param {number} timeRangeMinutes - How far back to search (default: 15 minutes)
-     * @returns {Promise<{success: boolean, count: number, data: any[]}>}
-     */
-    async countAlertNotificationsInStream(validationStreamName, alertName, timeRangeMinutes = 15) {
-        const headers = getAuthHeaders();
-        const baseUrl = process.env["ZO_BASE_URL"];
-        const orgName = getOrgIdentifier();
-
-        const query = `SELECT * FROM "${validationStreamName}" WHERE str_match_ignore_case(text, '${alertName}')`;
-
-        const endTime = Date.now() * 1000; // microseconds
-        const startTime = endTime - (timeRangeMinutes * 60 * 1000 * 1000); // microseconds
-
-        const searchPayload = {
-            query: {
-                sql: query,
-                start_time: startTime,
-                end_time: endTime,
-                from: 0,
-                size: 1000
-            }
-        };
-
-        try {
-            const response = await this.page.request.post(`${baseUrl}/api/${orgName}/_search?type=logs`, {
-                headers,
-                data: searchPayload
-            });
-            const responseData = await response.json().catch(() => null);
-            const hits = responseData?.hits || [];
-            testLogger.debug(`Count notifications for "${alertName}" in ${validationStreamName}: found ${hits.length} notifications`);
-            return {
-                success: true,
-                count: hits.length,
-                data: hits
-            };
-        } catch (error) {
-            testLogger.error('Error counting notifications in stream', { error: error.message });
-            return { success: false, count: 0, data: [] };
-        }
-    }
-
-    /**
-     * Wait for exact notification count in validation stream
-     * Used for deduplication testing to verify the expected number of notifications
-     * @param {string} validationStreamName - Name of the validation stream
-     * @param {string} alertName - Alert name to search for
-     * @param {number} expectedCount - Expected number of notifications
-     * @param {number} maxWaitSeconds - Maximum time to wait (default: 120 seconds)
-     * @param {number} pollIntervalSeconds - How often to poll (default: 10 seconds)
-     * @returns {Promise<{match: boolean, actualCount: number, attempts: number}>}
-     */
-    async waitForExactNotificationCount(validationStreamName, alertName, expectedCount, maxWaitSeconds = 120, pollIntervalSeconds = 10) {
-        const maxAttempts = Math.ceil(maxWaitSeconds / pollIntervalSeconds);
-
-        testLogger.info(`Waiting for exactly ${expectedCount} notifications for "${alertName}" in "${validationStreamName}" (max ${maxWaitSeconds}s)...`);
-
-        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-            const result = await this.countAlertNotificationsInStream(validationStreamName, alertName, 15);
-
-            if (result.success && result.count === expectedCount) {
-                testLogger.info(`Found expected ${expectedCount} notifications after ${attempt * pollIntervalSeconds}s`);
-                return { match: true, actualCount: result.count, attempts: attempt };
-            }
-
-            if (result.count > expectedCount) {
-                testLogger.warn(`Found more notifications than expected: ${result.count} > ${expectedCount}`);
-                return { match: false, actualCount: result.count, attempts: attempt };
-            }
-
-            if (attempt < maxAttempts) {
-                testLogger.debug(`Attempt ${attempt}/${maxAttempts}: Found ${result.count} notifications, expected ${expectedCount}, waiting ${pollIntervalSeconds}s...`);
-                await new Promise(resolve => setTimeout(resolve, pollIntervalSeconds * 1000));
-            }
-        }
-
-        const finalResult = await this.countAlertNotificationsInStream(validationStreamName, alertName, 15);
-        testLogger.info(`Final count: ${finalResult.count} notifications (expected ${expectedCount})`);
-        return { match: finalResult.count === expectedCount, actualCount: finalResult.count, attempts: maxAttempts };
-    }
-
     /**
      * Find elements containing specific text (case-sensitive)
      * @param {string} text - Text to search for
diff --git a/tests/ui-testing/pages/dashboardPages/dashboard-chart.js b/tests/ui-testing/pages/dashboardPages/dashboard-chart.js
index c69662880a..bcd8235066 100644
--- a/tests/ui-testing/pages/dashboardPages/dashboard-chart.js
+++ b/tests/ui-testing/pages/dashboardPages/dashboard-chart.js
@@ -89,6 +89,50 @@ export default class ChartTypeSelector {
     return this.htmlRenderer.locator("script");
   }
 
+  getHtmlRendererElement(selector) {
+    return this.htmlRenderer.locator(selector);
+  }
+
+  // Page-wide, since an escaped element would land outside the renderer
+  getInjectedOnErrorImages() {
+    return this.page.locator("img[onerror]");
+  }
+
+  async getHtmlPanelSentinel() {
+    return this.page.evaluate(() => window.__o2HtmlPanelSentinel);
+  }
+
+  async addHtmlPanelContent(html) {
+    await this.selectChartType("html");
+    await this.fillHtmlEditor(html);
+  }
+
+  // A null target asserts the sanitizer dropped it and added no rel
+  async expectHtmlLinkTarget(selector, target) {
+    const element = this.getHtmlRendererElement(selector);
+    if (target === null) {
+      await expect(element).toHaveCount(1);
+      await expect(element).not.toHaveAttribute("target");
+      await expect(element).not.toHaveAttribute("rel");
+      return;
+    }
+    await expect(element).toHaveAttribute("target", target);
+    await expect(element).toHaveAttribute("rel", "noopener noreferrer");
+  }
+
+  async clickHtmlRendererElementForPopup(selector) {
+    const [popup] = await Promise.all([
+      this.page.context().waitForEvent("page"),
+      this.getHtmlRendererElement(selector).click(),
+    ]);
+    await popup.waitForLoadState("domcontentloaded");
+    return popup;
+  }
+
+  async isPopupOpenerNull(popup) {
+    return popup.evaluate(() => window.opener === null);
+  }
+
   // Returns the field-list row for a given field name
   getFieldListRow(fieldName) {
     return this.page.locator(`[data-test="o-field-list-row-${fieldName}"]`);
diff --git a/tests/ui-testing/pages/generalPages/correlationSettingsPage.js b/tests/ui-testing/pages/generalPages/correlationSettingsPage.js
index 4cb9822845..e26034f940 100644
--- a/tests/ui-testing/pages/generalPages/correlationSettingsPage.js
+++ b/tests/ui-testing/pages/generalPages/correlationSettingsPage.js
@@ -7,9 +7,9 @@ const testLogger = require('../../playwright-tests/utils/test-logger.js');
  * Route: /web/settings/correlation?org_identifier={orgId}
  *
  * Tabs:
- * - Service Identity (identity)
  * - Discovered Services (services)
- * - Alert Correlation (alert-correlation)
+ * - Detection Rules (discovery)
+ * - Field Mappings (field-aliases)
  */
 export class CorrelationSettingsPage {
     constructor(page) {
@@ -20,7 +20,7 @@ export class CorrelationSettingsPage {
         this.pageSubtitle = '.general-page-subtitle';
 
         // Tab selectors (OTabs - render as [role="tablist"] / [role="tab"])
-        // Note: tabs use name attribute: services, discovery, alert-correlation, field-aliases
+        // Note: tabs use name attribute: services, discovery, field-aliases
         this.tabsContainer = '[role="tablist"]';
         // The Correlation Settings tabs wrapper (data-test container).
         this.correlationSettingsTabs = '[data-test="correlation-settings-tabs"]';
@@ -29,11 +29,10 @@ export class CorrelationSettingsPage {
         // Placeholder text of the "+ Add field" OSelect trigger.
         this.selectAFieldText = 'Select a field';
         // Visible tab labels (post-revamp): the tab `name` attrs are
-        // services / discovery / alert-correlation / field-aliases, rendered as
+        // services / discovery / field-aliases, rendered as
         // these i18n labels.
         this.servicesTabName = 'Discovered Services';
         this.serviceDiscoveryTabName = 'Detection Rules';
-        this.alertCorrelationTabName = 'Alert Grouping';
         this.fieldAliasesTabName = 'Field Mappings';
         // Detection Rules view (the "Distinguish Services By" configuration tab)
         this.detectionRulesTabName = 'Detection Rules';
@@ -51,12 +50,6 @@ export class CorrelationSettingsPage {
         this.retryDiscoveredServicesBtn = '[data-test="retry-discovered-services-btn"]';
         this.refreshDiscoveredServicesBtn = '[data-test="refresh-discovered-services-btn"]';
 
-        // ==================== Alert Correlation Tab Selectors ====================
-        this.dedupSettingsRefreshBtn = '[data-test="dedup-settings-refresh-btn"]';
-        this.organizationDedupEnableCheckbox = '[data-test="organization-deduplication-enable-checkbox"]';
-        this.crossAlertEnableCheckbox = '[data-test="organizationdeduplication-enable-cross-alert-checkbox"]';
-        this.defaultWindowInput = '[data-test="organizationdeduplication-default-window-input"]';
-
         // ==================== Semantic Field Groups Selectors ====================
         this.semanticGroupCategorySelect = '[data-test="semantic-group-category-select"]';
         this.importJsonBtn = '[data-test="correlation-semanticfieldgroup-import-json-btn"]';
@@ -79,101 +72,6 @@ export class CorrelationSettingsPage {
         this.notification = '[role="alert"]';
     }
 
-    // ==================== Test Data Setup ====================
-
-    /**
-     * Ensure semantic groups exist in the backend for testing fingerprint checkboxes
-     * Adds any missing test groups to the org's semantic groups (GET, merge, PUT), keeping every existing group
-     * @param {string} orgId - Organization identifier
-     * @returns {Promise<boolean>} - True if successful
-     */
-    async ensureSemanticGroupsExist(orgId) {
-        const baseUrl = process.env["ZO_BASE_URL"];
-        const username = process.env["ZO_ROOT_USER_EMAIL"];
-        const password = process.env["ZO_ROOT_USER_PASSWORD"];
-        const authHeader = 'Basic ' + Buffer.from(`${username}:${password}`).toString('base64');
-
-        // Define test semantic groups that cover common use cases.
-        // Post-revamp shape: {id, display, group, fields} only — the per-group
-        // flags (is_scope / is_stable / normalize) were removed.
-        const testSemanticGroups = [
-            {
-                id: 'k8s-cluster',
-                display: 'K8s Cluster',
-                group: 'Kubernetes',
-                fields: ['k8s.cluster.name', 'k8s_cluster_name'],
-            },
-            {
-                id: 'k8s-namespace',
-                display: 'K8s Namespace',
-                group: 'Kubernetes',
-                fields: ['k8s.namespace.name', 'k8s_namespace_name'],
-            },
-            {
-                id: 'k8s-deployment',
-                display: 'K8s Deployment',
-                group: 'Kubernetes',
-                fields: ['k8s.deployment.name', 'k8s_deployment_name'],
-            },
-            {
-                id: 'service',
-                display: 'Service',
-                group: 'Common',
-                fields: ['service.name', 'service_name', 'service'],
-            }
-        ];
-
-        testLogger.info('Setting up test semantic groups via API', { orgId, groupCount: testSemanticGroups.length });
-
-        try {
-            const url = `${baseUrl}/api/${orgId}/alerts/deduplication/semantic-groups`;
-            const headers = {
-                'Authorization': authHeader,
-                'Content-Type': 'application/json'
-            };
-
-            // PUT replaces the whole list, so writing only the test groups would delete the org's defaults (e.g. `host`) for every other spec on the server.
-            const getResponse = await fetch(url, { headers });
-            if (!getResponse.ok) {
-                testLogger.error('GET semantic-groups failed', { status: getResponse.status });
-                return false;
-            }
-            const current = await getResponse.json();
-            const currentGroups = Array.isArray(current) ? current : current.groups || [];
-            const currentIds = new Set(currentGroups.map((g) => g.id));
-            const missing = testSemanticGroups.filter((g) => !currentIds.has(g.id));
-            if (missing.length === 0) {
-                testLogger.info('Test semantic groups already present', { orgId, total: currentGroups.length });
-                return true;
-            }
-
-            testLogger.info('PUT semantic groups', { url, adding: missing.map((g) => g.id) });
-            const putResponse = await fetch(url, {
-                method: 'PUT',
-                headers,
-                body: JSON.stringify([...currentGroups, ...missing])
-            });
-
-            const putText = await putResponse.text();
-            testLogger.info('PUT semantic-groups response', {
-                status: putResponse.status,
-                statusText: putResponse.statusText,
-                body: putText.substring(0, 500)
-            });
-
-            // Note: We intentionally do NOT POST to /config here.
-            // The config endpoint doesn't persist semantic_field_groups anyway (GET returns 0),
-            // and concurrent config POSTs in parallel tests cause race conditions where
-            // loadConfig() overwrites UI checkbox state with stale API values.
-            // The PUT above is the single source of truth for semantic groups.
-
-            return putResponse.ok;
-        } catch (error) {
-            testLogger.error('Failed to setup semantic groups', { error: error.message, stack: error.stack });
-            return false;
-        }
-    }
-
     // ==================== Navigation ====================
 
     async navigateToCorrelationSettings(orgId) {
@@ -195,12 +93,10 @@ export class CorrelationSettingsPage {
         // Use getByRole for tabs or filter by text
         const servicesTab = this.page.getByRole('tab', { name: this.servicesTabName });
         const serviceDiscoveryTab = this.page.getByRole('tab', { name: this.serviceDiscoveryTabName });
-        const alertCorrelationTab = this.page.getByRole('tab', { name: this.alertCorrelationTabName });
         const fieldAliasesTab = this.page.getByRole('tab', { name: this.fieldAliasesTabName });
 
         await expect(servicesTab).toBeVisible({ timeout: 15000 });
         await expect(serviceDiscoveryTab).toBeVisible();
-        await expect(alertCorrelationTab).toBeVisible();
         await expect(fieldAliasesTab).toBeVisible();
     }
 
@@ -223,22 +119,6 @@ export class CorrelationSettingsPage {
         await this.clickServicesTab();
     }
 
-    async clickAlertCorrelationTab() {
-        const tab = this.page.getByRole('tab', { name: this.alertCorrelationTabName });
-        // Wait for semantic-groups API response that loadConfig() triggers on component mount.
-        // This prevents a race condition where the test interacts with checkboxes before
-        // loadConfig() completes and overwrites localConfig with API values.
-        const semanticGroupsPromise = this.page.waitForResponse(
-            resp => resp.url().includes('/alerts/deduplication/semantic-groups') && resp.status() === 200,
-            { timeout: 15000 }
-        ).catch(() => {
-            testLogger.info('Semantic groups API response not intercepted (may have already fired)');
-        });
-        await tab.click();
-        await semanticGroupsPromise;
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-    }
-
     async expectServiceDiscoveryTabActive() {
         const tab = this.page.getByRole('tab', { name: this.serviceDiscoveryTabName });
         await expect(tab).toHaveAttribute('aria-selected', 'true', { timeout: 5000 });
@@ -249,11 +129,6 @@ export class CorrelationSettingsPage {
         await expect(tab).toHaveAttribute('aria-selected', 'true', { timeout: 5000 });
     }
 
-    async expectAlertCorrelationTabActive() {
-        const tab = this.page.getByRole('tab', { name: this.alertCorrelationTabName });
-        await expect(tab).toHaveAttribute('aria-selected', 'true', { timeout: 5000 });
-    }
-
     // ==================== Tab / Button Getters (raw-selector relocation) ====================
 
     /**
@@ -484,93 +359,6 @@ export class CorrelationSettingsPage {
         await expect(refreshBtn).toBeVisible({ timeout: 15000 });
     }
 
-    // ==================== Alert Correlation Tab Actions ====================
-
-    async expectAlertCorrelationContentVisible() {
-        await expect(this.page.locator(this.organizationDedupEnableCheckbox)).toBeVisible({ timeout: 15000 });
-    }
-
-    async clickEnableDeduplicationCheckbox() {
-        await this.page.locator(this.organizationDedupEnableCheckbox).click();
-    }
-
-    async clickEnableCrossAlertCheckbox() {
-        await this.page.locator(this.crossAlertEnableCheckbox).click();
-    }
-
-    async expectCrossAlertCheckboxVisible() {
-        await expect(this.page.locator(this.crossAlertEnableCheckbox)).toBeVisible({ timeout: 5000 });
-    }
-
-    async expectCrossAlertCheckboxHidden() {
-        await expect(this.page.locator(this.crossAlertEnableCheckbox)).not.toBeVisible({ timeout: 5000 });
-    }
-
-    /**
-     * Check if the cross-alert deduplication checkbox is currently checked
-     * @returns {Promise<boolean>} True if checkbox is checked
-     */
-    async isCrossAlertCheckboxChecked() {
-        const checkbox = this.page.locator(this.crossAlertEnableCheckbox);
-        // The checkbox uses aria-checked attribute
-        const ariaChecked = await checkbox.getAttribute('aria-checked');
-        if (ariaChecked !== null) {
-            return ariaChecked === 'true';
-        }
-        // Fallback to checking the inner input if visible
-        const input = checkbox.locator('input[type="checkbox"]');
-        if (await input.count() > 0) {
-            return await input.isChecked();
-        }
-        // Last resort - check for checked class
-        const hasCheckedClass = await checkbox.evaluate(el => {
-            return el.classList.contains('checked') ||
-                   el.closest('[role="checkbox"]')?.getAttribute('aria-checked') === 'true';
-        }).catch(() => false);
-        return hasCheckedClass;
-    }
-
-    async fillTimeWindowInput(minutes) {
-        // OFormInput forwards data-test to a wrapper <div>; the real control is
-        // the inner <input type="number">.
-        const wrap = this.page.locator(this.defaultWindowInput);
-        await expect(wrap).toBeVisible({ timeout: 5000 });
-        await wrap.locator('input').first().fill(String(minutes));
-    }
-
-    async getTimeWindowValue() {
-        return await this.page.locator(this.defaultWindowInput).locator('input').first().inputValue();
-    }
-
-    async clickRefreshDedupSettings() {
-        await this.page.locator(this.dedupSettingsRefreshBtn).click();
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-    }
-
-    async expectEnableDedupCheckboxVisible() {
-        await expect(this.page.locator(this.organizationDedupEnableCheckbox)).toBeVisible({ timeout: 10000 });
-    }
-
-    async expectTimeWindowInputVisible() {
-        await expect(this.page.locator(this.defaultWindowInput)).toBeVisible({ timeout: 10000 });
-    }
-
-    async expectDedupRefreshButtonVisible() {
-        await expect(this.page.locator(this.dedupSettingsRefreshBtn)).toBeVisible({ timeout: 10000 });
-    }
-
-    // ==================== Fingerprint Checkbox Actions ====================
-
-    async clickFingerprintCheckbox(groupId) {
-        const selector = `[data-test="organizationdeduplication-fingerprint-${groupId}-checkbox"]`;
-        await this.page.locator(selector).click();
-    }
-
-    async expectFingerprintCheckboxVisible(groupId) {
-        const selector = `[data-test="organizationdeduplication-fingerprint-${groupId}-checkbox"]`;
-        await expect(this.page.locator(selector)).toBeVisible({ timeout: 5000 });
-    }
-
     // ==================== Semantic Field Groups Actions ====================
 
     async clickCategorySelect() {
@@ -707,35 +495,6 @@ export class CorrelationSettingsPage {
         await this.page.waitForLoadState('networkidle', { timeout: 30000 }).catch(() => {});
     }
 
-    async isDedupCheckboxChecked() {
-        const checkbox = this.page.locator(this.organizationDedupEnableCheckbox);
-        // Checkboxes use aria-checked or have a specific class when checked
-        const isChecked = await checkbox.getAttribute('aria-checked');
-        if (isChecked !== null) {
-            return isChecked === 'true';
-        }
-        // Fallback: check for checked class
-        const classList = await checkbox.getAttribute('class');
-        return classList?.includes('checked');
-    }
-
-    // ==================== Alert Correlation Save Button ====================
-
-    async clickSaveAlertCorrelation() {
-        // The save button in Alert Correlation tab
-        const saveBtn = this.page.getByRole('button', { name: /save/i }).last();
-        await saveBtn.click();
-        await this.page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-    }
-
-    async expectAlertCorrelationSaveSuccess() {
-        // Wait for positive notification about saved settings
-        const notification = this.page.locator('[role="alert"]');
-        await expect(notification).toBeVisible({ timeout: 10000 });
-        const text = await notification.textContent();
-        return text?.toLowerCase().includes('saved') || text?.toLowerCase().includes('success');
-    }
-
     // ==================== Phase 1 High Priority - Dimension Management ====================
 
     /**
@@ -816,56 +575,7 @@ export class CorrelationSettingsPage {
         await expect(item).not.toBeVisible({ timeout: 5000 });
     }
 
-    // ==================== Phase 1 High Priority - Fingerprint Groups ====================
-
-    /**
-     * Get all fingerprint group checkboxes
-     * @returns {import('@playwright/test').Locator}
-     */
-    getFingerprintGroupCheckboxes() {
-        return this.page.locator('[data-test^="organizationdeduplication-fingerprint-"]');
-    }
-
-    /**
-     * Expect fingerprint groups section to be visible
-     */
-    async expectFingerprintGroupsVisible() {
-        const checkboxes = this.getFingerprintGroupCheckboxes();
-        await expect(checkboxes.first()).toBeVisible({ timeout: 10000 });
-    }
-
-    /**
-     * Expect fingerprint groups section to be hidden
-     */
-    async expectFingerprintGroupsHidden() {
-        const checkboxes = this.page.locator('[data-test^="organizationdeduplication-fingerprint-"]');
-        await expect(checkboxes.first()).not.toBeVisible({ timeout: 5000 });
-    }
-
-    /**
-     * Get count of fingerprint group checkboxes
-     * @returns {Promise<number>}
-     */
-    async getFingerprintGroupsCount() {
-        const checkboxes = this.getFingerprintGroupCheckboxes();
-        return await checkboxes.count();
-    }
-
-    /**
-     * Check if a specific fingerprint group is checked
-     * @param {string} groupId - The group ID
-     * @returns {Promise<boolean>}
-     */
-    async isFingerprintGroupChecked(groupId) {
-        const selector = `[data-test="organizationdeduplication-fingerprint-${groupId}-checkbox"]`;
-        const checkbox = this.page.locator(selector);
-        const isChecked = await checkbox.getAttribute('aria-checked');
-        if (isChecked !== null) {
-            return isChecked === 'true';
-        }
-        const classList = await checkbox.getAttribute('class');
-        return classList?.includes('checked');
-    }
+    // ==================== Phase 1 High Priority - Validation Notifications ====================
 
     /**
      * Expect validation error notification to be visible
@@ -880,14 +590,6 @@ export class CorrelationSettingsPage {
         }
     }
 
-    /**
-     * Click the Cancel button in Alert Correlation tab
-     */
-    async clickCancelAlertCorrelation() {
-        const cancelBtn = this.page.getByRole('button', { name: /cancel/i });
-        await cancelBtn.click();
-    }
-
     // ==================== Phase 1 High Priority - Discovered Services ====================
 
     /**
diff --git a/tests/ui-testing/pages/iamPages/rolesPage.js b/tests/ui-testing/pages/iamPages/rolesPage.js
index 782459ff9f..b7c3496554 100644
--- a/tests/ui-testing/pages/iamPages/rolesPage.js
+++ b/tests/ui-testing/pages/iamPages/rolesPage.js
@@ -93,6 +93,16 @@ export class RolesPage {
         this.summaryEmpty = page.locator('[data-test="edit-role-summary-empty"]');
         this.summaryLoading = page.locator('[data-test="edit-role-summary-loading"]');
 
+        // ---------- presets panel (Role Overview, every role) ----------
+        // The panel shows either the preset list or one preset's detail, never both.
+        this.presetsPanel = page.locator('[data-test="edit-role-presets-panel"]');
+        this.presetDetail = page.locator('[data-test="edit-role-preset-detail"]');
+        this.presetBack = page.locator('[data-test="edit-role-preset-back"]');
+        this.presetApply = page.locator('[data-test="edit-role-preset-apply"]');
+        // A viewer can close the panel; the floating button reopens it, and each page visit starts open.
+        this.presetsClose = page.locator('[data-test="edit-role-presets-close"]');
+        this.presetsOpen = page.locator('[data-test="edit-role-presets-open"]');
+
         // ---------- pane pagination (OTable's own controls, scoped to the pane) ----------
         // MUST be scoped. GroupUsers and GroupServiceAccounts stay MOUNTED under
         // v-show in EditRole.vue, so an unscoped `o2-table-*` slug also matches the
@@ -120,6 +130,10 @@ export class RolesPage {
 
         // ---------- unsaved drawer ----------
         this.drawer = page.locator('[data-test="edit-role-unsaved-drawer"]');
+        // The drawer's own Save; the page Save underneath is unclickable while it is open.
+        this.drawerSave = page.locator('[data-test="edit-role-unsaved-save"]');
+        // "Not added yet": grants the role needs to work that are not staged.
+        this.drawerCompanions = page.locator('[data-test="edit-role-companions"]');
 
         this.toastMessages = page.locator('[data-test="o-toast-message"]');
     }
@@ -274,9 +288,46 @@ export class RolesPage {
         return this.page.locator('[data-test^="edit-role-unsaved-undo-"]');
     }
 
-    /** Preset cards in the empty state carry no slug of their own; match their label. */
-    presetCard(label) {
-        return this.summaryEmpty.getByText(label, { exact: true });
+    /** Companion row actions: Add stages the module-wide grant; Open (Streams Get only) opens the module instead. */
+    companionAdd(moduleKey) {
+        return this.page.locator(`[data-test="edit-role-companion-add-${moduleKey}"]`);
+    }
+    companionOpen(moduleKey) {
+        return this.page.locator(`[data-test="edit-role-companion-open-${moduleKey}"]`);
+    }
+
+    /** A row in the Presets panel, by preset id (readonly, dbm, k8s, rum_viewer, rum_editor, alert_manager, …). */
+    presetRow(id) {
+        return this.page.locator(`[data-test="edit-role-preset-${id}"]`);
+    }
+    /** The row's "+N" or "In Role" badge. */
+    presetStatus(id) {
+        return this.page.locator(`[data-test="edit-role-preset-${id}-status"]`);
+    }
+
+    /** Reopens the Presets panel if a test closed it earlier on the same page visit. */
+    async ensurePresetsOpen() {
+        await expect(this.presetsPanel.or(this.presetsOpen)).toBeVisible({ timeout: 15000 });
+        if (await this.presetsOpen.isVisible()) await this.presetsOpen.click();
+        await expect(this.presetsPanel).toBeVisible();
+    }
+
+    /** Opens a preset's detail in the panel. */
+    async openPreset(id) {
+        await this.ensurePresetsOpen();
+        await this.presetRow(id).click();
+        await expect(this.presetDetail).toBeVisible({ timeout: 15000 });
+    }
+
+    /**
+     * Opens a preset and clicks Add. Add stays disabled until the preview is ready
+     * (stream presets load their lists first), so wait for it rather than click early.
+     */
+    async applyPreset(id) {
+        await this.openPreset(id);
+        await expect(this.presetApply).toBeEnabled({ timeout: 30000 });
+        await this.presetApply.click();
+        await this.waitForPresetStaged();
     }
 
     // ================= capability probes =================
@@ -448,8 +499,11 @@ export class RolesPage {
 
     // ================= save =================
 
-    /** Resolves with the PUT body the save sent, or null when no request fired. */
-    async saveAndCapture({ expectRequest = true } = {}) {
+    /**
+     * Resolves with the PUT body the save sent, or null when no request fired.
+     * `via` picks the Save button: the page footer's (default) or the drawer's `drawerSave`.
+     */
+    async saveAndCapture({ expectRequest = true, via = this.saveButton } = {}) {
         let captured = null;
         const onRequest = (req) => {
             if (req.method() === 'PUT' && /\/roles\/[^/]+$/.test(new URL(req.url()).pathname)) {
@@ -457,7 +511,7 @@ export class RolesPage {
             }
         };
         this.page.on('request', onRequest);
-        await this.saveButton.click();
+        await via.click();
         // A save that legitimately sends nothing must not be papered over by a wait.
         await this.page.waitForTimeout(expectRequest ? 3000 : 2500);
         this.page.off('request', onRequest);
@@ -496,8 +550,9 @@ export class RolesPage {
      *
      * It is an ODrawer — a modal dismissable layer — so while it is open its subtree
      * intercepts pointer events and Save is visible and enabled but UNCLICKABLE. It
-     * self-closes only once nothing is staged (S-05), so any test that visits the
-     * drawer and then saves has to close it first.
+     * self-closes only once nothing is staged and no companion grant is missing (S-05),
+     * so any test that visits the drawer and then saves has to close it first, or save
+     * through `drawerSave`.
      */
     async closeDrawer() {
         if (!(await this.drawer.isVisible().catch(() => false))) return;
diff --git a/tests/ui-testing/pages/metricsPages/metricsPage.js b/tests/ui-testing/pages/metricsPages/metricsPage.js
index 1927111a6f..a4df477510 100644
--- a/tests/ui-testing/pages/metricsPages/metricsPage.js
+++ b/tests/ui-testing/pages/metricsPages/metricsPage.js
@@ -157,11 +157,12 @@ export class MetricsPage {
         this.shareErrorToast = page.locator('[data-test-variant="error"][data-test-message*="Error shortening link"]');
         this.toastMessage = page.locator('[data-test="o-toast-message"]');
 
-        // Query history drawer (QueryHistoryDrawer.vue)
         this.historyButton = page.locator('[data-test="metrics-history-btn"]');
-        this.historyTable = page.locator('[data-test="metrics-history-table"]');
-        this.historySearch = page.locator('[data-test="metrics-history-search"] input');
-        this.historyStarredOnly = page.locator('[data-test="metrics-history-starred-only"]');
+        this.historyPopover = page.locator('[data-test="recent-searches-popover"]');
+        this.historyViewAll = this.historyPopover.locator('[data-test="recent-searches-view-all"]');
+        this.historyDrawer = page.locator('[data-test="recent-searches-drawer"]');
+        this.historySearch = this.historyDrawer.locator('[data-test="recent-searches-search"] input');
+        this.historyStarredOnly = this.historyDrawer.locator('[data-test="recent-searches-starred-only"]');
     }
 
     /**
@@ -2793,7 +2794,8 @@ export class MetricsPage {
 
     async openQueryHistory() {
         await this.historyButton.click();
-        await this.historyTable.waitFor({ state: 'visible', timeout: 15000 });
+        await this.historyViewAll.click();
+        await this.historyDrawer.waitFor({ state: 'visible', timeout: 15000 });
     }
 
     /** Resolves once the filtered list answers: a click landing mid-re-render is lost. */
@@ -2805,24 +2807,33 @@ export class MetricsPage {
         await listed;
     }
 
-    /** The history row whose query cell is exactly `query`. */
+    /** The drawer row whose query text contains `query`. */
     historyRow(query) {
-        return this.historyTable.locator('[data-test^="o2-table-row-"]').filter({
-            has: this.page.locator('[data-test="o2-table-cell-query"]', { hasText: query }),
+        return this.historyDrawer.locator('[data-test^="recent-searches-drawer-row-"]').filter({
+            has: this.page.locator('[data-test="recent-searches-drawer-query"]', { hasText: query }),
         });
     }
 
     /** A row's star toggle; its data-test carries the entry id, so match the prefix. */
     historyStarButton(query) {
-        return this.historyRow(query).locator('[data-test^="metrics-history-star-"]');
+        return this.historyRow(query).locator('[data-test^="recent-searches-star-"]');
     }
 
+    /** Picks `action` (load, delete, copy-link, copy-query) from a row's "More" menu. */
+    async historyRowAction(query, action) {
+        const rowTest = await this.historyRow(query).getAttribute('data-test');
+        const id = rowTest.replace('recent-searches-drawer-row-', '');
+        await this.historyRow(query).locator(`[data-test="recent-searches-more-${id}"]`).click();
+        await this.page.locator(`[data-test="recent-searches-${action}-${id}"]`).click();
+    }
+
+    /** The DELETE is sent once the row's Undo toast closes, so callers wait for it. */
     async deleteHistoryEntry(query) {
-        await this.historyRow(query).locator('[data-test^="metrics-history-delete-"]').click();
+        await this.historyRowAction(query, 'delete');
     }
 
-    /** Clicking a row's query cell loads the entry into the open editor. */
+    /** Loads the entry into the editor without running it. */
     async loadHistoryEntry(query) {
-        await this.historyRow(query).locator('[data-test="o2-table-cell-query"]').click();
+        await this.historyRowAction(query, 'load');
     }
 }
\ No newline at end of file
diff --git a/tests/ui-testing/pages/page-manager.js b/tests/ui-testing/pages/page-manager.js
index 35bef1dd6c..f349553a97 100644
--- a/tests/ui-testing/pages/page-manager.js
+++ b/tests/ui-testing/pages/page-manager.js
@@ -87,6 +87,7 @@ import { MetricsExplorerPage } from "./metricsPages/metricsExplorerPage.js";
 import { TracesPage } from "./tracesPages/tracesPage.js";
 import { ServiceGraphPage } from "./tracesPages/serviceGraphPage.js";
 import { ServicesCatalogPage } from "./tracesPages/servicesCatalogPage.js";
+import { ProfilesPage } from "./profilesPages/profilesPage.js";
 import { DatabaseMonitoringPage } from "./dbmPages/databaseMonitoringPage.js";
 import { RumPage } from "./rumPages/rumPage.js";
 import { RumSessionsPage } from "./rumPages/rumSessionsPage.js";
@@ -285,6 +286,7 @@ class PageManager {
     this.tracesPage = new TracesPage(page);
     this.serviceGraphPage = new ServiceGraphPage(page);
     this.servicesCatalogPage = new ServicesCatalogPage(page);
+    this.profilesPage = new ProfilesPage(page);
     this.databaseMonitoringPage = new DatabaseMonitoringPage(page);
     this.rumPage = new RumPage(page);
     this.reportsPage = new ReportsPage(page);
diff --git a/tests/ui-testing/pages/profilesPages/profilesPage.js b/tests/ui-testing/pages/profilesPages/profilesPage.js
new file mode 100644
index 0000000000..b0928a4b63
--- /dev/null
+++ b/tests/ui-testing/pages/profilesPages/profilesPage.js
@@ -0,0 +1,1247 @@
+// Page object for Continuous Profiling (/web/profiles); selectors from web/src/plugins/profiles and FlameGraphView.vue.
+
+import { expect } from '@playwright/test';
+import { PNG } from 'pngjs';
+
+const { getOrgIdentifier } = require('../../playwright-tests/utils/cloud-auth.js');
+
+const FLAME_ROW_PX = 26;
+const FLAME_PLOT_INSET_PX = 10;
+const FLAME_TOOLTIP_Z = 'z-index: 9999999';
+
+// Hand-computed frame geometry (percent of width) for the reference checkout cpu tree (total 12 s).
+export const CHECKOUT_FRAMES = {
+  root: { depth: 0, left: 0, width: 100, path: 'root' },
+  main: { depth: 1, left: 0, width: 98.75, path: 'root/0' },
+  runtime_main: { depth: 1, left: 98.75, width: 1.25, path: 'root/1' },
+  handle_order: { depth: 2, left: 0, width: 98.75, path: 'root/0/0' },
+  gc_sweep: { depth: 2, left: 98.75, width: 1.25, path: 'root/1/0' },
+  db_query: { depth: 3, left: 0, width: 50, path: 'root/0/0/0' },
+  json_encode: { depth: 3, left: 50, width: 33.333, path: 'root/0/0/1' },
+  process_payment: { depth: 3, left: 83.333, width: 2.083, path: 'root/0/0/2' },
+};
+
+// Reference catalog cpu tree (total 5.515 s): catalog_main 4.515 s, [truncated] 1 s, 55 values below the 0.1 % draw floor.
+export const CATALOG_FRAMES = {
+  root: { depth: 0, left: 0, width: 100 },
+  catalog_main: { depth: 1, left: 0, width: 81.868 },
+  truncated: { depth: 1, left: 81.868, width: 18.132 },
+  wide_root: { depth: 2, left: 0, width: 81.868 },
+  smallFrames: { depth: 3, left: 79.076, width: 2.792 },
+};
+
+/** A frame spanning the whole plot at `depth` (zoomed frames and their dimmed callers). */
+export const fullWidthFrame = (depth) => ({ depth, left: 0, width: 100 });
+
+export class ProfilesPage {
+  constructor(page) {
+    this.page = page;
+
+    this.pageRoot = '[data-test="profiles-page"]';
+    this.pageTitle = '[data-test="profiles-page-title"]';
+    this.betaBadge = '[data-test="beta-badge"]';
+    this.datePrevBtn = '[data-test="profiles-date-picker"] [data-test="date-time-prev-btn"]';
+    this.dateNextBtn = '[data-test="profiles-date-picker"] [data-test="date-time-next-btn"]';
+    this.dateBtn = '[data-test="profiles-date-picker"] [data-test="date-time-btn"]';
+    this.shareBtn = '[data-test="profiles-share-btn"]';
+    this.runBtn = '[data-test="profiles-run-query"]';
+    this.cancelBtn = '[data-test="profiles-cancel-query"]';
+    this.runOptionsBtn = '[data-test="profiles-run-options"]';
+    this.autoRunToggle = '[data-test="profiles-auto-run-toggle"]';
+    this.streamSelect = 'profiles-stream-select';
+    this.serviceSelect = 'profiles-service-select';
+    this.typeSelect = 'profiles-type-select';
+
+    this.addFilterBtn = '[data-test="profiles-add-filter"]';
+    this.tagKeySelect = 'profiles-tag-key-select';
+    this.tagValueSelect = 'profiles-tag-value-select';
+    this.filterChips = '[data-test^="profiles-filter-chip-"]';
+
+    this.errorState = '[data-test="profiles-error"]';
+    this.noStreamState = '[data-test="profiles-no-stream"]';
+    this.searchCancelledState = '[data-test="profiles-search-cancelled"]';
+    this.noResultsState = '[data-test="profiles-no-results"]';
+    this.errorBanner = '[data-test="profiles-error-banner"]';
+    this.errorRetryBtn = '[data-test="profiles-error-retry"]';
+    this.partialResultBanner = '[data-test="profiles-partial-result"]';
+
+    this.seriesCard = '[data-test="profiles-series-card"]';
+    this.seriesChart = '[data-test="profiles-series-card"] [data-test="chart-renderer"]';
+    this.breakdownSelect = 'profiles-breakdown-select';
+    this.breakdownLegend = '[data-test="profiles-breakdown-legend"]';
+    this.breakdownChipOthers = '[data-test="profiles-breakdown-chip-others"]';
+    this.seriesSkeleton = '[data-test="profiles-series-skeleton"]';
+    this.noSeries = '[data-test="profiles-no-series"]';
+
+    this.searchInput = '[data-test="profiles-search-functions-field"]';
+    this.searchSummary = '[data-test="profiles-search-summary"]';
+    this.resultsExpandBtn = '[data-test="profiles-results-expand"]';
+    this.topTable = '[data-test="profiles-top-table"]';
+    this.stackTable = '[data-test="profiles-stack-table"]';
+    this.flameSkeleton = '[data-test="profiles-flame-skeleton"]';
+    this.sandwichFunction = 'profiles-sandwich-function';
+    this.sandwichCoverage = '[data-test="profiles-sandwich-coverage"]';
+    this.sandwichSkeleton = '[data-test="profiles-sandwich-skeleton"]';
+    this.loadingIndicators = [
+      '[data-test="profiles-series-skeleton"]',
+      '[data-test="profiles-flame-skeleton"]',
+      '[data-test="profiles-sandwich-skeleton"]',
+      '[data-test="profiles-top-table"] [data-test="o2-table"][data-test-loading="true"]',
+      '[data-test="profiles-stack-table"] [data-test="o2-table"][data-test-loading="true"]',
+    ].join(', ');
+
+    this.details = '[data-test="profiles-function-details"]';
+    this.detailsCopy = '[data-test="profiles-function-details-copy"]';
+    this.detailsClose = '[data-test="profiles-function-details-close"]';
+    this.detailsPackage = '[data-test="profiles-function-details-package"]';
+    this.detailsSelf = '[data-test="profiles-function-details-self"]';
+    this.detailsTotal = '[data-test="profiles-function-details-total"]';
+    this.detailsCalledBy = '[data-test="profiles-function-details-called-by"]';
+    this.detailsCalls = '[data-test="profiles-function-details-calls"]';
+    this.detailsSandwich = '[data-test="profiles-function-details-sandwich"]';
+    this.detailsShow = '[data-test="profiles-function-details-show"]';
+
+    this.compare = '[data-test="profiles-compare"]';
+    this.compareLabel = 'profiles-compare-label';
+    this.compareBaseline = 'profiles-compare-baseline';
+    this.compareComparison = 'profiles-compare-comparison';
+    this.compareSwap = '[data-test="profiles-compare-swap"]';
+    this.compareSkeleton = '[data-test="profiles-compare-skeleton"]';
+    this.compareMessage = '[data-test="profiles-compare-message"]';
+    this.compareFlame = '[data-test="profiles-compare-flame"]';
+    this.compareTable = '[data-test="profiles-compare-table"]';
+    this.compareSideBaseline = '[data-test="profiles-compare-side-baseline"]';
+    this.compareSideComparison = '[data-test="profiles-compare-side-comparison"]';
+
+    this.flameViewOptions = '[data-test="flame-graph-view-options"]';
+    this.flameAlignLeft = '[data-test="flame-graph-align-left"]';
+    this.flameAlignRight = '[data-test="flame-graph-align-right"]';
+    this.flameRootAtBottom = '[data-test="flame-graph-root-at-bottom-btn"]';
+    this.flamePlot = '[data-test="flame-graph-plot"]';
+    this.flameFrameMore = '[data-test="flame-graph-frame-more"]';
+    this.flameZoomHint = '[data-test="flame-graph-zoom-hint"]';
+    this.flameZoomHintNever = '[data-test="flame-graph-zoom-hint-never"]';
+    this.flameZoomHintClose = '[data-test="flame-graph-zoom-hint-close"]';
+    this.flameMenu = '[data-test="flame-graph-frame-menu"]';
+
+    this.successToast = '[data-test-variant="success"]';
+    this.menuProfiles = '[data-test="menu-link-/profiles-item"]';
+    this.menuTraces = '[data-test="menu-link-/traces-item"]';
+    this.menuLinks = '[data-test^="menu-link-"]';
+    this.navRail = '[data-test="navbar-main-nav"]';
+
+    this.streamTypeFilter = '[data-test="log-stream-type-filter"]';
+    this.streamSearchInput = '[data-test="streams-search-stream-input-field"]';
+    this.streamExploreBtn = '[data-test="log-stream-explore-btn"]';
+    this.ingestionProfilesTab = '[data-test="ingestion-custom-tab-ingestProfiles"]';
+    this.ingestionOtelTab = '[data-test="ingestion-profiles-tab-otelCollector"]';
+    this.ingestionOtelBlock = '[data-test="ingestion-profiles-otel-code-block-pre"]';
+    this.ingestionOtelStartBlock = '[data-test="ingestion-profiles-otel-start-code-block-pre"]';
+    this.ingestionOtelGrpcBlock = '[data-test="ingestion-profiles-otel-grpc-code-block-pre"]';
+    this.traceViewProfileBtn = '[data-test="trace-details-sidebar-header-toolbar-view-profile-btn"]';
+  }
+
+  orgName() {
+    return getOrgIdentifier();
+  }
+
+  baseUrl() {
+    return (process.env['ZO_BASE_URL'] || '').replace(/\/+$/, '');
+  }
+
+  /** Patches /config and /api/{org}/config so Auto Run and the profiling flag do not depend on how the server was started. */
+  async mockServerConfig({ autoQuery = false, profiling = true } = {}) {
+    await this.page.route(/\/config(\?.*)?$/, async (route) => {
+      const url = new URL(route.request().url());
+      if (url.pathname !== '/config' && !/^\/api\/[^/]+\/config$/.test(url.pathname)) return route.fallback();
+      const response = await route.fetch();
+      const body = await response.json();
+      await route.fulfill({
+        response,
+        json: { ...body, auto_query_enabled: autoQuery, profiling_enabled: profiling },
+      });
+    });
+  }
+
+  /** Drops this page's routes so an in-flight mock cannot fail the test after it ends. */
+  async teardown() {
+    await this.page.unrouteAll({ behavior: 'ignoreErrors' });
+  }
+
+  /** Hides the one-time flame zoom hint so it never covers a frame the test clicks. */
+  async hideFlameZoomHint() {
+    await this.page.addInitScript(() => localStorage.setItem('o2_flame_zoom_hint_hidden', '1'));
+  }
+
+  seededUrl({ stream, from, to, period, service, type = 'cpu', unit = 'nanoseconds', view = 'top', filters, extra = {} }) {
+    const params = new URLSearchParams({ org_identifier: this.orgName(), stream });
+    if (from && to) {
+      params.set('from', String(from));
+      params.set('to', String(to));
+    }
+    if (period) params.set('period', period);
+    if (service) params.set('service_name', service);
+    if (type) {
+      params.set('profile_type', type);
+      params.set('profile_unit', unit);
+    }
+    if (filters) params.set('filters', filters);
+    if (view) params.set('view', view);
+    for (const [key, value] of Object.entries(extra)) params.set(key, value);
+    return `${this.baseUrl()}/web/profiles?${params.toString()}`;
+  }
+
+  /** Opens the page on a seeded reference stream (`ref` from seedReferenceStream) and waits for the run. */
+  async gotoRef(ref, { service = 'checkout', view = 'top', type, unit, filters, extra = {} } = {}) {
+    await this.gotoSeeded({ stream: ref.stream, ...ref.window, service, view, filters, extra, ...(type ? { type, unit } : {}) });
+  }
+
+  async gotoSeeded(options) {
+    await this.page.goto(this.seededUrl(options));
+    await this.waitForPageReady();
+  }
+
+  /** Opens a seeded URL and returns once the page shell is up, without waiting for the run. */
+  async openSeededNoWait(options) {
+    await this.page.goto(this.seededUrl(options));
+    await expect(this.page.locator(this.pageRoot)).toBeVisible({ timeout: 30000 });
+  }
+
+  async gotoProfiles() {
+    await this.page.goto(`${this.baseUrl()}/web/profiles?org_identifier=${this.orgName()}`);
+    await this.waitForPageReady();
+  }
+
+  async gotoUrl(url) {
+    await this.page.goto(url);
+    await this.waitForPageReady();
+  }
+
+  async reload() {
+    await this.page.reload();
+    await this.waitForPageReady();
+  }
+
+  async waitForPageReady() {
+    await expect(this.page.locator(this.pageRoot)).toBeVisible({ timeout: 30000 });
+    await this.waitForRunIdle();
+  }
+
+  /** Waits until the query AND the page init (meta) are done: skeletons render while either runs, and init ignores input. */
+  async waitForRunIdle() {
+    await expect(this.page.locator(this.cancelBtn)).toHaveCount(0, { timeout: 30000 });
+    await expect(this.page.locator(this.runBtn)).toBeVisible({ timeout: 30000 });
+    // Before the org is known nothing has started yet; a picked stream (or the no-stream state) proves init ran.
+    const initStarted = this.page.locator(`[data-test="${this.streamSelect}-trigger"]:not([data-test-selected-value=""])`);
+    await expect(initStarted.or(this.page.locator(this.noStreamState)).first()).toBeVisible({ timeout: 30000 });
+    await expect(this.page.locator(this.loadingIndicators)).toHaveCount(0, { timeout: 30000 });
+  }
+
+  /** In-app navigation through the SPA router, as a menu click would do. */
+  async routerPush(location) {
+    await this.page.evaluate((to) => {
+      const app = document.querySelector('#app')?.__vue_app__;
+      return app.config.globalProperties.$router.push(to);
+    }, location);
+  }
+
+  currentQuery() {
+    return Object.fromEntries(new URL(this.page.url()).searchParams.entries());
+  }
+
+  async expectUrlParam(key, value) {
+    await expect.poll(() => this.currentQuery()[key], { timeout: 10000, message: `URL ${key}` }).toBe(value);
+  }
+
+  async expectUrlParamAbsent(key) {
+    await expect.poll(() => key in this.currentQuery(), { timeout: 10000, message: `URL ${key} absent` }).toBe(false);
+  }
+
+  async historyLength() {
+    return this.page.evaluate(() => window.history.length);
+  }
+
+  trackRequests() {
+    const calls = { series: [], merge: [], meta: [], tag_values: [], diff: [] };
+    this.page.on('request', (request) => {
+      const match = request.url().match(/\/profiles\/(series|merge|meta|tag_values|diff)(\?|$)/);
+      if (!match) return;
+      const body = request.method() === 'POST' ? request.postDataJSON() : null;
+      calls[match[1]].push({ url: request.url(), body });
+    });
+    return calls;
+  }
+
+  /** Holds matching profiles API calls until the returned release() is called, so loading and cancel states stay on screen. */
+  async holdApi(kind) {
+    let release;
+    const gate = new Promise((resolve) => {
+      release = resolve;
+    });
+    await this.page.route(new RegExp(`/profiles/${kind}(\\?|$)`), async (route) => {
+      await gate;
+      await route.fallback().catch((error) => {
+        if (!/already handled|closed/i.test(error.message)) throw error;
+      });
+    });
+    return release;
+  }
+
+  async mockApi(kind, { status = 200, json }) {
+    await this.page.route(new RegExp(`/profiles/${kind}(\\?|$)`), (route) => route.fulfill({ status, json }));
+  }
+
+  /** Rewrites the real `kind` response with the fields `patch(body)` returns (e.g. truncated flags). */
+  async patchApiResponse(kind, patch) {
+    await this.page.route(new RegExp(`/profiles/${kind}(\\?|$)`), async (route) => {
+      const response = await route.fetch();
+      const body = await response.json();
+      await route.fulfill({ response, json: { ...body, ...patch(body) } });
+    });
+  }
+
+  /** Rewrites the merge request's max_nodes before it reaches the server. */
+  async forceMergeMaxNodes(maxNodes) {
+    await this.page.route(/\/profiles\/merge(\?|$)/, async (route) => {
+      const body = route.request().postDataJSON();
+      await route.fallback({ postData: JSON.stringify({ ...body, max_nodes: maxNodes }) });
+    });
+  }
+
+  /** Answers the profiles stream-name list with exactly `names`, so "first stream" does not depend on other streams in the org. */
+  async mockStreamList(names) {
+    await this.page.route(/\/api\/[^/]+\/streams\?.*type=profiles/, (route) =>
+      route.fulfill({ status: 200, json: { list: names.map((name) => ({ name, stream_type: 'profiles' })) } }),
+    );
+  }
+
+  async unrouteApi(kind) {
+    await this.page.unroute(new RegExp(`/profiles/${kind}(\\?|$)`));
+  }
+
+  selectTrigger(name, scope) {
+    return (scope ?? this.page).locator(`[data-test="${name}-trigger"]`).first();
+  }
+
+  async openSelect(name, scope) {
+    const trigger = this.selectTrigger(name, scope);
+    await expect(trigger).toBeVisible();
+    await expect(async () => {
+      if ((await trigger.getAttribute('aria-expanded')) !== 'true') await trigger.click();
+      await expect(trigger).toHaveAttribute('aria-expanded', 'true', { timeout: 1500 });
+    }).toPass({ timeout: 15000 });
+  }
+
+  async closeSelect(name, scope) {
+    const trigger = this.selectTrigger(name, scope);
+    if ((await trigger.getAttribute('aria-expanded')) === 'true') await this.page.keyboard.press('Escape');
+    await expect(trigger).toHaveAttribute('aria-expanded', 'false');
+  }
+
+  options(name) {
+    return this.page.locator(`[data-test="${name}-popover"] [data-test="${name}-option"]`);
+  }
+
+  async selectOptionLabels(name, scope) {
+    await this.openSelect(name, scope);
+    await expect(this.options(name).first()).toBeVisible();
+    const labels = await this.options(name).evaluateAll((els) => els.map((el) => el.getAttribute('data-test-label')));
+    await this.closeSelect(name, scope);
+    return labels;
+  }
+
+  async pickOption(name, label, scope) {
+    await this.openSelect(name, scope);
+    const search = this.page.locator(`[data-test="${name}-popover"] [data-test="${name}-search"]`);
+    // Lists over 50 entries are virtualised, so an option off screen only renders once the search narrows to it.
+    if (await search.count()) await search.fill(label);
+    const option = this.page.locator(`[data-test="${name}-popover"] [data-test="${name}-option"][data-test-label="${label}"]`);
+    await expect(option).toBeVisible();
+    await option.click();
+    await expect(this.selectTrigger(name, scope)).toHaveAttribute('data-test-selected-label', label);
+  }
+
+  async expectSelected(name, label, scope) {
+    await expect(this.selectTrigger(name, scope)).toHaveAttribute('data-test-selected-label', label, { timeout: 15000 });
+  }
+
+  async selectStream(stream) {
+    await this.pickOption(this.streamSelect, stream);
+  }
+
+  async selectService(service) {
+    await this.pickOption(this.serviceSelect, service);
+  }
+
+  async clickRun() {
+    await expect(this.page.locator(this.runBtn)).toBeEnabled();
+    await this.page.locator(this.runBtn).click();
+    await this.waitForRunIdle();
+  }
+
+  /** Clicks Run without waiting for the query to answer (for cancel tests). */
+  async clickRunNoWait() {
+    await this.page.locator(this.runBtn).click();
+  }
+
+  async clickCancel() {
+    await expect(this.page.locator(this.cancelBtn)).toBeVisible({ timeout: 15000 });
+    await this.page.locator(this.cancelBtn).click();
+    await this.waitForRunIdle();
+  }
+
+  async expectRunPending(pending) {
+    const run = this.page.locator(this.runBtn);
+    if (pending) await expect(run).toHaveAttribute('data-run-pending', 'true');
+    else await expect(run).not.toHaveAttribute('data-run-pending', 'true');
+  }
+
+  async expectRunDisabled() {
+    await expect(this.page.locator(this.runBtn)).toBeDisabled();
+  }
+
+  async hoverRunAndExpectTooltip(text) {
+    await this.page.locator(this.runBtn).hover({ force: true });
+    await expect(this.page.locator('[data-test="o-tooltip-content"]').filter({ hasText: text })).toBeVisible();
+  }
+
+  async expectRunOptionsHidden() {
+    await expect(this.page.locator(this.runBtn)).toBeVisible();
+    await expect(this.page.locator(this.runOptionsBtn)).toHaveCount(0);
+  }
+
+  async openRunOptions() {
+    const trigger = this.page.locator(this.runOptionsBtn);
+    await expect(async () => {
+      if ((await trigger.getAttribute('aria-expanded')) !== 'true') await trigger.click();
+      await expect(this.page.locator(this.autoRunToggle)).toBeVisible({ timeout: 1500 });
+    }).toPass({ timeout: 15000 });
+  }
+
+  async expectAutoRunToggleText(text) {
+    await expect(this.page.locator(this.autoRunToggle)).toContainText(text);
+  }
+
+  async clickAutoRunToggle() {
+    await this.page.locator(this.autoRunToggle).click();
+    await expect(this.page.locator(this.autoRunToggle)).toHaveCount(0);
+  }
+
+  async autoRunStorageValue() {
+    return this.page.evaluate(() => localStorage.getItem('oo_toggle_auto_run'));
+  }
+
+  async clickDatePrev() {
+    await this.page.locator(this.datePrevBtn).click();
+  }
+
+  async clickDateNext() {
+    await this.page.locator(this.dateNextBtn).click();
+  }
+
+  async expectDateButtonText(pattern) {
+    await expect(this.page.locator(this.dateBtn)).toContainText(pattern);
+  }
+
+  async openAddFilter() {
+    const add = this.page.locator(this.addFilterBtn);
+    await expect(async () => {
+      if ((await add.getAttribute('aria-expanded')) !== 'true') await add.click();
+      await expect(this.selectTrigger(this.tagKeySelect)).toBeVisible({ timeout: 1500 });
+    }).toPass({ timeout: 15000 });
+  }
+
+  async openFilterEditor(key) {
+    const edit = this.page.locator(`[data-test="profiles-filter-edit-${key}"]`);
+    await expect(async () => {
+      if ((await edit.getAttribute('aria-expanded')) !== 'true') await edit.click();
+      await expect(this.selectTrigger(this.tagValueSelect)).toBeVisible({ timeout: 1500 });
+    }).toPass({ timeout: 15000 });
+  }
+
+  /** Opens the add-filter menu, picks the label, then the value (which applies the filter). */
+  async addFilter(key, value) {
+    await this.openAddFilter();
+    await this.pickOption(this.tagKeySelect, key);
+    await this.pickFilterValue(value);
+  }
+
+  async pickFilterValue(value) {
+    const trigger = this.selectTrigger(this.tagValueSelect);
+    await expect(trigger).toBeEnabled();
+    await this.openSelect(this.tagValueSelect);
+    const option = this.page.locator(
+      `[data-test="${this.tagValueSelect}-popover"] [data-test="${this.tagValueSelect}-option"][data-test-label="${value}"]`,
+    );
+    await expect(option).toBeVisible();
+    await option.click();
+    await expect(this.selectTrigger(this.tagValueSelect)).toHaveCount(0);
+  }
+
+  async filterValueOptionLabels(key) {
+    await this.openAddFilter();
+    await this.pickOption(this.tagKeySelect, key);
+    await expect(this.selectTrigger(this.tagValueSelect)).toBeEnabled();
+    const labels = await this.selectOptionLabels(this.tagValueSelect);
+    await this.page.keyboard.press('Escape');
+    return labels;
+  }
+
+  async editFilter(key, value) {
+    await this.openFilterEditor(key);
+    await this.pickFilterValue(value);
+  }
+
+  async removeFilter(key) {
+    await this.page.locator(`[data-test="profiles-filter-remove-${key}"]`).click();
+    await expect(this.page.locator(`[data-test="profiles-filter-chip-${key}"]`)).toHaveCount(0);
+  }
+
+  async expectFilterChip(key, value) {
+    const chip = this.page.locator(`[data-test="profiles-filter-chip-${key}"]`);
+    await expect(chip).toHaveCount(1);
+    await expect(chip).toContainText(key);
+    await expect(chip).toContainText(value);
+  }
+
+  async expectFilterChipCount(count) {
+    await expect(this.page.locator(this.filterChips)).toHaveCount(count);
+  }
+
+  async expectValueSelectDisabled() {
+    await this.openAddFilter();
+    await expect(this.selectTrigger(this.tagValueSelect)).toBeDisabled();
+    await this.page.keyboard.press('Escape');
+  }
+
+  async switchView(view) {
+    await this.page.locator(`[data-test="profiles-view-${view}"]`).click();
+    await this.expectViewActive(view);
+  }
+
+  async expectViewActive(view) {
+    await expect(this.page.locator(`[data-test="profiles-view-${view}"]`)).toHaveAttribute('data-state', 'on', { timeout: 15000 });
+  }
+
+  async search(text) {
+    await this.page.locator(this.searchInput).fill(text);
+  }
+
+  async expectSearchValue(text) {
+    await expect(this.page.locator(this.searchInput)).toHaveValue(text);
+  }
+
+  async expectSearchSummary(text) {
+    await expect(this.page.locator(this.searchSummary)).toHaveText(text);
+  }
+
+  async toggleResultsExpand() {
+    await this.page.locator(this.resultsExpandBtn).click();
+  }
+
+  /** Rendered row at `position` (data-test row ids keep the unsorted data index, so position is by DOM order). */
+  topRow(position) {
+    return this.topRowsLocator().nth(position);
+  }
+
+  topRowsLocator() {
+    return this.page.locator(`${this.topTable} [data-test^="o2-table-row-"]`);
+  }
+
+  /** Asserts a Top Table row: values are display strings, any omitted key is not checked. */
+  async expectTopRow(index, { name, self, selfPercent, total, totalPercent }) {
+    const row = this.topRow(index);
+    if (name !== undefined) await expect(row.locator('[data-test="o2-table-cell-name"]')).toHaveText(name, { timeout: 15000 });
+    if (self !== undefined) await expect(row.locator('[data-test="o2-table-cell-self"]')).toHaveText(self);
+    if (selfPercent !== undefined) await expect(row.locator('[data-test="o2-table-cell-selfPercent"]')).toHaveText(selfPercent);
+    if (total !== undefined) await expect(row.locator('[data-test="o2-table-cell-total"]')).toHaveText(total);
+    if (totalPercent !== undefined) await expect(row.locator('[data-test="o2-table-cell-totalPercent"]')).toHaveText(totalPercent);
+  }
+
+  async expectTopRowNames(names) {
+    await expect(this.topRowsLocator().locator('[data-test="o2-table-cell-name"]')).toHaveText(names, { timeout: 15000 });
+  }
+
+  async expectTopRowCount(count) {
+    await expect(this.topRowsLocator()).toHaveCount(count, { timeout: 15000 });
+  }
+
+  async expectTopTableVisible() {
+    await expect(this.page.locator(this.topTable)).toBeVisible({ timeout: 15000 });
+  }
+
+  async sortTopBy(columnId) {
+    await this.page.locator(`th[data-test="o2-table-th-${columnId}"] [data-test="o2-table-th-sort-trigger"]`).click();
+  }
+
+  async expectTopSort(columnId, direction) {
+    await expect(this.page.locator(`th[data-test="o2-table-th-${columnId}"]`)).toHaveAttribute('aria-sort', direction);
+  }
+
+  async expectMarkedText(text) {
+    await expect(this.topRowsLocator().locator('mark').first()).toHaveText(text);
+  }
+
+  /** Opens the ⋮ menu of the row rendered at `position`; returns the menu's data-test prefix. */
+  async openRowMenu(kind, position) {
+    const row = kind === 'tree' ? this.treeRow(position) : this.topRow(position);
+    const trigger = row.locator(`[data-test^="profiles-${kind}-row-"][data-test$="-menu"]`);
+    const prefix = (await trigger.getAttribute('data-test')).replace(/-menu$/, '');
+    await expect(async () => {
+      if ((await trigger.getAttribute('aria-expanded')) !== 'true') await trigger.click();
+      await expect(this.page.locator(`[data-test="${prefix}-copy"]`)).toBeVisible({ timeout: 1500 });
+    }).toPass({ timeout: 15000 });
+    return prefix;
+  }
+
+  async rowMenuAction(kind, position, action) {
+    const prefix = await this.openRowMenu(kind, position);
+    await this.page.locator(`[data-test="${prefix}-${action}"]`).click();
+  }
+
+  treeRow(position) {
+    return this.page.locator(`${this.stackTable} [data-test^="o2-table-row-"]`).nth(position);
+  }
+
+  async expectTreeRow(index, { name, counts, self, total }) {
+    const row = this.treeRow(index);
+    if (name !== undefined) await expect(row.locator('[data-test="o2-table-cell-name"]')).toContainText(name, { timeout: 15000 });
+    const countCell = row.locator('[data-test^="profiles-tree-row-"][data-test$="-counts"]');
+    if (counts === null) await expect(countCell).toHaveCount(0);
+    else if (counts !== undefined) await expect(countCell).toHaveText(counts);
+    if (self !== undefined) await expect(row.locator('[data-test="o2-table-cell-self"]')).toHaveText(self);
+    if (total !== undefined) await expect(row.locator('[data-test="o2-table-cell-total"]')).toHaveText(total);
+  }
+
+  async expectTreeRowCount(count) {
+    await expect(this.page.locator(`${this.stackTable} [data-test^="o2-table-row-"]`)).toHaveCount(count);
+  }
+
+  async toggleTreeRow(index) {
+    await this.treeRow(index).locator('[data-test="o2-table-tree-toggle-name"]').click();
+  }
+
+  async expectTreeRowExpanded(index, expanded) {
+    await expect(this.treeRow(index).locator('[data-test="o2-table-tree-toggle-name"]')).toHaveAttribute('aria-expanded', String(expanded));
+  }
+
+  async expectDetails({ name, self, total, calledBy, calls, hasPackage }) {
+    const panel = this.page.locator(this.details);
+    await expect(panel).toBeVisible({ timeout: 15000 });
+    if (name !== undefined) await expect(panel).toContainText(name);
+    if (self !== undefined) await expect(panel.locator(this.detailsSelf)).toHaveText(self);
+    if (total !== undefined) await expect(panel.locator(this.detailsTotal)).toHaveText(total);
+    if (calledBy !== undefined) {
+      for (const caller of calledBy) await expect(panel.locator(this.detailsCalledBy)).toContainText(caller);
+    }
+    if (calls !== undefined) {
+      for (const callee of calls) await expect(panel.locator(this.detailsCalls)).toContainText(callee);
+    }
+    if (hasPackage !== undefined) await expect(panel.locator(this.detailsPackage)).toHaveCount(hasPackage ? 1 : 0);
+  }
+
+  async detailsListRowCount(list) {
+    const section = this.page.locator(list === 'calls' ? this.detailsCalls : this.detailsCalledBy);
+    return section.locator(':scope > div').count();
+  }
+
+  async expectDetailsHidden() {
+    await expect(this.page.locator(this.details)).toHaveCount(0);
+  }
+
+  async clickDetails(action) {
+    const map = { copy: this.detailsCopy, close: this.detailsClose, sandwich: this.detailsSandwich, show: this.detailsShow };
+    await this.page.locator(map[action]).click();
+  }
+
+  async expectSandwichFunction(name) {
+    await this.expectSelected(this.sandwichFunction, name);
+  }
+
+  async pickSandwichFunction(name) {
+    await this.pickOption(this.sandwichFunction, name);
+  }
+
+  async expectSandwichCoverage(visible) {
+    await expect(this.page.locator(this.sandwichCoverage)).toHaveCount(visible ? 1 : 0, { timeout: 15000 });
+  }
+
+  async expectSandwichCoverageText(text) {
+    await expect(this.page.locator(this.sandwichCoverage)).toContainText(text, { timeout: 15000 });
+  }
+
+  flameGraph(scope) {
+    return (scope ? this.page.locator(scope) : this.page).locator(this.flamePlot).first();
+  }
+
+  /** Viewport point at the centre of a frame from its hand-computed geometry (rows 26 px, plot inset 10 px). */
+  async framePoint(frame, { scope, rootAtBottom = false, maxDepth = 0, at = 0.5 } = {}) {
+    const box = await this.flameGraph(scope).boundingBox();
+    if (!box) throw new Error('Flame graph plot is not on screen');
+    const depth = rootAtBottom ? maxDepth - frame.depth : frame.depth;
+    const share = (frame.left + frame.width * at) / 100;
+    return {
+      x: box.x + FLAME_PLOT_INSET_PX + share * (box.width - 2 * FLAME_PLOT_INSET_PX),
+      y: box.y + 1 + depth * FLAME_ROW_PX + FLAME_ROW_PX / 2 - 1,
+    };
+  }
+
+  flameTooltip(text) {
+    return this.page.locator(`body > div[style*="${FLAME_TOOLTIP_Z}"]`).filter({ hasText: text });
+  }
+
+  /** Hovers a frame and proves the tooltip names it, so later clicks land on the intended frame. */
+  async hoverFrame(frame, name, options = {}) {
+    const point = await this.framePoint(frame, options);
+    await expect(async () => {
+      await this.page.mouse.move(point.x, point.y - 3);
+      await this.page.mouse.move(point.x, point.y);
+      await expect(this.flameTooltip(name).first()).toBeVisible({ timeout: 1500 });
+    }).toPass({ timeout: 15000 });
+    return point;
+  }
+
+  async expectFlameTooltipContains(name, texts) {
+    const tooltip = this.flameTooltip(name).first();
+    for (const text of texts) await expect(tooltip).toContainText(text);
+  }
+
+  async expectFlameTooltipLacks(name, text) {
+    await expect(this.flameTooltip(name).first()).not.toContainText(text);
+  }
+
+  async expectFlameViewOptions() {
+    await expect(this.page.locator(this.flameViewOptions).first()).toBeVisible();
+  }
+
+  async clickFrame(frame, name, options = {}) {
+    const point = await this.hoverFrame(frame, name, options);
+    await this.page.mouse.click(point.x, point.y);
+  }
+
+  async rightClickFrame(frame, name, options = {}) {
+    const point = await this.hoverFrame(frame, name, options);
+    await this.page.mouse.click(point.x, point.y, { button: 'right' });
+  }
+
+  async expectFlameMenu(items, absent = []) {
+    const menu = this.page.locator(this.flameMenu);
+    await expect(menu).toBeVisible();
+    for (const item of items) await expect(menu.locator(`[data-test="flame-graph-${item}"]`)).toBeVisible();
+    for (const item of absent) await expect(menu.locator(`[data-test="flame-graph-${item}"]`)).toHaveCount(0);
+  }
+
+  /** Hovering a wide frame shows its ⋮ button only while no frame menu is open, so this proves the menu is closed. */
+  async expectNoFrameMenuVia(frame, name, options = {}) {
+    await this.hoverFrame(frame, name, options);
+    await expect(this.page.locator(this.flameFrameMore)).toBeVisible();
+    await expect(this.page.locator(this.flameMenu)).toHaveCount(0);
+  }
+
+  /** Opens a frame's menu, which offers Reset zoom only while a frame is focused, then closes it again. */
+  async expectNotZoomedVia(frame, name, options = {}) {
+    await this.rightClickFrame(frame, name, options);
+    await this.expectFlameMenu(['copy-name'], ['zoom-reset', 'zoom-out', 'zoom-out-here']);
+    await this.pressEscape();
+    await expect(this.page.locator(this.flameMenu)).toHaveCount(0);
+  }
+
+  async expectFlameMenuHidden() {
+    await expect(this.page.locator(this.flameMenu)).toHaveCount(0);
+  }
+
+  async clickFlameMenuItem(item) {
+    await this.page.locator(`${this.flameMenu} [data-test="flame-graph-${item}"]`).click();
+  }
+
+  async expectFlameRootSummary(text, scope) {
+    await this.hoverFrame(CHECKOUT_FRAMES.root, text, { scope });
+  }
+
+  /** Screenshot of the label end of a frame (first 40 px), where search highlighting draws. */
+  async frameLabelPng(frame, options = {}) {
+    const box = await this.flameGraph(options.scope).boundingBox();
+    const x = box.x + FLAME_PLOT_INSET_PX + (frame.left / 100) * (box.width - 2 * FLAME_PLOT_INSET_PX);
+    const y = box.y + 1 + frame.depth * FLAME_ROW_PX;
+    return this.page.screenshot({ clip: { x: Math.round(x), y: Math.round(y), width: 40, height: FLAME_ROW_PX - 2 } });
+  }
+
+  async flameCanvasPng(scope) {
+    return this.flameGraph(scope).screenshot();
+  }
+
+  async toggleRootAtBottom() {
+    await this.page.locator(this.flameRootAtBottom).first().click();
+  }
+
+  async expectRootAtBottom(checked) {
+    await expect(this.page.locator(this.flameRootAtBottom).first()).toHaveAttribute('data-state', checked ? 'checked' : 'unchecked');
+  }
+
+  async clickAlign(side) {
+    await this.page.locator(side === 'right' ? this.flameAlignRight : this.flameAlignLeft).first().click();
+  }
+
+  async expectAlignActive(side) {
+    const active = this.page.locator(side === 'right' ? this.flameAlignRight : this.flameAlignLeft).first();
+    await expect(active).toHaveAttribute('data-o2-variant', 'primary');
+  }
+
+  async flamePlotWidth(scope) {
+    const box = await this.flameGraph(scope).boundingBox();
+    return box ? box.width : 0;
+  }
+
+  async flameCanvasWidth(scope) {
+    return this.flameGraph(scope).locator('canvas').first().evaluate((canvas) => canvas.getBoundingClientRect().width);
+  }
+
+  async ctrlWheelOnFrame(frame, name, deltaY) {
+    const point = await this.hoverFrame(frame, name);
+    await this.page.keyboard.down('Control');
+    await this.page.mouse.wheel(0, deltaY);
+    await this.page.keyboard.up('Control');
+    return point;
+  }
+
+  async dragOnFlame(from, dx) {
+    await this.page.mouse.move(from.x, from.y);
+    await this.page.mouse.down();
+    await this.page.mouse.move(from.x + dx / 2, from.y, { steps: 5 });
+    await this.page.mouse.move(from.x + dx, from.y, { steps: 5 });
+    await this.page.mouse.up();
+  }
+
+  async expectFlameGrabCursor(zoomed) {
+    const plot = this.flameGraph();
+    if (zoomed) await expect(plot).toHaveClass(/cursor-grab/);
+    else await expect(plot).not.toHaveClass(/cursor-grab/);
+  }
+
+  async expectZoomHint(visible) {
+    await expect(this.page.locator(this.flameZoomHint)).toHaveCount(visible ? 1 : 0, { timeout: 15000 });
+  }
+
+  async expectZoomHintText(pattern) {
+    await expect(this.page.locator(this.flameZoomHint)).toContainText(pattern);
+  }
+
+  async clickZoomHint(action) {
+    await this.page.locator(action === 'never' ? this.flameZoomHintNever : this.flameZoomHintClose).click();
+  }
+
+  async zoomHintStorageValue() {
+    return this.page.evaluate(() => localStorage.getItem('o2_flame_zoom_hint_hidden'));
+  }
+
+  async expectFrameMoreVisible() {
+    await expect(this.page.locator(this.flameFrameMore)).toBeVisible();
+  }
+
+  async clickFrameMore() {
+    await this.page.locator(this.flameFrameMore).click();
+  }
+
+  async pressEscape() {
+    await this.page.keyboard.press('Escape');
+  }
+
+  pixelAt(png, fx, fy) {
+    const image = PNG.sync.read(png);
+    const x = Math.min(image.width - 1, Math.max(0, Math.round(fx * image.width)));
+    const y = Math.min(image.height - 1, Math.max(0, Math.round(fy * image.height)));
+    const i = (image.width * y + x) * 4;
+    return { r: image.data[i], g: image.data[i + 1], b: image.data[i + 2] };
+  }
+
+  /** RGB at a viewport point, from a 1×1 page screenshot. */
+  async viewportPixel(x, y) {
+    const png = await this.page.screenshot({ clip: { x: Math.round(x), y: Math.round(y), width: 1, height: 1 } });
+    return this.pixelAt(png, 0, 0);
+  }
+
+  /** Horizontal centre (0–1 of the chart width) of the strongly blue pixels the series draws. */
+  async seriesBlueCentre() {
+    const png = await this.page.locator(this.seriesChart).screenshot();
+    const image = PNG.sync.read(png);
+    let sum = 0;
+    let count = 0;
+    for (let y = 0; y < image.height; y++) {
+      for (let x = 0; x < image.width; x++) {
+        const i = (image.width * y + x) * 4;
+        const [r, g, b] = [image.data[i], image.data[i + 1], image.data[i + 2]];
+        if (b > 150 && b - r > 60 && b - g > 30) {
+          sum += x;
+          count += 1;
+        }
+      }
+    }
+    return { count, centre: count ? sum / count / image.width : -1 };
+  }
+
+  async expectSeriesCardVisible(visible) {
+    if (visible) await expect(this.page.locator(this.seriesCard)).toBeVisible();
+    else await expect(this.page.locator(this.seriesCard)).toBeHidden();
+  }
+
+  /** Sweeps the pointer across the series chart and returns every distinct tooltip text. */
+  async collectSeriesTooltips(step = 5) {
+    const chart = this.page.locator(this.seriesChart);
+    await expect(chart.locator('canvas').first()).toBeVisible();
+    const box = await chart.boundingBox();
+    const texts = new Set();
+    const tooltip = chart.locator(':scope > div').filter({ hasText: /\d/ });
+    for (let x = box.x + 2; x < box.x + box.width - 2; x += step) {
+      await this.page.mouse.move(x, box.y + box.height / 2);
+      const visible = tooltip.last();
+      if (await visible.isVisible()) {
+        const text = (await visible.innerText()).replace(/\s+/g, ' ').trim();
+        if (text) texts.add(text);
+      }
+    }
+    await this.page.mouse.move(box.x - 20, box.y - 20);
+    return [...texts];
+  }
+
+  async dragAcrossChart(fromShare, toShare) {
+    const box = await this.page.locator(this.seriesChart).boundingBox();
+    const y = box.y + box.height / 2;
+    await this.page.mouse.move(box.x + box.width * fromShare, y);
+    await this.page.mouse.down();
+    await this.page.mouse.move(box.x + box.width * ((fromShare + toShare) / 2), y, { steps: 5 });
+    await this.page.mouse.move(box.x + box.width * toShare, y, { steps: 5 });
+    await this.page.mouse.up();
+  }
+
+  async pickBreakdown(label) {
+    await this.pickOption(this.breakdownSelect, label);
+  }
+
+  async breakdownOptionLabels() {
+    return this.selectOptionLabels(this.breakdownSelect);
+  }
+
+  async expectBreakdownDisabled() {
+    await expect(this.selectTrigger(this.breakdownSelect)).toBeDisabled();
+  }
+
+  breakdownChip(key) {
+    return this.page.locator(`[data-test="profiles-breakdown-chip-${key}"]`);
+  }
+
+  async expectBreakdownChips(labels) {
+    await expect(this.page.locator(`${this.breakdownLegend} [data-test^="profiles-breakdown-chip-"]`)).toHaveText(labels, { timeout: 15000 });
+  }
+
+  async clickBreakdownChip(key) {
+    await this.breakdownChip(key).click();
+  }
+
+  async expectOthersChipDisabled() {
+    await expect(this.page.locator(this.breakdownChipOthers)).toBeDisabled();
+    await expect(this.page.locator(this.breakdownChipOthers)).toHaveText('Others');
+  }
+
+  async expectState(name, { title, description } = {}) {
+    const map = {
+      error: this.errorState,
+      noStream: this.noStreamState,
+      cancelled: this.searchCancelledState,
+      noResults: this.noResultsState,
+      errorBanner: this.errorBanner,
+      partial: this.partialResultBanner,
+      noSeries: this.noSeries,
+      seriesSkeleton: this.seriesSkeleton,
+      sandwichSkeleton: this.sandwichSkeleton,
+    };
+    const state = this.page.locator(map[name]);
+    await expect(state).toBeVisible({ timeout: 15000 });
+    if (title) await expect(state).toContainText(title);
+    if (description) await expect(state).toContainText(description);
+  }
+
+  async expectStateHidden(name) {
+    const map = { error: this.errorState, noResults: this.noResultsState, errorBanner: this.errorBanner, partial: this.partialResultBanner, cancelled: this.searchCancelledState };
+    await expect(this.page.locator(map[name])).toHaveCount(0, { timeout: 15000 });
+  }
+
+  /** OEmptyState renders its action buttons without a data-test hook, so the button is found by its label inside the state. */
+  async clickStateAction(name) {
+    const map = {
+      error: [this.errorState, 'Retry'],
+      noStream: [this.noStreamState, 'Set up profiles ingestion'],
+      cancelled: [this.searchCancelledState, 'Run query'],
+    };
+    const [state, label] = map[name];
+    await this.page.locator(state).getByRole('button', { name: label }).click();
+  }
+
+  async expectTopTableLoading() {
+    await expect(this.page.locator(`${this.topTable} [data-test="o2-table"]`)).toHaveAttribute('data-test-loading', 'true');
+  }
+
+  async expectSkeleton(kind) {
+    const map = { series: this.seriesSkeleton, flame: this.flameSkeleton, sandwich: this.sandwichSkeleton };
+    await expect(this.page.locator(map[kind])).toBeVisible({ timeout: 15000 });
+  }
+
+  /** Switches the results view while a query is still loading (the toggle stays usable). */
+  async switchViewWhileLoading(view) {
+    await this.page.locator(`[data-test="profiles-view-${view}"]`).click();
+    await expect(this.page.locator(`[data-test="profiles-view-${view}"]`)).toHaveAttribute('data-state', 'on');
+  }
+
+  async expectErrorBannerText(text) {
+    await expect(this.page.locator(this.errorBanner)).toContainText(text, { timeout: 15000 });
+  }
+
+  async clickErrorBannerRetry() {
+    await this.page.locator(this.errorRetryBtn).click();
+  }
+
+  async expectShareDisabled(disabled) {
+    const share = this.page.locator(this.shareBtn);
+    if (disabled) await expect(share).toBeDisabled();
+    else await expect(share).toBeEnabled();
+  }
+
+  async clickShareAndReadClipboard() {
+    await this.page.locator(this.shareBtn).click();
+    await expect(this.page.locator(this.successToast).filter({ hasText: 'Link Copied Successfully!' })).toBeVisible({ timeout: 15000 });
+    return this.readClipboard();
+  }
+
+  async readClipboard() {
+    return this.page.evaluate(() => navigator.clipboard.readText());
+  }
+
+  async expectCopiedToast() {
+    await expect(this.page.locator(this.successToast).filter({ hasText: 'Copied to clipboard' }).first()).toBeVisible({ timeout: 15000 });
+  }
+
+  /** RGB of the frame's fill at `at` across its width (away from the label, which sits at the left). */
+  async framePixel(frame, { at = 0.8, scope } = {}) {
+    const point = await this.framePoint(frame, { at, scope });
+    await this.page.mouse.move(0, 0);
+    return this.viewportPixel(point.x, point.y);
+  }
+
+  /** Chart-canvas pixel near its top-right corner (no axis or line there) and the card pixel just above the canvas. */
+  async chartAndCardBackground() {
+    const box = await this.page.locator(this.seriesChart).boundingBox();
+    const chart = await this.viewportPixel(box.x + box.width - 6, box.y + 3);
+    const card = await this.viewportPixel(box.x + box.width - 6, box.y - 6);
+    return { chart, card };
+  }
+
+  async setViewport(width, height) {
+    await this.page.setViewportSize({ width, height });
+  }
+
+  async openMobileViewMenu() {
+    const trigger = this.page.locator('[data-test="profiles-view-dropdown-btn"]');
+    await expect(async () => {
+      if ((await trigger.getAttribute('aria-expanded')) !== 'true') await trigger.click();
+      await expect(this.page.locator('[data-test="profiles-view-top-item"]')).toBeVisible({ timeout: 1500 });
+    }).toPass({ timeout: 15000 });
+  }
+
+  async mobileViewMenuItems() {
+    return this.page.locator('[data-test^="profiles-view-"][data-test$="-item"]').evaluateAll((els) => els.map((el) => el.getAttribute('data-test')));
+  }
+
+  async pickMobileView(view) {
+    await this.openMobileViewMenu();
+    await this.page.locator(`[data-test="profiles-view-${view}-item"]`).click();
+  }
+
+  async hasHorizontalPageScroll() {
+    return this.page.evaluate(() => document.documentElement.scrollWidth > document.documentElement.clientWidth);
+  }
+
+  async detailsSitsBelowTable() {
+    const table = await this.page.locator(this.topTable).boundingBox();
+    const details = await this.page.locator(this.details).boundingBox();
+    return details.y >= table.y + table.height - 1;
+  }
+
+  async expectCompareSides(label, baseline, comparison) {
+    await this.expectSelected(this.compareLabel, label);
+    await this.expectSelected(this.compareBaseline, baseline);
+    await this.expectSelected(this.compareComparison, comparison);
+  }
+
+  async waitForCompareIdle() {
+    await expect(this.page.locator(this.compare)).toBeVisible({ timeout: 15000 });
+    await expect(this.page.locator(this.compareSkeleton)).toHaveCount(0, { timeout: 30000 });
+  }
+
+  async pickCompareDisplay(display) {
+    await this.page.locator(`[data-test="profiles-compare-display-${display}"]`).click();
+    await expect(this.page.locator(`[data-test="profiles-compare-display-${display}"]`)).toHaveAttribute('data-state', 'on');
+    await this.waitForCompareIdle();
+  }
+
+  async clickCompareSwap() {
+    await this.page.locator(this.compareSwap).click();
+    await this.waitForCompareIdle();
+  }
+
+  async pickCompareLabel(label) {
+    await this.pickOption(this.compareLabel, label);
+    await this.waitForCompareIdle();
+  }
+
+  async compareBaselineOptions() {
+    return this.selectOptionLabels(this.compareBaseline);
+  }
+
+  compareTableRow(name) {
+    return this.page.locator(`${this.compareTable} [data-test^="o2-table-row-"]`).filter({
+      has: this.page.locator('[data-test="o2-table-cell-name"]', { hasText: new RegExp(`^${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`) }),
+    });
+  }
+
+  async expectCompareTableRow(name, { before, after, beforePercent, afterPercent, change }) {
+    const row = this.compareTableRow(name);
+    await expect(row).toHaveCount(1, { timeout: 15000 });
+    if (before !== undefined) await expect(row.locator('[data-test="o2-table-cell-before"]')).toHaveText(before);
+    if (after !== undefined) await expect(row.locator('[data-test="o2-table-cell-after"]')).toHaveText(after);
+    if (beforePercent !== undefined) await expect(row.locator('[data-test="o2-table-cell-beforePercent"]')).toHaveText(beforePercent);
+    if (afterPercent !== undefined) await expect(row.locator('[data-test="o2-table-cell-afterPercent"]')).toHaveText(afterPercent);
+    if (change !== undefined) await expect(row.locator('[data-test="o2-table-cell-change"]')).toHaveText(change);
+  }
+
+  async expectCompareTableRowNames(names) {
+    await expect(
+      this.page.locator(`${this.compareTable} [data-test^="o2-table-row-"] [data-test="o2-table-cell-name"]`),
+    ).toHaveText(names, { timeout: 15000 });
+  }
+
+  async expectCompareMessage(text) {
+    await expect(this.page.locator(this.compareMessage)).toContainText(text, { timeout: 15000 });
+  }
+
+  async expectMenuProfilesVisible(visible) {
+    await expect(this.page.locator(this.navRail)).toBeVisible();
+    await expect(this.page.locator(this.menuTraces)).toBeVisible();
+    await expect(this.page.locator(this.menuProfiles)).toHaveCount(visible ? 1 : 0);
+  }
+
+  async clickMenuProfiles() {
+    await this.page.locator(this.menuProfiles).click();
+    await this.waitForPageReady();
+  }
+
+  async expectPageHeader() {
+    await expect(this.page.locator(this.pageRoot)).toBeVisible();
+    await expect(this.page.locator(this.betaBadge).first()).toBeVisible();
+    await expect(this.page.locator(this.pageTitle)).toContainText('Profiles');
+  }
+
+  async gotoDataPageProfiles(stream) {
+    await this.page.goto(`${this.baseUrl()}/web/streams?org_identifier=${this.orgName()}`);
+    const filter = this.page.locator(this.streamTypeFilter);
+    await expect(filter).toBeVisible({ timeout: 30000 });
+    // The stream-type toggle items carry no data-test of their own (OToggleGroupItem only tags its mobile menu rows).
+    const profilesToggle = filter.getByRole('button', { name: 'Profiles' });
+    await profilesToggle.click();
+    await expect(profilesToggle).toHaveAttribute('data-state', 'on');
+    await expect(this.page.locator('[data-test^="log-stream-name-cell-"]').first()).toBeVisible({ timeout: 30000 });
+    await expect(async () => {
+      await this.page.locator(this.streamSearchInput).fill(stream);
+      await expect(this.page.locator('[data-test^="log-stream-name-cell-"]')).toHaveCount(1, { timeout: 5000 });
+    }).toPass({ timeout: 30000 });
+    await expect(this.page.locator(`[data-test="log-stream-name-cell-${stream}"]`)).toBeVisible();
+  }
+
+  /** Clicks the row's explore button until the app leaves the Data page (the filtered list re-renders under the pointer). */
+  async clickDataPageExplore(stream) {
+    const row = this.page
+      .locator('[data-test^="o2-table-row-"]')
+      .filter({ has: this.page.locator(`[data-test="log-stream-name-cell-${stream}"]`) });
+    await expect(async () => {
+      if (new URL(this.page.url()).pathname === '/web/streams') await row.locator(this.streamExploreBtn).click({ timeout: 2000 });
+      await expect.poll(() => new URL(this.page.url()).pathname, { timeout: 3000 }).toBe('/web/logs');
+    }).toPass({ timeout: 20000 });
+  }
+
+  /** Data-test ids of the visible left-rail items, top to bottom. */
+  async visibleMenuOrder() {
+    await expect(this.page.locator(this.menuProfiles)).toBeVisible();
+    return this.page.locator(this.menuLinks).evaluateAll((els) =>
+      els
+        .map((el) => ({ id: el.getAttribute('data-test'), box: el.getBoundingClientRect() }))
+        .filter(({ box }) => box.width > 0 && box.height > 0)
+        .sort((a, b) => a.box.top - b.box.top)
+        .map(({ id }) => id),
+    );
+  }
+
+  async gotoProfilesIngestion() {
+    await this.page.goto(`${this.baseUrl()}/web/ingestion/custom/profiles/otelcollector?org_identifier=${this.orgName()}`);
+    await expect(this.page.locator(this.ingestionOtelBlock)).toBeVisible({ timeout: 30000 });
+  }
+
+  async ingestionSnippetText(which) {
+    const map = { otel: this.ingestionOtelBlock, start: this.ingestionOtelStartBlock, grpc: this.ingestionOtelGrpcBlock };
+    await expect(this.page.locator(map[which])).toBeVisible();
+    return this.page.locator(map[which]).innerText();
+  }
+
+  async expectIngestionProfilesTabsActive() {
+    await expect(this.page.locator(this.ingestionProfilesTab)).toBeVisible();
+    await expect(this.page.locator(this.ingestionOtelTab)).toBeVisible();
+  }
+
+  async expectLogsExplorerRows() {
+    await expect(this.page.locator('[data-test="logs-search-result-logs-table"] tbody tr[data-test^="o2-table-row-"]').first()).toBeVisible({ timeout: 30000 });
+  }
+
+  /** Resolves once the trace sidebar's profile probe has queried `stream` for `spanId`. */
+  waitForSpanProfileProbe(stream, spanId) {
+    return this.page.waitForResponse(
+      (response) => {
+        const body = response.request().postData() || '';
+        return response.url().includes('/_search') && body.includes(spanId) && body.includes(stream);
+      },
+      { timeout: 30000 },
+    );
+  }
+
+  async expectTraceSidebarSpan(spanId) {
+    await expect(this.page.locator('[data-test="trace-details-sidebar-header-operation-name"]').first()).toHaveText(`op_${spanId}`);
+  }
+
+  async clickTraceSpanAndAwaitProbe(stream, spanId) {
+    const probe = this.waitForSpanProfileProbe(stream, spanId);
+    await this.openTraceSpan(spanId);
+    await (await probe).finished();
+  }
+
+  async gotoTraceDetails({ traceId, stream, fromUs, toUs }) {
+    await this.page.goto(
+      `${this.baseUrl()}/web/traces/trace-details?trace_id=${traceId}&stream=${stream}&from=${fromUs}&to=${toUs}&org_identifier=${this.orgName()}`,
+    );
+  }
+
+  async openTraceSpan(spanId) {
+    const span = this.page.locator(`[data-test="trace-tree-span-operation-name-${spanId}"]`);
+    await expect(span).toBeVisible({ timeout: 30000 });
+    await span.click();
+  }
+
+  async expectViewProfileButton(visible) {
+    if (visible) await expect(this.page.locator(this.traceViewProfileBtn)).toBeVisible({ timeout: 30000 });
+    else await expect(this.page.locator(this.traceViewProfileBtn)).toHaveCount(0);
+  }
+
+  async clickViewProfile() {
+    await this.page.locator(this.traceViewProfileBtn).click();
+    await this.waitForPageReady();
+  }
+
+  async isXssExecuted() {
+    return this.page.evaluate(() => window.__xss !== undefined || !!document.querySelector('img[src="x"]'));
+  }
+}
diff --git a/tests/ui-testing/playwright-tests/Alerts/alerts-advanced.spec.js b/tests/ui-testing/playwright-tests/Alerts/alerts-advanced.spec.js
index a97ed578b5..dcaa5edb36 100644
--- a/tests/ui-testing/playwright-tests/Alerts/alerts-advanced.spec.js
+++ b/tests/ui-testing/playwright-tests/Alerts/alerts-advanced.spec.js
@@ -4,7 +4,6 @@
  * Tests for:
  * 1. Advanced Conditions - Multiple conditions with AND/OR logic
  * 2. Bulk Operations - Bulk pause/unpause alerts
- * 3. Deduplication Configuration - Scheduled alerts with dedup settings
  *
  * Note: Each test is independent and creates its own test data.
  * Cleanup is handled by cleanup.spec.js via 'auto_' prefix patterns.
@@ -14,7 +13,7 @@ const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures
 const testLogger = require('../utils/test-logger.js');
 const PageManager = require('../../pages/page-manager.js');
 const logData = require('../../fixtures/log.json');
-const { getOrgIdentifier, isCloudEnvironment } = require('../utils/cloud-auth.js');
+const { getOrgIdentifier } = require('../utils/cloud-auth.js');
 
 const TEST_STREAM = 'e2e_automate';
 
@@ -161,208 +160,4 @@ test.describe("Alerts Advanced Coverage Tests", () => {
 
         testLogger.info('Bulk operations test completed successfully');
     });
-
-    // ==================== DEDUPLICATION TESTS ====================
-
-    test("Create scheduled alert with deduplication configuration", {
-        tag: ['@alertsAdvanced', '@all', '@alerts', '@deduplication']
-    }, async ({ page }) => {
-        const uniqueSuffix = Math.random().toString(36).substring(2, 8);
-        testLogger.info('Testing scheduled alert with deduplication configuration', { uniqueSuffix });
-
-        // This test focuses on UI validation of scheduled alert with deduplication settings
-        // Scheduled alert trigger verification is covered by alerts-ui-operations.spec.js
-        const templateName = 'auto_template_dedup_' + uniqueSuffix;
-        const destinationName = 'auto_dest_dedup_' + uniqueSuffix;
-
-        await pm.alertTemplatesPage.navigateToTemplates();
-        await pm.alertTemplatesPage.waitForTemplateListReady();
-        await pm.alertTemplatesPage.createTemplate(templateName);
-        testLogger.info('Template created', { templateName });
-
-        await pm.alertDestinationsPage.navigateToDestinations();
-        await pm.alertDestinationsPage.waitForDestinationListReady();
-        const destinationUrl = notificationSinkUrl();
-        await pm.alertDestinationsPage.createDestination(destinationName, destinationUrl, templateName);
-        testLogger.info('Destination created', { destinationName });
-
-        const alertsUrl = `${logData.alertUrl}?org_identifier=${getOrgIdentifier()}`;
-        await page.goto(alertsUrl);
-        await pm.alertsPage.waitForAddAlertButton();
-
-        const dedupConfig = {
-            timeWindowMinutes: 30
-            // fingerprintFields left empty to test auto-detection
-        };
-
-        const alertName = await pm.alertsPage.createScheduledAlertWithDeduplication(
-            TEST_STREAM,
-            destinationName,
-            uniqueSuffix,
-            dedupConfig
-        );
-
-        await pm.alertsPage.verifyAlertCreated(alertName);
-        testLogger.info('Scheduled alert with deduplication created and verified successfully', {
-            alertName,
-            dedupConfig
-        });
-    });
-
-    /**
-     * Deduplication Validation Test with Trigger Verification
-     *
-     * NOTE: This test is currently skipped because:
-     * 1. Scheduled alert trigger validation has timing issues (known limitation)
-     * 2. Deduplication is an enterprise-only feature (requires enterprise build)
-     * 3. UI configuration testing is covered by "Create scheduled alert with deduplication configuration"
-     *
-     * To enable this test:
-     * - Ensure enterprise features are enabled in the build
-     * - Consider using longer timeouts or API-based validation
-     * - May need to adjust scheduled alert query time ranges
-     *
-     * Test design:
-     * 1. Creates unique source stream with custom columns
-     * 2. Creates scheduled alert with deduplication configured
-     * 3. Ingests data to trigger first alert - verifies notification appears
-     * 4. Ingests more data (same fingerprint, within time window)
-     * 5. Verifies NO NEW notification - dedup suppressed the duplicate
-     */
-    test("Deduplication validation - verify duplicate alerts are suppressed", {
-        tag: ['@alertsAdvanced', '@alerts', '@deduplication', '@dedupValidation', '@enterprise', '@skip']
-    }, async ({ page }) => {
-        // Round-trip verification needs a self-referencing destination (alert notification
-        // ingested back into a validation stream). On cloud the SSRF guard blocks the
-        // cluster's own (private-IP) URL at destination-create time, so this cannot run.
-        test.skip(isCloudEnvironment(), 'Self-referencing validation destination is blocked by the SSRF guard on cloud');
-
-        test.slow(); // Mark as slow test due to scheduled alert evaluation cycles
-
-        // Generate unique suffix (lowercase for API compatibility)
-        const uniqueSuffix = Math.random().toString(36).substring(2, 8).toLowerCase();
-        testLogger.info('Starting deduplication validation test', { uniqueSuffix });
-
-        // Create unique source stream with custom columns (same approach as e2e-flow)
-        const sourceStreamName = `dedup_src_${uniqueSuffix}`.toLowerCase();
-        const column = 'city';        // Custom column from our test stream
-        const value = 'bangalore';    // Value that triggers the alert condition
-
-        // Initialize the source stream with custom columns
-        await pm.commonActions.initializeAlertTestStream(sourceStreamName);
-        testLogger.info('Initialized source stream with custom columns', {
-            sourceStreamName,
-            columns: ['city', 'country', 'status', 'age', 'test_run_id', 'test_timestamp', 'message']
-        });
-
-        // Create validation infrastructure (template + destination pointing to validation stream)
-        const validationInfra = await pm.alertsPage.ensureValidationInfrastructure(pm, uniqueSuffix);
-        testLogger.info('Validation infrastructure ready', validationInfra);
-
-        // Navigate to alerts page - refresh to ensure new stream appears
-        await pm.commonActions.navigateToAlerts();
-        await page.reload();
-        await page.waitForLoadState('networkidle', { timeout: 10000 }).catch(() => {});
-        await pm.alertsPage.waitForAddAlertButton();
-
-        // Create scheduled alert with deduplication for validation
-        const dedupConfig = {
-            timeWindowMinutes: 5,           // 5-minute dedup window
-            fingerprintFields: [column]     // Fingerprint based on city column
-        };
-
-        const alertName = await pm.alertsPage.createScheduledAlertWithDedupForValidation(
-            sourceStreamName,
-            column,
-            value,
-            validationInfra.destinationName,
-            uniqueSuffix,
-            dedupConfig
-        );
-        await pm.alertsPage.verifyAlertCreated(alertName);
-        testLogger.info('Created scheduled alert with deduplication', {
-            alertName,
-            dedupConfig,
-            stream: sourceStreamName
-        });
-
-        // Wait for alert to register (handled implicitly by the validation-stream poll below)
-        testLogger.info('Waiting for alert registration...');
-
-        // ===== TRIGGER #1: Ingest data to trigger first alert =====
-        testLogger.info('Ingesting first batch of data to trigger alert...');
-        await pm.commonActions.ingestTestDataWithUniqueId(sourceStreamName, `trigger1_${uniqueSuffix}`, column, value);
-        testLogger.info('First data ingestion complete');
-
-        // Wait for scheduled alert evaluation cycle (1 min period + buffer)
-        testLogger.info('Waiting for first scheduled alert evaluation cycle...');
-
-        // Verify first notification appears in validation stream
-        const firstCheck = await pm.commonActions.waitForAlertInValidationStream(
-            validationInfra.streamName,
-            alertName,
-            150,  // max 150 seconds (2.5 min for scheduled alert to fire)
-            10    // poll every 10 seconds
-        );
-
-        expect(firstCheck.found, `First alert notification should appear in validation stream for ${alertName}`).toBe(true);
-        testLogger.info('First notification verified in validation stream', {
-            alertName,
-            found: firstCheck.found,
-            attempts: firstCheck.attempts
-        });
-
-        // Get initial notification count
-        const initialCount = await pm.commonActions.countAlertNotificationsInStream(
-            validationInfra.streamName,
-            alertName,
-            15
-        );
-        testLogger.info('Initial notification count', {
-            count: initialCount.count,
-            alertName
-        });
-
-        // ===== TRIGGER #2: Additional data ingestion (same fingerprint, within window) =====
-        testLogger.info('Ingesting second batch of data (should be suppressed by dedup)...');
-        const trigger2Start = Date.now();
-        await pm.commonActions.ingestTestDataWithUniqueId(sourceStreamName, `trigger2_${uniqueSuffix}`, column, value);
-        testLogger.info('Second data ingestion complete');
-
-        // Wait for another evaluation cycle: poll until the scheduled-alert window has elapsed
-        // since trigger2 ingestion. This is the deterministic equivalent of the previous time wait.
-        testLogger.info('Waiting for second scheduled alert evaluation cycle...');
-        await page.waitForFunction(
-            (startedAt) => Date.now() - startedAt >= 100000,
-            trigger2Start,
-            { timeout: 120000, polling: 5000 }
-        );
-
-        // ===== VALIDATION: Check that dedup suppressed the duplicate =====
-        const finalCount = await pm.commonActions.countAlertNotificationsInStream(
-            validationInfra.streamName,
-            alertName,
-            15
-        );
-        testLogger.info('Final notification count after second trigger', {
-            initialCount: initialCount.count,
-            finalCount: finalCount.count,
-            alertName
-        });
-
-        // The key assertion: count should NOT have increased
-        // If dedup is working, we should have same count as before
-        expect(
-            finalCount.count,
-            `Dedup should suppress duplicate: expected ${initialCount.count} notifications, got ${finalCount.count}`
-        ).toBe(initialCount.count);
-
-        testLogger.info('DEDUPLICATION VALIDATION PASSED', {
-            alertName,
-            dedupConfig,
-            firstTriggerCount: initialCount.count,
-            secondTriggerCount: finalCount.count,
-            duplicateSuppressed: true
-        });
-    });
 });
diff --git a/tests/ui-testing/playwright-tests/Alerts/alerts-vrl-encoding.spec.js b/tests/ui-testing/playwright-tests/Alerts/alerts-vrl-encoding.spec.js
index 90749a58f7..b47e26011c 100644
--- a/tests/ui-testing/playwright-tests/Alerts/alerts-vrl-encoding.spec.js
+++ b/tests/ui-testing/playwright-tests/Alerts/alerts-vrl-encoding.spec.js
@@ -423,7 +423,7 @@ test.describe("VRL Encoding Tests @vrl @alerts", () => {
       await page.waitForLoadState('domcontentloaded', { timeout: 15000 }).catch(() => {});
 
       // Navigate through wizard steps and submit
-      await pm.alertsPage.navigateThroughWizardSteps(5);
+      await pm.alertsPage.navigateThroughWizardSteps(4);
 
       const submitted = await pm.alertsPage.clickSubmitButton();
       expect(submitted).toBe(true);
diff --git a/tests/ui-testing/playwright-tests/Correlation/correlation-settings.spec.js b/tests/ui-testing/playwright-tests/Correlation/correlation-settings.spec.js
index 18fb702e44..fa6367b753 100644
--- a/tests/ui-testing/playwright-tests/Correlation/correlation-settings.spec.js
+++ b/tests/ui-testing/playwright-tests/Correlation/correlation-settings.spec.js
@@ -133,7 +133,7 @@ test.describe(
       pm = new PageManager(page);
     });
 
-    test("loads the Correlation Settings page with all four tabs visible", {
+    test("loads the Correlation Settings page with all three tabs visible", {
       tag: ["@smoke", "@P0"],
     }, async () => {
       const orgId = process.env["ORGNAME"];
@@ -142,7 +142,7 @@ test.describe(
       await pm.correlationSettingsPage.expectAllTabsVisible();
     });
 
-    test("switches between all four tabs successfully", {
+    test("switches between all three tabs successfully", {
       tag: ["@smoke", "@P0"],
     }, async () => {
       const orgId = process.env["ORGNAME"];
@@ -152,8 +152,8 @@ test.describe(
       await pm.correlationSettingsPage.expectServicesContentVisible();
       await pm.correlationSettingsPage.clickServiceDiscoveryTab();
       await pm.correlationSettingsPage.expectServiceDiscoveryContentVisible();
-      await pm.correlationSettingsPage.clickAlertCorrelationTab();
-      await pm.correlationSettingsPage.expectAlertCorrelationContentVisible();
+      await pm.correlationSettingsPage.clickFieldAliasesTab();
+      await pm.correlationSettingsPage.expectFieldAliasesContentVisible();
       await pm.correlationSettingsPage.clickServicesTab();
       await pm.correlationSettingsPage.expectServicesContentVisible();
     });
diff --git a/tests/ui-testing/playwright-tests/Dashboards/dashboard-create-alert.spec.js b/tests/ui-testing/playwright-tests/Dashboards/dashboard-create-alert.spec.js
index 7937d9c43e..d6c75501fb 100644
--- a/tests/ui-testing/playwright-tests/Dashboards/dashboard-create-alert.spec.js
+++ b/tests/ui-testing/playwright-tests/Dashboards/dashboard-create-alert.spec.js
@@ -629,10 +629,7 @@ test.describe("Dashboard Create Alert testcases", () => {
       await destOption.click();
       await page.keyboard.press("Escape");
 
-      // Step 5 (Dedup) → Skip, Continue
-      await continueBtn.click();
-
-      // Step 6 (Advanced) → Skip, Continue
+      // Step 5 (Advanced) → Skip, Continue
       await continueBtn.click();
 
       // Submit the alert
diff --git a/tests/ui-testing/playwright-tests/Dashboards/dashboard-html-chart.spec.js b/tests/ui-testing/playwright-tests/Dashboards/dashboard-html-chart.spec.js
index 2c3cae9178..cabc11955d 100644
--- a/tests/ui-testing/playwright-tests/Dashboards/dashboard-html-chart.spec.js
+++ b/tests/ui-testing/playwright-tests/Dashboards/dashboard-html-chart.spec.js
@@ -7,12 +7,24 @@ const testLogger = require('../utils/test-logger.js');
 import logData from "../../fixtures/log.json";
 import { ingestion } from "./utils/dashIngestion.js";
 import PageManager from "../../pages/page-manager";
-import { waitForDashboardPage, deleteDashboard } from "./utils/dashCreation.js";
+import {
+  waitForDashboardPage,
+  deleteDashboard,
+  setupTestDashboard,
+  cleanupTestDashboard,
+} from "./utils/dashCreation.js";
+import {
+  BLANK_TARGET_HTML_SNIPPET,
+  DROPPED_TARGET_HTML_SNIPPET,
+  HTML_LINK_SELECTORS,
+  POPUP_HTML_SNIPPET,
+  SHADOWED_FORM_HTML_SNIPPET,
+} from "./utils/htmlPanelFixtures.js";
 // Each test runs in parallel (mode: "parallel" below), so the name must be
 // generated fresh per test — a single shared name caused cross-test races
 // where one test's create/delete collided with another's mid-flight.
 const generateDashboardName = () =>
-  "Dashboard_" + Math.random().toString(36).substr(2, 9);
+  "Dashboard_" + Math.random().toString(36).slice(2, 11);
 
 // Basic HTML snippet for the first test
 const BASIC_HTML_SNIPPET = `<!DOCTYPE html>
@@ -106,7 +118,6 @@ test.describe("HTML chart dashboard", () => {
     await deleteDashboard(page, randomDashboardName);
   });
 
-  //skip because value is not set in the variable on other environments its is working
   test("Should correctly replace the dashboard variable value on the HTML chart.", async ({
     page,
   }) => {
@@ -176,8 +187,7 @@ test.describe("HTML chart dashboard", () => {
     const pm = new PageManager(page);
     const panelName =
       pm.dashboardPanelActions.generateUniquePanelName("panel-test");
-    const dashboardName =
-      "Dashboard_" + Math.random().toString(36).substr(2, 9);
+    const dashboardName = generateDashboardName();
 
     await pm.dashboardList.menuItem("dashboards-item");
     await waitForDashboardPage(page);
@@ -204,7 +214,6 @@ test.describe("HTML chart dashboard", () => {
     const panelName =
       pm.dashboardPanelActions.generateUniquePanelName("panel-test");
     const dashboardName = generateDashboardName();
-    const sentinel = () => page.evaluate(() => window.__o2HtmlPanelSentinel);
 
     await pm.dashboardList.menuItem("dashboards-item");
     await waitForDashboardPage(page);
@@ -217,7 +226,7 @@ test.describe("HTML chart dashboard", () => {
     await expect(
       pm.chartTypeSelector.getHtmlHeading("CSS Rewrite Test")
     ).toBeVisible();
-    await expect(page.locator("img[onerror]")).toHaveCount(0);
+    await expect(pm.chartTypeSelector.getInjectedOnErrorImages()).toHaveCount(0);
 
     await pm.dashboardPanelActions.addPanelName(panelName);
     await pm.dashboardPanelActions.savePanel();
@@ -225,10 +234,10 @@ test.describe("HTML chart dashboard", () => {
     await expect(
       pm.chartTypeSelector.getHtmlHeading("CSS Rewrite Test")
     ).toBeVisible();
-    await expect(page.locator("img[onerror]")).toHaveCount(0);
+    await expect(pm.chartTypeSelector.getInjectedOnErrorImages()).toHaveCount(0);
     // an injected image fails to load asynchronously, so give onerror time to fire
     await page.waitForTimeout(1000);
-    expect(await sentinel()).toBeUndefined();
+    expect(await pm.chartTypeSelector.getHtmlPanelSentinel()).toBeUndefined();
 
     await pm.dashboardCreate.backToDashboardList();
     await deleteDashboard(page, dashboardName);
@@ -240,8 +249,7 @@ test.describe("HTML chart dashboard", () => {
     const pm = new PageManager(page);
     const panelName =
       pm.dashboardPanelActions.generateUniquePanelName("panel-test");
-    const dashboardName =
-      "Dashboard_" + Math.random().toString(36).substr(2, 9);
+    const dashboardName = generateDashboardName();
 
     await pm.dashboardList.menuItem("dashboards-item");
     await waitForDashboardPage(page);
@@ -261,3 +269,173 @@ test.describe("HTML chart dashboard", () => {
     await deleteDashboard(page, dashboardName);
   });
 });
+
+test.describe("HTML chart link targets", () => {
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    await navigateToBase(page);
+    await page.goto(
+      `${logData.logsUrl}?org_identifier=${process.env["ORGNAME"]}`
+    );
+  });
+
+  test("Should keep target=_blank and force a safe rel on links, forms, area and SVG links", {
+    tag: ["@dashboards", "@htmlChart", "@P1"],
+  }, async ({ page }) => {
+    const pm = new PageManager(page);
+    const dashboardName = generateDashboardName();
+
+    await setupTestDashboard(page, pm, dashboardName);
+    await pm.dashboardCreate.addPanel();
+    await pm.chartTypeSelector.addHtmlPanelContent(BLANK_TARGET_HTML_SNIPPET);
+    await expect(
+      pm.chartTypeSelector.getHtmlHeading("Blank Target Test")
+    ).toBeVisible();
+
+    for (const selector of [
+      HTML_LINK_SELECTORS.blankLink,
+      HTML_LINK_SELECTORS.blankMixedCaseLink,
+      HTML_LINK_SELECTORS.blankForm,
+      HTML_LINK_SELECTORS.blankArea,
+      HTML_LINK_SELECTORS.blankSvgLink,
+    ]) {
+      await pm.chartTypeSelector.expectHtmlLinkTarget(selector, "_blank");
+    }
+
+    await pm.dashboardPanelActions.addPanelName(
+      pm.dashboardPanelActions.generateUniquePanelName("panel-test")
+    );
+    await pm.dashboardPanelActions.savePanel();
+    await cleanupTestDashboard(page, pm, dashboardName);
+  });
+
+  test("Should drop named, _top, _self and _parent targets without adding rel", {
+    tag: ["@dashboards", "@htmlChart", "@P1"],
+  }, async ({ page }) => {
+    const pm = new PageManager(page);
+    const dashboardName = generateDashboardName();
+
+    await setupTestDashboard(page, pm, dashboardName);
+    await pm.dashboardCreate.addPanel();
+    await pm.chartTypeSelector.addHtmlPanelContent(DROPPED_TARGET_HTML_SNIPPET);
+    await expect(
+      pm.chartTypeSelector.getHtmlHeading("Dropped Target Test")
+    ).toBeVisible();
+
+    for (const selector of [
+      HTML_LINK_SELECTORS.namedLink,
+      HTML_LINK_SELECTORS.topLink,
+      HTML_LINK_SELECTORS.selfLink,
+      HTML_LINK_SELECTORS.parentLink,
+      HTML_LINK_SELECTORS.namedForm,
+    ]) {
+      await pm.chartTypeSelector.expectHtmlLinkTarget(selector, null);
+    }
+
+    // an element without a target keeps the author's rel
+    await expect(
+      pm.chartTypeSelector.getHtmlRendererElement(HTML_LINK_SELECTORS.plainLink)
+    ).toHaveAttribute("rel", "nofollow");
+
+    await pm.dashboardPanelActions.addPanelName(
+      pm.dashboardPanelActions.generateUniquePanelName("panel-test")
+    );
+    await pm.dashboardPanelActions.savePanel();
+    await cleanupTestDashboard(page, pm, dashboardName);
+  });
+
+  test("Should render a form with a control named getAttribute and drop a nodeName-clobbered form", {
+    tag: ["@dashboards", "@htmlChart", "@P1"],
+  }, async ({ page }) => {
+    const pm = new PageManager(page);
+    const dashboardName = generateDashboardName();
+
+    await setupTestDashboard(page, pm, dashboardName);
+    await pm.dashboardCreate.addPanel();
+    await pm.chartTypeSelector.addHtmlPanelContent(SHADOWED_FORM_HTML_SNIPPET);
+
+    await expect(
+      pm.chartTypeSelector.getHtmlHeading("Shadowed Form Test")
+    ).toBeVisible();
+    await expect(
+      pm.chartTypeSelector.getHtmlRendererElement(HTML_LINK_SELECTORS.shadowedFormButton)
+    ).toBeVisible();
+    await pm.chartTypeSelector.expectHtmlLinkTarget(HTML_LINK_SELECTORS.shadowedForm, "_blank");
+    await expect(
+      pm.chartTypeSelector.getHtmlRendererElement(HTML_LINK_SELECTORS.clobberedForm)
+    ).toHaveCount(0);
+    await pm.chartTypeSelector.expectHtmlLinkTarget(HTML_LINK_SELECTORS.afterFormsLink, "_blank");
+
+    await pm.dashboardPanelActions.addPanelName(
+      pm.dashboardPanelActions.generateUniquePanelName("panel-test")
+    );
+    await pm.dashboardPanelActions.savePanel();
+    await cleanupTestDashboard(page, pm, dashboardName);
+  });
+
+  test("Should open a target=_blank link in a new tab without window.opener", {
+    tag: ["@dashboards", "@htmlChart", "@P1"],
+  }, async ({ page }) => {
+    const pm = new PageManager(page);
+    const dashboardName = generateDashboardName();
+    const popupUrl = new URL("/healthz", process.env["ZO_BASE_URL"]).href;
+
+    await setupTestDashboard(page, pm, dashboardName);
+    await pm.dashboardCreate.addPanel();
+    await pm.chartTypeSelector.addHtmlPanelContent(POPUP_HTML_SNIPPET);
+    await pm.chartTypeSelector.expectHtmlLinkTarget(HTML_LINK_SELECTORS.popupLink, "_blank");
+
+    const popup = await pm.chartTypeSelector.clickHtmlRendererElementForPopup(
+      HTML_LINK_SELECTORS.popupLink
+    );
+    expect(popup.url()).toBe(popupUrl);
+    expect(await pm.chartTypeSelector.isPopupOpenerNull(popup)).toBe(true);
+    await popup.close();
+
+    // the dashboard tab itself must not navigate away
+    await expect(
+      pm.chartTypeSelector.getHtmlHeading("Popup Link Test")
+    ).toBeVisible();
+
+    await pm.dashboardPanelActions.addPanelName(
+      pm.dashboardPanelActions.generateUniquePanelName("panel-test")
+    );
+    await pm.dashboardPanelActions.savePanel();
+    await cleanupTestDashboard(page, pm, dashboardName);
+  });
+
+  test("Should keep target=_blank and safe rel on the saved panel after reload", {
+    tag: ["@dashboards", "@htmlChart", "@P2"],
+  }, async ({ page }) => {
+    const pm = new PageManager(page);
+    const dashboardName = generateDashboardName();
+
+    await setupTestDashboard(page, pm, dashboardName);
+    await pm.dashboardCreate.addPanel();
+    await pm.chartTypeSelector.addHtmlPanelContent(BLANK_TARGET_HTML_SNIPPET);
+    await expect(
+      pm.chartTypeSelector.getHtmlHeading("Blank Target Test")
+    ).toBeVisible();
+
+    await pm.dashboardPanelActions.addPanelName(
+      pm.dashboardPanelActions.generateUniquePanelName("panel-test")
+    );
+    await pm.dashboardPanelActions.savePanel();
+
+    await expect(
+      pm.chartTypeSelector.getHtmlHeading("Blank Target Test")
+    ).toBeVisible();
+    await pm.chartTypeSelector.expectHtmlLinkTarget(HTML_LINK_SELECTORS.blankLink, "_blank");
+    await pm.chartTypeSelector.expectHtmlLinkTarget(HTML_LINK_SELECTORS.blankForm, "_blank");
+
+    await page.reload();
+    await expect(
+      pm.chartTypeSelector.getHtmlHeading("Blank Target Test")
+    ).toBeVisible();
+    await pm.chartTypeSelector.expectHtmlLinkTarget(HTML_LINK_SELECTORS.blankLink, "_blank");
+    await pm.chartTypeSelector.expectHtmlLinkTarget(HTML_LINK_SELECTORS.blankMixedCaseLink, "_blank");
+    await pm.chartTypeSelector.expectHtmlLinkTarget(HTML_LINK_SELECTORS.blankSvgLink, "_blank");
+
+    await cleanupTestDashboard(page, pm, dashboardName);
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/Dashboards/utils/htmlPanelFixtures.js b/tests/ui-testing/playwright-tests/Dashboards/utils/htmlPanelFixtures.js
new file mode 100644
index 0000000000..428c5e3e8b
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Dashboards/utils/htmlPanelFixtures.js
@@ -0,0 +1,62 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+export const HTML_LINK_SELECTORS = {
+  blankLink: "#o2-blank-link",
+  blankMixedCaseLink: "#o2-blank-mixed-case-link",
+  blankForm: "#o2-blank-form",
+  blankArea: "#o2-blank-area",
+  blankSvgLink: "#o2-blank-svg-link",
+  namedLink: "#o2-named-link",
+  topLink: "#o2-top-link",
+  selfLink: "#o2-self-link",
+  parentLink: "#o2-parent-link",
+  namedForm: "#o2-named-form",
+  plainLink: "#o2-plain-link",
+  shadowedForm: "#o2-shadowed-form",
+  shadowedFormButton: "#o2-shadowed-form button",
+  clobberedForm: "#o2-clobbered-form",
+  afterFormsLink: "#o2-after-forms-link",
+  popupLink: "#o2-popup-link",
+};
+
+export const BLANK_TARGET_HTML_SNIPPET = `<h1>Blank Target Test</h1>
+<a id="o2-blank-link" href="https://example.com/a" target="_blank" rel="opener">Blank link</a>
+<a id="o2-blank-mixed-case-link" href="https://example.com/b" target="  _BLANK ">Mixed case link</a>
+<form id="o2-blank-form" action="https://example.com/submit" target="_blank"><button type="submit">Go</button></form>
+<map name="o2-map"><area id="o2-blank-area" shape="rect" coords="0,0,10,10" href="https://example.com/c" target="_blank" alt="area"></map>
+<svg width="20" height="20"><a id="o2-blank-svg-link" href="https://example.com/d" target="_blank"><rect width="10" height="10"></rect></a></svg>`;
+
+export const DROPPED_TARGET_HTML_SNIPPET = `<h1>Dropped Target Test</h1>
+<a id="o2-named-link" href="https://example.com/a" target="o2frame">Named link</a>
+<a id="o2-top-link" href="https://example.com/b" target="_top">Top link</a>
+<a id="o2-self-link" href="https://example.com/c" target="_self">Self link</a>
+<a id="o2-parent-link" href="https://example.com/d" target="_parent">Parent link</a>
+<form id="o2-named-form" action="https://example.com/submit" target="o2frame"><button type="submit">Go</button></form>
+<a id="o2-plain-link" href="https://example.com/e" rel="nofollow">Plain link</a>`;
+
+// a shadowed getAttribute must not blank the panel; a shadowed nodeName form is dropped as clobbered
+export const SHADOWED_FORM_HTML_SNIPPET = `<h1>Shadowed Form Test</h1>
+<form id="o2-shadowed-form" action="https://example.com/submit" target="_blank">
+  <input name="getAttribute" value="a">
+  <button type="submit">Send</button>
+</form>
+<form id="o2-clobbered-form" action="https://example.com/submit" target="_blank">
+  <input name="nodeName" value="b">
+</form>
+<a id="o2-after-forms-link" href="https://example.com/a" target="_blank">After forms</a>`;
+
+export const POPUP_HTML_SNIPPET = `<h1>Popup Link Test</h1>
+<a id="o2-popup-link" href="/healthz" target="_blank">Open in new tab</a>`;
diff --git a/tests/ui-testing/playwright-tests/IAM/iam-roles-editor.spec.js b/tests/ui-testing/playwright-tests/IAM/iam-roles-editor.spec.js
index 3729f01c48..6f121c87ea 100644
--- a/tests/ui-testing/playwright-tests/IAM/iam-roles-editor.spec.js
+++ b/tests/ui-testing/playwright-tests/IAM/iam-roles-editor.spec.js
@@ -272,7 +272,7 @@ test.describe('IAM · Edit Role · navigation and filtering', { tag: '@enterpris
 
     // ---------------- empty role, presets, loading ----------------
 
-    test('U-13 · an empty role offers the three presets', {
+    test('U-13 · the Role Overview Presets panel offers the built-in and job presets', {
         tag: ['@iam', '@iamRolesEditor', '@P1', '@all']
     }, async () => {
         await pm.rolesPage.gotoRoles();
@@ -280,9 +280,21 @@ test.describe('IAM · Edit Role · navigation and filtering', { tag: '@enterpris
         await pm.rolesPage.waitForGrantsSettled(0);
 
         await expect(pm.rolesPage.summaryEmpty).toBeVisible({ timeout: 15000 });
-        await expect(pm.rolesPage.presetCard('Read-Only')).toBeVisible();
-        await expect(pm.rolesPage.presetCard('Database Monitoring Viewer')).toBeVisible();
-        await expect(pm.rolesPage.presetCard('Kubernetes Viewer')).toBeVisible();
+        await expect(pm.rolesPage.presetsPanel).toBeVisible({ timeout: 15000 });
+        // Job presets hide only when a module they grant is missing; an enterprise org has all of them.
+        for (const id of [
+            'readonly', 'dbm', 'k8s', 'rum_viewer', 'rum_editor',
+            'alert_manager', 'alert_viewer', 'dashboard_editor', 'dashboard_viewer', 'pipeline_editor',
+        ]) {
+            await expect(pm.rolesPage.presetRow(id), `preset ${id} missing from the panel`).toBeVisible();
+        }
+
+        // A row opens its detail in place; Back returns to the list.
+        await pm.rolesPage.openPreset('readonly');
+        await expect(pm.rolesPage.presetRow('alert_manager')).toBeHidden();
+        await pm.rolesPage.presetBack.click();
+        await expect(pm.rolesPage.presetDetail).toBeHidden();
+        await expect(pm.rolesPage.presetRow('alert_manager')).toBeVisible();
     });
 
     // Guards o2-enterprise#2697: a populated role once read "0 Permissions" before its grants loaded.
diff --git a/tests/ui-testing/playwright-tests/IAM/iam-roles-grants.spec.js b/tests/ui-testing/playwright-tests/IAM/iam-roles-grants.spec.js
index 891afd95de..e3413c1497 100644
--- a/tests/ui-testing/playwright-tests/IAM/iam-roles-grants.spec.js
+++ b/tests/ui-testing/playwright-tests/IAM/iam-roles-grants.spec.js
@@ -1,4 +1,4 @@
-// IAM → Edit Role · grant semantics (G-01 .. G-18)
+// IAM → Edit Role · grant semantics (G-01 .. G-19)
 //
 // Plan: .claude/commands/nvpworkflow/iam-roles-redesign-tests.md
 //
@@ -335,8 +335,8 @@ test.describe('IAM · Edit Role · grant semantics', { tag: '@enterprise' }, ()
         tag: ['@iam', '@iamRolesGrants', '@P1', '@all']
     }, async ({ page }) => {
         const name = await openFresh(page, 'preset');
-        await expect(pm.rolesPage.summaryEmpty).toBeVisible({ timeout: 15000 });
-        await pm.rolesPage.presetCard('Read-Only').click();
+        await expect(pm.rolesPage.presetsPanel).toBeVisible({ timeout: 15000 });
+        await pm.rolesPage.applyPreset('readonly');
         await pm.rolesPage.save();
 
         const stored = await getPerms(page, name);
@@ -384,6 +384,42 @@ test.describe('IAM · Edit Role · grant semantics', { tag: '@enterprise' }, ()
             .toBeGreaterThan(0);
     });
 
+    test('G-19 · the Alert Manager preset adds module-wide grants plus Streams List and Get, leaving nothing missing', {
+        tag: ['@iam', '@iamRolesGrants', '@P1', '@all']
+    }, async ({ page }) => {
+        const name = await openFresh(page, 'alertmgr');
+        const want = [
+            { object: obj('afolder'), permission: 'AllowAll' },
+            { object: obj('destination'), permission: 'AllowAll' },
+            { object: obj('template'), permission: 'AllowAll' },
+            { object: obj('stream'), permission: 'AllowList' },
+            { object: obj('stream'), permission: 'AllowGet' },
+        ];
+
+        await expect(pm.rolesPage.presetStatus('alert_manager')).toContainText('+5', { timeout: 15000 });
+        await pm.rolesPage.openPreset('alert_manager');
+        await expect(pm.rolesPage.presetDetail).toContainText('Nothing will be missing after you add it.');
+        await expect(pm.rolesPage.presetApply).toBeEnabled({ timeout: 15000 });
+        await pm.rolesPage.presetApply.click();
+        await pm.rolesPage.waitForPresetStaged();
+
+        await pm.rolesPage.openDrawer();
+        // One row per object, so Streams List and Get share the stream row.
+        for (const resource of ['afolder', 'destination', 'template', 'stream']) {
+            await expect(pm.rolesPage.drawerChange(`${resource}-_all_${org()}-added`)).toBeVisible();
+        }
+        await expect(pm.rolesPage.drawerCompanions).toHaveCount(0);
+
+        const payload = await pm.rolesPage.saveAndCapture({ via: pm.rolesPage.drawerSave });
+        expect(payload, 'save fired no PUT').toBeTruthy();
+        expect(payload.remove).toEqual([]);
+        expect(tuples(payload.add)).toEqual(tuples(want));
+
+        await expect
+            .poll(async () => tuples(await getPerms(page, name)), { timeout: 15000 })
+            .toEqual(tuples(want));
+    });
+
     // ---------------- column select-all ----------------
 
     test('G-14 · ticking the List header in All Modules grants List on every module at once', {
diff --git a/tests/ui-testing/playwright-tests/IAM/iam-roles-scale.spec.js b/tests/ui-testing/playwright-tests/IAM/iam-roles-scale.spec.js
index 0fdca7b6a0..c074908673 100644
--- a/tests/ui-testing/playwright-tests/IAM/iam-roles-scale.spec.js
+++ b/tests/ui-testing/playwright-tests/IAM/iam-roles-scale.spec.js
@@ -151,8 +151,9 @@ test.describe('IAM · Edit Role · scale and layout', { tag: '@enterprise' }, ()
 
         // Looking at the JSON is not editing it — a round trip that stages changes
         // would let an untouched role be rewritten by a stray Save.
-        await expect(pm.rolesPage.reviewChangesButton,
-            'the Table -> JSON -> Table round trip staged changes').toHaveCount(0);
+        // Review Changes always renders in table view; List-only grants raise no companion gap, so it stays disabled.
+        await expect(pm.rolesPage.unsavedCount, 'the Table -> JSON -> Table round trip staged changes').toHaveCount(0);
+        await expect(pm.rolesPage.reviewChangesButton).toBeDisabled();
 
         const payload = await pm.rolesPage.saveAndCapture({ expectRequest: false });
         if (payload) {
diff --git a/tests/ui-testing/playwright-tests/IAM/iam-roles-staging.spec.js b/tests/ui-testing/playwright-tests/IAM/iam-roles-staging.spec.js
index affdf24f36..7161f97692 100644
--- a/tests/ui-testing/playwright-tests/IAM/iam-roles-staging.spec.js
+++ b/tests/ui-testing/playwright-tests/IAM/iam-roles-staging.spec.js
@@ -129,7 +129,7 @@ test.describe('IAM · Edit Role · staged changes', { tag: '@enterprise' }, () =
     });
 
     // The drawer closes once nothing is left to review (useRoleSummary), so there is no empty state to wait for.
-    test('S-05 · undoing every change closes the drawer and drops Review Changes', {
+    test('S-05 · undoing every change closes the drawer and disables Review Changes', {
         tag: ['@iam', '@iamRolesStaging', '@P1', '@all']
     }, async ({ page }) => {
         const name = await openFresh(page, 'undoall');
@@ -143,7 +143,7 @@ test.describe('IAM · Edit Role · staged changes', { tag: '@enterprise' }, () =
             await page.waitForTimeout(300);
         }
         await expect(pm.rolesPage.drawer).toBeHidden({ timeout: 10000 });
-        await expect(pm.rolesPage.reviewChangesButton).toBeHidden();
+        await expect(pm.rolesPage.reviewChangesButton).toBeDisabled();
 
         // And nothing may reach the API afterwards.
         const payload = await pm.rolesPage.saveAndCapture({ expectRequest: false });
@@ -257,11 +257,11 @@ test.describe('IAM · Edit Role · staged changes', { tag: '@enterprise' }, () =
         await page.unroute('**/api/*/roles/*');
     });
 
-    // A clean role has nothing to review, so the affordance is not offered at all.
-    test('S-12 · a clean role offers no Review Changes', {
+    // A clean role has nothing to review, so Review Changes shows but is disabled.
+    test('S-12 · a clean role shows Review Changes disabled', {
         tag: ['@iam', '@iamRolesStaging', '@P2', '@all']
     }, async ({ page }) => {
         await openFresh(page, 'clean');
-        await expect(pm.rolesPage.reviewChangesButton).toBeHidden();
+        await expect(pm.rolesPage.reviewChangesButton).toBeDisabled();
     });
 });
diff --git a/tests/ui-testing/playwright-tests/Metrics/metrics-query-history.spec.js b/tests/ui-testing/playwright-tests/Metrics/metrics-query-history.spec.js
index 7b67185e11..d8ae345351 100644
--- a/tests/ui-testing/playwright-tests/Metrics/metrics-query-history.spec.js
+++ b/tests/ui-testing/playwright-tests/Metrics/metrics-query-history.spec.js
@@ -43,28 +43,41 @@ test.describe('Metrics editor query history', () => {
     await custom.click();
     await expect(custom).toHaveAttribute('data-state', 'on');
     await runAndRecord(page, pm, first);
+    await runAndRecord(page, pm, second);
 
     await metrics.openQueryHistory();
     await metrics.searchQueryHistory(String(marker));
     await expect(metrics.historyRow(first)).toHaveCount(1, { timeout: 15000 });
+    await expect(metrics.historyRow(second)).toHaveCount(1, { timeout: 15000 });
 
-    // Star it: the toggle flips, and the entry survives "starred only".
+    // Star one: the toggle flips, and "starred only" keeps it and drops the unstarred one.
     const starred = page.waitForResponse(isHistoryCall('PATCH'));
     await metrics.historyStarButton(first).click();
     expect((await starred).ok()).toBe(true);
     await expect(metrics.historyStarButton(first)).toHaveAttribute('aria-label', 'Unstar');
+    const starredOnlyBox = metrics.historyStarredOnly.locator('[role="checkbox"]');
+    // The new filter shows a skeleton until its list answers, and a skeleton has no rows to find.
+    const starredList = page.waitForResponse(
+      (res) => {
+        const params = new URL(res.url()).searchParams;
+        return isHistoryCall('GET')(res) && params.get('starred') === 'true' && !params.has('count_only');
+      },
+      { timeout: 30000 },
+    );
     await metrics.historyStarredOnly.click();
+    await expect(starredOnlyBox).toHaveAttribute('aria-checked', 'true');
+    const starredRows = await (await starredList).json();
+    expect(starredRows.map((row) => row.query)).toContain(first);
+    expect(starredRows.map((row) => row.query)).not.toContain(second);
     await expect(metrics.historyRow(first)).toHaveCount(1, { timeout: 15000 });
+    await expect(metrics.historyRow(second)).toHaveCount(0);
     await metrics.historyStarredOnly.click();
-    await page.keyboard.press('Escape');
-    await expect(metrics.historyTable).toBeHidden();
-
-    // Replace the editor's query, then load the starred entry back in place.
-    await runAndRecord(page, pm, second);
-    await metrics.openQueryHistory();
+    await expect(starredOnlyBox).toHaveAttribute('aria-checked', 'false');
     await expect(metrics.historyRow(second)).toHaveCount(1, { timeout: 15000 });
+
+    // The editor holds the second query; load the starred entry back in place.
     await metrics.loadHistoryEntry(first);
-    await expect(metrics.historyTable).toBeHidden();
+    await expect(metrics.historyDrawer).toBeHidden();
     await expect
       .poll(() => pm.metricsQueryEditorPage.getCurrentQueryText(), { timeout: 15000 })
       .toBe(first);
@@ -72,7 +85,8 @@ test.describe('Metrics editor query history', () => {
     // Starred entries are never reaped, so remove this run's from the user's history.
     await metrics.openQueryHistory();
     for (const query of [first, second]) {
-      const deleted = page.waitForResponse(isHistoryCall('DELETE'));
+      // The DELETE waits for the row's 6s Undo toast to close.
+      const deleted = page.waitForResponse(isHistoryCall('DELETE'), { timeout: 30000 });
       await metrics.deleteHistoryEntry(query);
       expect((await deleted).ok()).toBe(true);
       await expect(metrics.historyRow(query)).toHaveCount(0, { timeout: 15000 });
diff --git a/tests/ui-testing/playwright-tests/Profiles/profiles-chart-breakdown.spec.js b/tests/ui-testing/playwright-tests/Profiles/profiles-chart-breakdown.spec.js
new file mode 100644
index 0000000000..f3618df837
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Profiles/profiles-chart-breakdown.spec.js
@@ -0,0 +1,187 @@
+// Continuous Profiling time-series card: units, single points, drag-to-range, Breakdown and its legend.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const {
+  seedReferenceStream,
+  seedProfilesStream,
+  manyVersionsResources,
+  deleteProfilesStream,
+  MINUTE_MS,
+} = require('../utils/profiles-ingestion.js');
+
+test.describe('Profiles chart and breakdown', () => {
+  test.describe.configure({ mode: 'parallel' });
+  let api;
+  let ref;
+  let many;
+  let pm;
+
+  test.beforeAll(async ({ playwright }) => {
+    api = await playwright.request.newContext();
+    ref = await seedReferenceStream(api, 'chart');
+    many = await seedProfilesStream(api, 'chartmany', manyVersionsResources, { service: 'checkout', total: 7_800_000_000 });
+  });
+
+  test.afterAll(async () => {
+    await deleteProfilesStream(api, ref.stream);
+    await deleteProfilesStream(api, many.stream);
+    await api.dispose();
+  });
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    pm = new PageManager(page);
+    await pm.profilesPage.mockServerConfig();
+    await pm.profilesPage.hideFlameZoomHint();
+    await navigateToBase(page);
+  });
+
+  test.afterEach(async ({}, testInfo) => {
+    await pm.profilesPage.teardown();
+    testLogger.testEnd(testInfo.title, testInfo.status);
+  });
+
+  test('CPU chart is drawn in cores', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    const tips = await pm.profilesPage.collectSeriesTooltips();
+    testLogger.info('Series tooltips', { tips });
+    expect(tips.some((tip) => tip.endsWith('cpu 0.4 cores'))).toBe(true);
+    expect(tips.some((tip) => tip.endsWith('cpu 0.785 cores'))).toBe(true);
+    expect(tips.some((tip) => tip.endsWith('cpu 0.015 cores'))).toBe(true);
+  });
+
+  test('Memory chart uses binary byte units', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { service: 'payments', type: 'inuse_space', unit: 'bytes' });
+    const tips = await pm.profilesPage.collectSeriesTooltips();
+    testLogger.info('Series tooltips', { tips });
+    expect(tips.some((tip) => tip.endsWith('inuse_space 2 MiB'))).toBe(true);
+    expect(tips.some((tip) => tip.endsWith('inuse_space 4 MiB'))).toBe(true);
+    expect(tips.filter((tip) => / MB$| KB$/.test(tip))).toEqual([]);
+  });
+
+  test('A single point is drawn where it sits in the run window', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { service: 'catalog' });
+    const tips = await pm.profilesPage.collectSeriesTooltips(40);
+    expect(tips.some((tip) => tip.endsWith('cpu 0.5515 cores'))).toBe(true);
+    const drawn = await pm.profilesPage.seriesBlueCentre();
+    expect(drawn.count).toBeGreaterThan(0);
+    expect(drawn.centre).toBeGreaterThan(0.7);
+    expect(drawn.centre).toBeLessThan(0.95);
+  });
+
+  test('Dragging across the chart picks a minute-rounded range and runs', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.dragAcrossChart(0.3, 0.7);
+    await expect.poll(() => calls.merge.length, { timeout: 15000 }).toBeGreaterThan(0);
+    expect(calls.series.length).toBeGreaterThan(0);
+    await pm.profilesPage.waitForRunIdle();
+    await expect.poll(() => pm.profilesPage.currentQuery().from).not.toBe(String(ref.window.from));
+    const query = pm.profilesPage.currentQuery();
+    const from = Number(query.from);
+    const to = Number(query.to);
+    expect(query.period).toBeUndefined();
+    expect(from % (MINUTE_MS * 1000)).toBe(0);
+    expect(to % (MINUTE_MS * 1000)).toBe(0);
+    expect(from).toBeGreaterThan(ref.window.from);
+    expect(to).toBeLessThan(ref.window.to);
+    expect(to).toBeGreaterThan(from);
+    expect(calls.merge.at(-1).body.start_time).toBe(from);
+    await pm.profilesPage.expectRunPending(false);
+  });
+
+  test('Breakdown lists labels but not per-request ids', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    expect(await pm.profilesPage.breakdownOptionLabels()).toEqual([
+      'None',
+      'deployment_environment',
+      'host_name',
+      'service_instance_id',
+      'service_version',
+    ]);
+  });
+
+  test('Breakdown draws one line per value and re-fetches only the series', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.pickBreakdown('service_version');
+    await pm.profilesPage.expectBreakdownChips(['v1.4.0', 'v1.5.0']);
+    expect(calls.series).toHaveLength(1);
+    expect(calls.series[0].body.group_by).toBe('service_version');
+    expect(calls.series[0].body.group_limit).toBe(10);
+    expect(calls.merge).toHaveLength(0);
+    await pm.profilesPage.expectUrlParam('breakdown', 'service_version');
+  });
+
+  test('A legend chip filters the page to that value', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { extra: { breakdown: 'service_version' } });
+    await pm.profilesPage.expectBreakdownChips(['v1.4.0', 'v1.5.0']);
+    await pm.profilesPage.clickBreakdownChip('1');
+    await pm.profilesPage.expectFilterChip('service_version', 'v1.5.0');
+    await pm.profilesPage.expectRunPending(true);
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '4 s', selfPercent: '50.00%' });
+    await pm.profilesPage.expectUrlParam('filters', 'service_version=v1.5.0');
+  });
+
+  test('More than ten values fold into a disabled Others chip', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(many, { extra: { breakdown: 'service_version' } });
+    await pm.profilesPage.expectBreakdownChips([
+      'v1.3.0',
+      'v1.4.0',
+      'v1.5.0',
+      'v1.6.0',
+      'v1.7.0',
+      'v1.8.0',
+      'v1.9.0',
+      'v1.10.0',
+      'v1.11.0',
+      'v1.12.0',
+      'Others',
+    ]);
+    await pm.profilesPage.expectOthersChipDisabled();
+  });
+
+  test('Breakdown is disabled until the first run answers', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    const release = await pm.profilesPage.holdApi('merge');
+    await pm.profilesPage.openSeededNoWait({ stream: ref.stream, ...ref.window, service: 'checkout' });
+    await pm.profilesPage.expectState('seriesSkeleton');
+    await pm.profilesPage.expectBreakdownDisabled();
+    release();
+    await pm.profilesPage.waitForRunIdle();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+  });
+
+  test('Breakdown re-charts the last run, not unrun selector changes', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.selectService('payments');
+    await pm.profilesPage.expectRunPending(true);
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.pickBreakdown('service_version');
+    await pm.profilesPage.expectBreakdownChips(['v1.4.0', 'v1.5.0']);
+    expect(calls.series).toHaveLength(1);
+    expect(calls.series[0].body.service_name).toBe('checkout');
+    expect(calls.series[0].body.group_by).toBe('service_version');
+  });
+
+  test('Expand hides the chart and collapse brings it back', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectSeriesCardVisible(true);
+    await pm.profilesPage.toggleResultsExpand();
+    await pm.profilesPage.expectSeriesCardVisible(false);
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query' });
+    await pm.profilesPage.toggleResultsExpand();
+    await pm.profilesPage.expectSeriesCardVisible(true);
+  });
+
+  test('An empty series shows No data while the tables keep their rows', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.mockApi('series', {
+      json: { unit: 'nanoseconds', profile_type: 'cpu', step_secs: 10, series: [], took: 1 },
+    });
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectState('noSeries', { title: 'No data' });
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/Profiles/profiles-compare.spec.js b/tests/ui-testing/playwright-tests/Profiles/profiles-compare.spec.js
new file mode 100644
index 0000000000..775df91b5f
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Profiles/profiles-compare.spec.js
@@ -0,0 +1,174 @@
+// Continuous Profiling Compare view: diff table, diff flame, side by side, sides and messages.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const { CHECKOUT_FRAMES: F, fullWidthFrame } = require('../../pages/profilesPages/profilesPage.js');
+const {
+  seedReferenceStream,
+  seedProfilesStream,
+  noLabelResources,
+  deleteProfilesStream,
+} = require('../utils/profiles-ingestion.js');
+
+test.describe('Profiles compare', () => {
+  test.describe.configure({ mode: 'parallel' });
+  let api;
+  let ref;
+  let bare;
+  let pm;
+
+  test.beforeAll(async ({ playwright }) => {
+    api = await playwright.request.newContext();
+    ref = await seedReferenceStream(api, 'compare');
+    bare = await seedProfilesStream(api, 'cmpbare', noLabelResources, { service: 'bare-svc', total: 1_000_000_000 });
+  });
+
+  test.afterAll(async () => {
+    await deleteProfilesStream(api, ref.stream);
+    await deleteProfilesStream(api, bare.stream);
+    await api.dispose();
+  });
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    pm = new PageManager(page);
+    await pm.profilesPage.mockServerConfig();
+    await pm.profilesPage.hideFlameZoomHint();
+    await navigateToBase(page);
+  });
+
+  test.afterEach(async ({}, testInfo) => {
+    await pm.profilesPage.teardown();
+    testLogger.testEnd(testInfo.title, testInfo.status);
+  });
+
+  test('Compare defaults to service_version with the latest two values', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.expectCompareSides('service_version', 'v1.4.0', 'v1.5.0');
+    expect(calls.diff).toHaveLength(1);
+    const body = calls.diff[0].body;
+    expect(body.max_nodes).toBe(4096);
+    expect(body.baseline.filters).toEqual([{ key: 'service_version', op: '=', value: 'v1.4.0' }]);
+    expect(body.comparison.filters).toEqual([{ key: 'service_version', op: '=', value: 'v1.5.0' }]);
+    expect(body.baseline.service_name).toBe('checkout');
+    expect(body.comparison.profile_type).toBe('cpu');
+  });
+
+  test('Diff Table shows each side and the share change in points', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare', extra: { compare_display: 'table' } });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.expectCompareTableRow('json_encode', {
+      before: '1 s',
+      after: '3 s',
+      beforePercent: '25.00%',
+      afterPercent: '37.50%',
+      change: '+12.50 pt',
+    });
+    await pm.profilesPage.expectCompareTableRow('process_payment', { before: '0 ns', after: '250 ms', change: '+3.13 pt' });
+    await pm.profilesPage.expectCompareTableRow('db_query', { before: '2 s', after: '4 s', change: '0.00 pt' });
+    await pm.profilesPage.expectCompareTableRow('handle_order', { before: '4 s', after: '7.85 s', change: '−1.88 pt' });
+    await pm.profilesPage.expectCompareTableRow('gc_sweep', { before: '0 ns', after: '150 ms', change: '+1.88 pt' });
+  });
+
+  test('Diff Flame Graph tooltip shows both sides and the change', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    const scope = pm.profilesPage.compareFlame;
+    await pm.profilesPage.hoverFrame(fullWidthFrame(0), 'v1.5.0: 8 s', { scope });
+    await pm.profilesPage.hoverFrame(F.db_query, 'db_query', { scope });
+    await pm.profilesPage.expectFlameTooltipContains('db_query', ['v1.4.0', '2 s', 'v1.5.0', '4 s', '50.00%', 'Change', '0.00 pt']);
+    await pm.profilesPage.hoverFrame({ depth: 3, left: 50, width: 37.5 }, 'json_encode', { scope });
+    await pm.profilesPage.expectFlameTooltipContains('json_encode', ['1 s', '25.00%', '3 s', '37.50%', '+12.50 pt']);
+  });
+
+  test('Side by side names each graph by its value and total', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.pickCompareDisplay('sides');
+    await pm.profilesPage.hoverFrame(fullWidthFrame(0), 'v1.4.0: 4 s', { scope: pm.profilesPage.compareSideBaseline });
+    await pm.profilesPage.hoverFrame(fullWidthFrame(0), 'v1.5.0: 8 s', { scope: pm.profilesPage.compareSideComparison });
+    await pm.profilesPage.expectUrlParam('compare_display', 'sides');
+  });
+
+  test('Swap exchanges the sides and re-runs the diff', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.clickCompareSwap();
+    await pm.profilesPage.expectCompareSides('service_version', 'v1.5.0', 'v1.4.0');
+    expect(calls.diff).toHaveLength(1);
+    expect(calls.diff[0].body.baseline.filters).toEqual([{ key: 'service_version', op: '=', value: 'v1.5.0' }]);
+    expect(calls.diff[0].body.comparison.filters).toEqual([{ key: 'service_version', op: '=', value: 'v1.4.0' }]);
+    await pm.profilesPage.expectUrlParam('compare_a', 'v1.5.0');
+    await pm.profilesPage.expectUrlParam('compare_b', 'v1.4.0');
+  });
+
+  test('Compare state survives a reload', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.pickCompareDisplay('sides');
+    await pm.profilesPage.clickCompareSwap();
+    await pm.profilesPage.expectUrlParam('compare_a', 'v1.5.0');
+    await pm.profilesPage.reload();
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.expectViewActive('compare');
+    await pm.profilesPage.expectCompareSides('service_version', 'v1.5.0', 'v1.4.0');
+    await pm.profilesPage.hoverFrame(fullWidthFrame(0), 'v1.5.0: 8 s', { scope: pm.profilesPage.compareSideBaseline });
+  });
+
+  test("Each side's list leaves out the other side's value", { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    await expect.poll(() => pm.profilesPage.compareBaselineOptions(), { timeout: 15000 }).toEqual(['v1.4.0']);
+  });
+
+  test('Changing the label picks that label\'s defaults', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.pickCompareLabel('deployment_environment');
+    await pm.profilesPage.expectCompareSides('deployment_environment', 'prod', 'stage');
+  });
+
+  test('A label with one value in range explains why there is no diff', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare', filters: 'service_version=v1.4.0' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.pickCompareLabel('host_name');
+    await pm.profilesPage.expectCompareMessage('This label has fewer than two values in the time range.');
+  });
+
+  test('One side with no data says so', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.patchApiResponse('diff', () => ({ comparison_total: 0 }));
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.expectCompareMessage('One side has no data. Pick other values or a wider time range.');
+  });
+
+  test('A filter on the compare label pre-selects that value as B', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare', filters: 'service_version=v1.4.0' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.expectCompareSides('service_version', 'v1.5.0', 'v1.4.0');
+  });
+
+  test('Search filters the Diff Table', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'compare', extra: { compare_display: 'table' } });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.search('json');
+    await pm.profilesPage.expectCompareTableRowNames(['json_encode']);
+  });
+
+  test('A diff error is shown in place of the graph', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.mockApi('diff', { status: 400, json: { code: 400, message: 'boom' } });
+    await pm.profilesPage.gotoRef(ref, { view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.expectCompareMessage('boom');
+  });
+
+  test('A stream with no labels has nothing to compare by', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.gotoRef(bare, { service: 'bare-svc', view: 'compare' });
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.expectCompareMessage('No label to compare by.');
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/Profiles/profiles-flame-graph.spec.js b/tests/ui-testing/playwright-tests/Profiles/profiles-flame-graph.spec.js
new file mode 100644
index 0000000000..30fe4cf7f8
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Profiles/profiles-flame-graph.spec.js
@@ -0,0 +1,245 @@
+// Continuous Profiling flame graph: zoom, frame menu, hint, layout options, grouped frames.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const { CHECKOUT_FRAMES: F, CATALOG_FRAMES: C, fullWidthFrame: FULL_WIDTH } = require('../../pages/profilesPages/profilesPage.js');
+const { seedReferenceStream, deleteProfilesStream } = require('../utils/profiles-ingestion.js');
+
+test.describe('Profiles flame graph', () => {
+  test.describe.configure({ mode: 'parallel' });
+  let api;
+  let ref;
+  let pm;
+
+  test.beforeAll(async ({ playwright }) => {
+    api = await playwright.request.newContext();
+    ref = await seedReferenceStream(api, 'flame');
+  });
+
+  test.afterAll(async () => {
+    await deleteProfilesStream(api, ref.stream);
+    await api.dispose();
+  });
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    pm = new PageManager(page);
+    await pm.profilesPage.mockServerConfig();
+    await navigateToBase(page);
+  });
+
+  test.afterEach(async ({}, testInfo) => {
+    await pm.profilesPage.teardown();
+    testLogger.testEnd(testInfo.title, testInfo.status);
+  });
+
+  test.describe('frames', () => {
+    test.beforeEach(async () => {
+      await pm.profilesPage.hideFlameZoomHint();
+    });
+
+    test('Flame graph renders with the root total', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.expectFlameViewOptions();
+      await pm.profilesPage.expectFlameRootSummary('Total: 12 s (CPU duration)');
+      await pm.profilesPage.hoverFrame(F.db_query, 'db_query');
+      await pm.profilesPage.expectFlameTooltipContains('db_query', ['6 s', '50.00%', 'Share of caller', '50.63%']);
+    });
+
+    test('Left-click zooms into a frame and writes focus to the URL without history', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      const before = await pm.profilesPage.historyLength();
+      await pm.profilesPage.clickFrame(F.db_query, 'db_query');
+      await pm.profilesPage.expectUrlParam('focus', F.db_query.path);
+      expect(await pm.profilesPage.historyLength()).toBe(before);
+      await pm.profilesPage.hoverFrame(FULL_WIDTH(3), 'db_query');
+    });
+
+    test('Clicking a dimmed caller zooms out to it and the root resets', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.clickFrame(F.db_query, 'db_query');
+      await pm.profilesPage.expectUrlParam('focus', F.db_query.path);
+      await pm.profilesPage.clickFrame(FULL_WIDTH(2), 'handle_order');
+      await pm.profilesPage.expectUrlParam('focus', F.handle_order.path);
+      await pm.profilesPage.clickFrame(FULL_WIDTH(0), 'Click to zoom out');
+      await pm.profilesPage.expectUrlParamAbsent('focus');
+      await pm.profilesPage.hoverFrame(F.json_encode, 'json_encode');
+    });
+
+    test('A re-run clears a stale flame focus', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.clickFrame(F.handle_order, 'handle_order');
+      await pm.profilesPage.expectUrlParam('focus', F.handle_order.path);
+      await pm.profilesPage.addFilter('deployment_environment', 'stage');
+      await pm.profilesPage.clickRun();
+      await pm.profilesPage.expectUrlParam('filters', 'deployment_environment=stage');
+      await pm.profilesPage.expectUrlParamAbsent('focus');
+      await pm.profilesPage.expectFlameRootSummary('Total: 150 ms (CPU duration)');
+      await pm.profilesPage.hoverFrame({ depth: 1, left: 0, width: 100 }, 'runtime_main');
+      await pm.profilesPage.hoverFrame({ depth: 2, left: 0, width: 100 }, 'gc_sweep');
+      await pm.profilesPage.hoverFrame(FULL_WIDTH(0), 'Total: 150 ms');
+      await pm.profilesPage.expectFlameTooltipLacks('Total: 150 ms', 'Click to zoom out');
+    });
+
+    test('A focus seeded in the URL survives the first run', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame', extra: { focus: F.handle_order.path } });
+      await pm.profilesPage.expectUrlParam('focus', F.handle_order.path);
+      await pm.profilesPage.hoverFrame(FULL_WIDTH(2), 'handle_order');
+      await pm.profilesPage.hoverFrame(FULL_WIDTH(0), 'Click to zoom out');
+      await pm.profilesPage.hoverFrame({ depth: 3, left: 0, width: 50.633 }, 'db_query');
+    });
+
+    test('Right-click opens the frame menu with the frame actions', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.rightClickFrame(F.json_encode, 'json_encode');
+      await pm.profilesPage.expectFlameMenu(
+        ['copy-name', 'zoom-in', 'search-function', 'sandwich', 'details'],
+        ['zoom-reset', 'zoom-out', 'zoom-out-here'],
+      );
+    });
+
+    test('Frame menu on the zoomed frame and on a caller offers zoom out', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.clickFrame(F.db_query, 'db_query');
+      await pm.profilesPage.expectUrlParam('focus', F.db_query.path);
+      await pm.profilesPage.rightClickFrame(FULL_WIDTH(3), 'db_query');
+      await pm.profilesPage.expectFlameMenu(['zoom-out', 'zoom-reset'], ['zoom-in', 'zoom-out-here']);
+      await pm.profilesPage.pressEscape();
+      await pm.profilesPage.expectFlameMenuHidden();
+      await pm.profilesPage.rightClickFrame(FULL_WIDTH(2), 'handle_order');
+      await pm.profilesPage.expectFlameMenu(['zoom-out-here', 'zoom-reset'], ['zoom-in', 'zoom-out']);
+      await pm.profilesPage.clickFlameMenuItem('zoom-out-here');
+      await pm.profilesPage.expectUrlParam('focus', F.handle_order.path);
+      await pm.profilesPage.rightClickFrame(FULL_WIDTH(2), 'handle_order');
+      await pm.profilesPage.clickFlameMenuItem('zoom-reset');
+      await pm.profilesPage.expectUrlParamAbsent('focus');
+    });
+
+    test('Frame menu actions copy, highlight, open details and open sandwich', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.rightClickFrame(F.json_encode, 'json_encode');
+      await pm.profilesPage.clickFlameMenuItem('copy-name');
+      await pm.profilesPage.expectCopiedToast();
+      expect(await pm.profilesPage.readClipboard()).toBe('json_encode');
+      await pm.profilesPage.rightClickFrame(F.json_encode, 'json_encode');
+      await pm.profilesPage.clickFlameMenuItem('search-function');
+      await pm.profilesPage.expectSearchValue('json_encode');
+      await pm.profilesPage.expectUrlParam('search', 'json_encode');
+      await pm.profilesPage.rightClickFrame(F.json_encode, 'json_encode');
+      await pm.profilesPage.clickFlameMenuItem('details');
+      await pm.profilesPage.expectDetails({ name: 'json_encode', self: '4 s · 33.33%', total: '4 s · 33.33%' });
+      await pm.profilesPage.rightClickFrame(F.db_query, 'db_query');
+      await pm.profilesPage.clickFlameMenuItem('sandwich');
+      await pm.profilesPage.expectViewActive('sandwich');
+      await pm.profilesPage.expectSandwichFunction('db_query');
+      await pm.profilesPage.expectUrlParam('fn', 'db_query');
+    });
+
+    test('The ⋮ button on a hovered frame opens its menu and Escape closes it', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.hoverFrame(F.db_query, 'db_query');
+      await pm.profilesPage.expectFrameMoreVisible();
+      await pm.profilesPage.clickFrameMore();
+      await pm.profilesPage.expectFlameMenu(['copy-name', 'zoom-in']);
+      await pm.profilesPage.pressEscape();
+      await pm.profilesPage.expectFlameMenuHidden();
+    });
+
+    test('Ctrl + wheel zooms the view and a drag pans it', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.expectFlameGrabCursor(false);
+      const initial = await pm.profilesPage.flameCanvasPng();
+      const point = await pm.profilesPage.ctrlWheelOnFrame(F.db_query, 'db_query', -600);
+      await pm.profilesPage.expectFlameGrabCursor(true);
+      const zoomed = await pm.profilesPage.flameCanvasPng();
+      expect(zoomed.equals(initial)).toBe(false);
+      await pm.profilesPage.dragOnFlame(point, 200);
+      const panned = await pm.profilesPage.flameCanvasPng();
+      expect(panned.equals(zoomed)).toBe(false);
+      await pm.profilesPage.expectNotZoomedVia(FULL_WIDTH(0), 'Total: 12 s');
+      await pm.profilesPage.expectUrlParamAbsent('focus');
+    });
+
+    test('Root at bottom flips the drawing and label alignment switches', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.expectRootAtBottom(false);
+      await pm.profilesPage.expectAlignActive('left');
+      await pm.profilesPage.toggleRootAtBottom();
+      await pm.profilesPage.expectRootAtBottom(true);
+      await pm.profilesPage.hoverFrame(FULL_WIDTH(0), 'Total: 12 s', { rootAtBottom: true, maxDepth: 3 });
+      await pm.profilesPage.hoverFrame(F.db_query, 'db_query', { rootAtBottom: true, maxDepth: 3 });
+      await pm.profilesPage.clickAlign('right');
+      await pm.profilesPage.expectAlignActive('right');
+    });
+
+    test('Grouped frames ignore clicks and have no menu', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { service: 'catalog', view: 'flame' });
+      await pm.profilesPage.expectFlameRootSummary('Total: 5.52 s (CPU duration)');
+      await pm.profilesPage.hoverFrame(C.truncated, '[truncated]');
+      await pm.profilesPage.expectFlameTooltipContains('[truncated]', ['Callers beyond 1000 frames, cut from this stack.']);
+      await pm.profilesPage.clickFrame(C.truncated, '[truncated]');
+      await pm.profilesPage.expectNotZoomedVia(C.catalog_main, 'catalog_main');
+      await pm.profilesPage.rightClickFrame(C.truncated, '[truncated]');
+      await pm.profilesPage.expectNoFrameMenuVia(C.catalog_main, 'catalog_main');
+      await pm.profilesPage.hoverFrame(C.smallFrames, '55 small frames');
+      await pm.profilesPage.expectFlameTooltipContains('55 small frames', ['Too thin to draw one by one.']);
+      await pm.profilesPage.clickFrame(C.smallFrames, '55 small frames');
+      await pm.profilesPage.expectNotZoomedVia(C.catalog_main, 'catalog_main');
+      await pm.profilesPage.expectUrlParamAbsent('focus');
+      await pm.profilesPage.hoverFrame(FULL_WIDTH(0), 'Total: 5.52 s');
+      await pm.profilesPage.expectFlameTooltipLacks('Total: 5.52 s', 'Click to zoom out');
+    });
+
+    test('Flame graph resizes with the Function details panel', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      const wide = await pm.profilesPage.flamePlotWidth();
+      await expect.poll(() => pm.profilesPage.flameCanvasWidth()).toBeGreaterThan(wide - 4);
+      await pm.profilesPage.rightClickFrame(F.db_query, 'db_query');
+      await pm.profilesPage.clickFlameMenuItem('details');
+      await pm.profilesPage.expectDetails({ name: 'db_query' });
+      await expect.poll(() => pm.profilesPage.flamePlotWidth()).toBeLessThan(wide - 200);
+      const narrow = await pm.profilesPage.flamePlotWidth();
+      await expect.poll(() => pm.profilesPage.flameCanvasWidth()).toBeLessThan(narrow + 4);
+      await pm.profilesPage.clickDetails('close');
+      await expect.poll(() => pm.profilesPage.flamePlotWidth()).toBeGreaterThan(wide - 4);
+      await expect.poll(() => pm.profilesPage.flameCanvasWidth()).toBeGreaterThan(wide - 4);
+      await pm.profilesPage.hoverFrame(F.json_encode, 'json_encode');
+    });
+
+    test('Search highlights only the matching frame', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.hoverFrame(F.runtime_main, 'runtime_main');
+      const jsonPlain = await pm.profilesPage.frameLabelPng(F.json_encode);
+      const dbPlain = await pm.profilesPage.frameLabelPng(F.db_query);
+      await pm.profilesPage.search('json');
+      await pm.profilesPage.expectSearchSummary('1 function · 33.33% of samples');
+      await expect.poll(async () => (await pm.profilesPage.frameLabelPng(F.json_encode)).equals(jsonPlain)).toBe(false);
+      expect((await pm.profilesPage.frameLabelPng(F.db_query)).equals(dbPlain)).toBe(true);
+    });
+  });
+
+  test.describe('zoom hint', () => {
+    test("Don't show again hides the hint for good", { tag: ['@all', '@profiles', '@P2'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.expectZoomHint(true);
+      await pm.profilesPage.expectZoomHintText(/Use (⌘|Ctrl) \+ scroll to zoom/);
+      await pm.profilesPage.clickZoomHint('never');
+      await pm.profilesPage.expectZoomHint(false);
+      expect(await pm.profilesPage.zoomHintStorageValue()).toBe('1');
+      await pm.profilesPage.reload();
+      await pm.profilesPage.hoverFrame(F.db_query, 'db_query');
+      await pm.profilesPage.expectZoomHint(false);
+    });
+
+    test('Closing the hint hides it for this graph only', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+      await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+      await pm.profilesPage.expectZoomHint(true);
+      await pm.profilesPage.clickZoomHint('close');
+      await pm.profilesPage.expectZoomHint(false);
+      expect(await pm.profilesPage.zoomHintStorageValue()).toBeNull();
+      await pm.profilesPage.reload();
+      await pm.profilesPage.expectZoomHint(true);
+    });
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/Profiles/profiles-navigation-entry.spec.js b/tests/ui-testing/playwright-tests/Profiles/profiles-navigation-entry.spec.js
new file mode 100644
index 0000000000..85438f30f7
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Profiles/profiles-navigation-entry.spec.js
@@ -0,0 +1,159 @@
+// Continuous Profiling entry points: left menu, feature flag, Data page, Data Sources, no-stream CTA, Trace span link.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const {
+  seedReferenceStream,
+  deleteProfilesStream,
+  ingestTraceSpans,
+  deleteTracesStream,
+  randomHex,
+  MINUTE_MS,
+} = require('../utils/profiles-ingestion.js');
+
+test.describe('Profiles navigation and entry points', () => {
+  test.describe.configure({ mode: 'parallel' });
+  let api;
+  let ref;
+  let trace;
+  let pm;
+
+  test.beforeAll(async ({ playwright }) => {
+    api = await playwright.request.newContext();
+    ref = await seedReferenceStream(api, 'nav');
+    const startMs = ref.t0Ms + 4 * MINUTE_MS - 500;
+    trace = {
+      stream: `e2e_prof_trace_${randomHex(4)}`,
+      startMs,
+      traceId: ref.link.traceId,
+      linkedSpanId: ref.link.spanId,
+      unlinkedSpanId: randomHex(8),
+    };
+    await ingestTraceSpans(api, trace.stream, {
+      traceId: trace.traceId,
+      spanIds: [trace.linkedSpanId, trace.unlinkedSpanId],
+      startMs,
+    });
+  });
+
+  test.afterAll(async () => {
+    await deleteProfilesStream(api, ref.stream);
+    await deleteTracesStream(api, trace.stream);
+    await api.dispose();
+  });
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    pm = new PageManager(page);
+    await pm.profilesPage.hideFlameZoomHint();
+  });
+
+  test.afterEach(async ({}, testInfo) => {
+    await pm.profilesPage.teardown();
+    testLogger.testEnd(testInfo.title, testInfo.status);
+  });
+
+  test('The left menu opens Profiles with its Beta tag', { tag: ['@all', '@profiles', '@P0'] }, async ({ page }) => {
+    await navigateToBase(page);
+    await pm.profilesPage.clickMenuProfiles();
+    expect(new URL(page.url()).pathname).toBe('/web/profiles');
+    await pm.profilesPage.expectPageHeader();
+  });
+
+  test('Profiles sits right after Traces in the menu', { tag: ['@all', '@profiles', '@P2'] }, async ({ page }) => {
+    await navigateToBase(page);
+    await pm.profilesPage.expectMenuProfilesVisible(true);
+    const order = await pm.profilesPage.visibleMenuOrder();
+    testLogger.info('Menu order', { order });
+    expect(order.indexOf('menu-link-/profiles-item')).toBe(order.indexOf('menu-link-/traces-item') + 1);
+  });
+
+  test('With profiling off the menu hides Profiles and the route goes home', { tag: ['@all', '@profiles', '@P1'] }, async ({ page }) => {
+    await pm.profilesPage.mockServerConfig({ profiling: false });
+    await navigateToBase(page);
+    await pm.profilesPage.expectMenuProfilesVisible(false);
+    await pm.profilesPage.routerPush({ name: 'profiles', query: { org_identifier: pm.profilesPage.orgName() } });
+    await expect.poll(() => new URL(page.url()).pathname).toBe('/web/');
+    expect(pm.profilesPage.currentQuery().org_identifier).toBe(pm.profilesPage.orgName());
+  });
+
+  test('The Data page Profiles filter lists the stream', { tag: ['@all', '@profiles', '@P1'] }, async ({ page }) => {
+    await navigateToBase(page);
+    await pm.profilesPage.gotoDataPageProfiles(ref.stream);
+  });
+
+  test('The Data page explore button opens Logs search on the profiles stream', { tag: ['@all', '@profiles', '@P1'] }, async ({ page }) => {
+    await navigateToBase(page);
+    await pm.profilesPage.gotoDataPageProfiles(ref.stream);
+    await pm.profilesPage.clickDataPageExplore(ref.stream);
+    await expect.poll(() => new URL(page.url()).pathname).toBe('/web/logs');
+    const query = pm.profilesPage.currentQuery();
+    expect(query.stream_type).toBe('profiles');
+    expect(query.stream).toBe(ref.stream);
+    expect(query.type).toBe('stream_explorer');
+    await pm.profilesPage.expectLogsExplorerRows();
+  });
+
+  test('Data Sources shows the profiles collector snippets', { tag: ['@all', '@profiles', '@P2'] }, async ({ page }) => {
+    await navigateToBase(page);
+    await pm.profilesPage.gotoProfilesIngestion();
+    await pm.profilesPage.expectIngestionProfilesTabsActive();
+    const otel = await pm.profilesPage.ingestionSnippetText('otel');
+    expect(otel).toContain(`/api/${pm.profilesPage.orgName()}/v1/profiles`);
+    expect(otel).toContain('stream-name');
+    expect(await pm.profilesPage.ingestionSnippetText('start')).toMatch(/otelcol/);
+    expect(await pm.profilesPage.ingestionSnippetText('grpc')).toContain('stream-name');
+  });
+
+  test('With no profile streams the empty state links to ingestion setup', { tag: ['@all', '@profiles', '@P2'] }, async ({ page }) => {
+    await pm.profilesPage.mockStreamList([]);
+    await navigateToBase(page);
+    await pm.profilesPage.gotoProfiles();
+    await pm.profilesPage.expectState('noStream', { title: 'No profile streams available' });
+    await pm.profilesPage.clickStateAction('noStream');
+    await expect.poll(() => new URL(page.url()).pathname).toMatch(/^\/web\/ingestion\/custom\/profiles/);
+  });
+
+  test('A linked trace span opens its profile', { tag: ['@all', '@profiles', '@P1'] }, async ({ page }) => {
+    await pm.profilesPage.mockStreamList([ref.stream]);
+    await navigateToBase(page);
+    await pm.profilesPage.gotoTraceDetails({
+      traceId: trace.traceId,
+      stream: trace.stream,
+      fromUs: (trace.startMs - 5 * MINUTE_MS) * 1000,
+      toUs: (trace.startMs + 5 * MINUTE_MS) * 1000,
+    });
+    await pm.profilesPage.clickTraceSpanAndAwaitProbe(ref.stream, trace.linkedSpanId);
+    await pm.profilesPage.expectViewProfileButton(true);
+    await pm.profilesPage.clickViewProfile();
+    const query = pm.profilesPage.currentQuery();
+    expect(query.stream).toBe(ref.stream);
+    expect(query.view).toBe('flame');
+    expect(query.service_name).toBe('checkout');
+    expect(query.profile_type).toBe('cpu');
+    expect(Math.abs(Number(query.from) - (trace.startMs * 1000 - 60_000_000))).toBeLessThan(1_000_000);
+    expect(Math.abs(Number(query.to) - ((trace.startMs + 1000) * 1000 + 60_000_000))).toBeLessThan(1_000_000);
+    await pm.profilesPage.expectFilterChip('trace_id', trace.traceId);
+    await pm.profilesPage.expectFilterChip('span_id', trace.linkedSpanId);
+    await pm.profilesPage.expectFlameRootSummary('Total: 250 ms (CPU duration)');
+  });
+
+  test('A span without a linked profile has no View Profile', { tag: ['@all', '@profiles', '@P2'] }, async ({ page }) => {
+    await pm.profilesPage.mockStreamList([ref.stream]);
+    await navigateToBase(page);
+    await pm.profilesPage.gotoTraceDetails({
+      traceId: trace.traceId,
+      stream: trace.stream,
+      fromUs: (trace.startMs - 5 * MINUTE_MS) * 1000,
+      toUs: (trace.startMs + 5 * MINUTE_MS) * 1000,
+    });
+    await pm.profilesPage.clickTraceSpanAndAwaitProbe(ref.stream, trace.unlinkedSpanId);
+    await pm.profilesPage.clickTraceSpanAndAwaitProbe(ref.stream, trace.linkedSpanId);
+    await pm.profilesPage.expectViewProfileButton(true);
+    // The unlinked span's probe finished before the linked one started, so its cached miss now renders synchronously.
+    await pm.profilesPage.openTraceSpan(trace.unlinkedSpanId);
+    await pm.profilesPage.expectTraceSidebarSpan(trace.unlinkedSpanId);
+    await pm.profilesPage.expectViewProfileButton(false);
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/Profiles/profiles-query-controls.spec.js b/tests/ui-testing/playwright-tests/Profiles/profiles-query-controls.spec.js
new file mode 100644
index 0000000000..b36fd8e112
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Profiles/profiles-query-controls.spec.js
@@ -0,0 +1,343 @@
+// Continuous Profiling header and query controls: run rules, Auto Run, cancel, label filters, date, URL and Share.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const { CHECKOUT_FRAMES: F } = require('../../pages/profilesPages/profilesPage.js');
+const {
+  seedReferenceStream,
+  seedProfilesStream,
+  noLabelResources,
+  deleteProfilesStream,
+  MINUTE_MS,
+} = require('../utils/profiles-ingestion.js');
+
+test.describe('Profiles query controls', () => {
+  test.describe.configure({ mode: 'parallel' });
+  let api;
+  let ref;
+  let bare;
+  let pm;
+
+  test.beforeAll(async ({ playwright }) => {
+    api = await playwright.request.newContext();
+    ref = await seedReferenceStream(api, 'query');
+    bare = await seedProfilesStream(api, 'querybare', noLabelResources, { service: 'bare-svc', total: 1_000_000_000 });
+  });
+
+  test.afterAll(async () => {
+    await deleteProfilesStream(api, ref.stream);
+    await deleteProfilesStream(api, bare.stream);
+    await api.dispose();
+  });
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    pm = new PageManager(page);
+    await pm.profilesPage.mockServerConfig();
+    await pm.profilesPage.hideFlameZoomHint();
+    await navigateToBase(page);
+  });
+
+  test.afterEach(async ({}, testInfo) => {
+    await pm.profilesPage.teardown();
+    testLogger.testEnd(testInfo.title, testInfo.status);
+  });
+
+  test('A seeded page load runs the query exactly once', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+    expect(calls.series).toHaveLength(1);
+    expect(calls.merge).toHaveLength(1);
+    expect(calls.merge[0].body).toMatchObject({
+      start_time: ref.window.from,
+      end_time: ref.window.to,
+      service_name: 'checkout',
+      profile_type: 'cpu',
+      profile_unit: 'nanoseconds',
+      filters: [],
+      max_nodes: 4096,
+    });
+  });
+
+  test('Selectors show the seeded stream, service and type', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectSelected(pm.profilesPage.streamSelect, ref.stream);
+    await pm.profilesPage.expectSelected(pm.profilesPage.serviceSelect, 'checkout');
+    await pm.profilesPage.expectSelected(pm.profilesPage.typeSelect, 'cpu (cores)');
+  });
+
+  test('An unseeded open picks the first stream, CPU and Past 15 minutes and writes the URL', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.mockStreamList([ref.stream, bare.stream].sort());
+    await pm.profilesPage.gotoProfiles();
+    const first = [ref.stream, bare.stream].sort()[0];
+    await pm.profilesPage.expectUrlParam('stream', first);
+    await pm.profilesPage.expectUrlParam('period', '15m');
+    await pm.profilesPage.expectUrlParam('profile_type', 'cpu');
+    await pm.profilesPage.expectUrlParam('view', 'top');
+    await pm.profilesPage.expectSelected(pm.profilesPage.streamSelect, first);
+  });
+
+  test('The type list is scoped to the chosen service', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    expect(await pm.profilesPage.selectOptionLabels(pm.profilesPage.typeSelect)).toEqual(['cpu (cores)']);
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.selectService('payments');
+    await expect.poll(() => calls.meta.filter((call) => call.url.includes('service_name=payments')).length).toBeGreaterThan(0);
+    await expect
+      .poll(() => pm.profilesPage.selectOptionLabels(pm.profilesPage.typeSelect), { timeout: 15000 })
+      .toEqual(['alloc_space (bytes)', 'cpu (cores)', 'inuse_space (bytes)']);
+  });
+
+  test('With Auto Run off a change marks Run as pending without querying', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.selectService('payments');
+    await pm.profilesPage.expectRunPending(true);
+    expect(calls.series).toHaveLength(0);
+    expect(calls.merge).toHaveLength(0);
+    expect(pm.profilesPage.currentQuery().service_name).toBe('checkout');
+  });
+
+  test('Run clears the pending state and writes the new inputs to the URL', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.selectService('payments');
+    await pm.profilesPage.expectRunPending(true);
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectRunPending(false);
+    expect(calls.series).toHaveLength(1);
+    expect(calls.merge).toHaveLength(1);
+    await pm.profilesPage.expectUrlParam('service_name', 'payments');
+    await pm.profilesPage.expectTopRow(0, { name: 'charge_card', self: '2.7 s' });
+  });
+
+  test('Run is disabled when the window has no profile type', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.mockApi('meta', {
+      json: { data_sources: [], services: ['checkout'], profile_types: [], label_names: [], took: 1 },
+    });
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectRunDisabled();
+    await pm.profilesPage.hoverRunAndExpectTooltip('Pick a stream and a profile type with data in this time range');
+  });
+
+  test('With Auto Run on a change runs at once, and the switch turns it off', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.mockServerConfig({ autoQuery: true });
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.openRunOptions();
+    await pm.profilesPage.expectAutoRunToggleText('Turn off Auto Run');
+    await pm.profilesPage.pressEscape();
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.selectService('payments');
+    await expect.poll(() => calls.merge.filter((call) => call.body.service_name === 'payments').length).toBe(1);
+    await pm.profilesPage.waitForRunIdle();
+    expect(calls.series.filter((call) => call.body.service_name === 'payments')).toHaveLength(1);
+    await pm.profilesPage.expectRunPending(false);
+    await pm.profilesPage.expectUrlParam('service_name', 'payments');
+    await pm.profilesPage.openRunOptions();
+    await pm.profilesPage.clickAutoRunToggle();
+    expect(await pm.profilesPage.autoRunStorageValue()).toBe('false');
+    await pm.profilesPage.openRunOptions();
+    await pm.profilesPage.expectAutoRunToggleText('Turn on Auto Run');
+    await pm.profilesPage.pressEscape();
+    const offCalls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.selectService('checkout');
+    await pm.profilesPage.expectRunPending(true);
+    expect(offCalls.merge).toHaveLength(0);
+  });
+
+  test('Run options are hidden when the server has Auto Run off', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectRunOptionsHidden();
+  });
+
+  test('Cancelling the first query shows Search cancelled and its Run query recovers', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    const release = await pm.profilesPage.holdApi('merge');
+    await pm.profilesPage.openSeededNoWait({ stream: ref.stream, ...ref.window, service: 'checkout' });
+    await pm.profilesPage.clickCancel();
+    await pm.profilesPage.expectState('cancelled', { title: 'Search cancelled' });
+    await pm.profilesPage.expectRunPending(true);
+    release();
+    await pm.profilesPage.clickStateAction('cancelled');
+    await pm.profilesPage.waitForRunIdle();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+    await pm.profilesPage.expectStateHidden('cancelled');
+  });
+
+  test('Cancelling a re-run keeps the results on screen', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.selectService('payments');
+    const release = await pm.profilesPage.holdApi('merge');
+    await pm.profilesPage.clickRunNoWait();
+    await pm.profilesPage.clickCancel();
+    release();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+    await pm.profilesPage.expectRunPending(true);
+    expect(pm.profilesPage.currentQuery().service_name).toBe('checkout');
+  });
+
+  test('Picking a filter value applies it and Run narrows the result', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.addFilter('service_version', 'v1.5.0');
+    await pm.profilesPage.expectFilterChip('service_version', 'v1.5.0');
+    await pm.profilesPage.expectRunPending(true);
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '4 s', selfPercent: '50.00%' });
+    await pm.profilesPage.expectUrlParam('filters', 'service_version=v1.5.0');
+  });
+
+  test('A second value of the same label replaces the first', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { filters: 'service_version=v1.5.0' });
+    await pm.profilesPage.addFilter('service_version', 'v1.4.0');
+    await pm.profilesPage.expectFilterChipCount(1);
+    await pm.profilesPage.expectFilterChip('service_version', 'v1.4.0');
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.clickRun();
+    expect(calls.merge[0].body.filters).toEqual([{ key: 'service_version', op: '=', value: 'v1.4.0' }]);
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '2 s', selfPercent: '50.00%' });
+  });
+
+  test('A second label ANDs and its value list is narrowed by the first', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { filters: 'service_version=v1.4.0' });
+    expect(await pm.profilesPage.filterValueOptionLabels('deployment_environment')).toEqual(['prod']);
+    await pm.profilesPage.addFilter('deployment_environment', 'prod');
+    await pm.profilesPage.expectFilterChipCount(2);
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '2 s', selfPercent: '50.00%' });
+  });
+
+  test('Editing a chip changes its value', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { filters: 'service_version=v1.4.0,deployment_environment=prod' });
+    await pm.profilesPage.editFilter('service_version', 'v1.5.0');
+    await pm.profilesPage.expectFilterChip('service_version', 'v1.5.0');
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '4 s', selfPercent: '50.96%' });
+  });
+
+  test('Removing every chip restores the unfiltered result', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { filters: 'service_version=v1.4.0,deployment_environment=prod' });
+    await pm.profilesPage.removeFilter('service_version');
+    await pm.profilesPage.removeFilter('deployment_environment');
+    await pm.profilesPage.expectFilterChipCount(0);
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s', selfPercent: '50.00%' });
+    await pm.profilesPage.expectUrlParamAbsent('filters');
+  });
+
+  test('The value select stays disabled until a label is picked', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectValueSelectDisabled();
+  });
+
+  test('Changing stream clears the filters and the service', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.mockStreamList([ref.stream, bare.stream].sort());
+    await pm.profilesPage.gotoRef(ref, { filters: 'service_version=v1.4.0' });
+    await pm.profilesPage.expectFilterChipCount(1);
+    await pm.profilesPage.selectStream(bare.stream);
+    await pm.profilesPage.expectFilterChipCount(0);
+    await pm.profilesPage.expectSelected(pm.profilesPage.serviceSelect, 'bare-svc');
+    await pm.profilesPage.expectRunPending(true);
+  });
+
+  test('Shifting the date reloads meta and marks Run as pending', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.clickDatePrev();
+    await expect.poll(() => calls.meta.length).toBeGreaterThan(0);
+    await pm.profilesPage.expectRunPending(true);
+    expect(calls.merge).toHaveLength(0);
+    expect(pm.profilesPage.currentQuery().from).toBe(String(ref.window.from));
+  });
+
+  test('An empty window keeps the chosen service', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    const span = ref.window.to - ref.window.from;
+    await pm.profilesPage.gotoSeeded({ stream: ref.stream, from: ref.window.from - span, to: ref.window.to - span, service: 'checkout' });
+    await pm.profilesPage.expectState('noResults', { title: 'No profiles found' });
+    await pm.profilesPage.expectSelected(pm.profilesPage.serviceSelect, 'checkout');
+    await pm.profilesPage.clickDateNext();
+    await pm.profilesPage.expectRunPending(true);
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectSelected(pm.profilesPage.serviceSelect, 'checkout');
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+    await pm.profilesPage.expectUrlParam('from', String(ref.window.from));
+  });
+
+  test('The URL restores the view, search and filters on reload with one run', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.addFilter('service_version', 'v1.5.0');
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.switchView('tree');
+    await pm.profilesPage.search('json');
+    await pm.profilesPage.expectUrlParam('search', 'json');
+    await pm.profilesPage.expectUrlParam('view', 'tree');
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.reload();
+    await pm.profilesPage.expectViewActive('tree');
+    await pm.profilesPage.expectSearchValue('json');
+    await pm.profilesPage.expectFilterChip('service_version', 'v1.5.0');
+    await pm.profilesPage.expectSelected(pm.profilesPage.serviceSelect, 'checkout');
+    await pm.profilesPage.expectSelected(pm.profilesPage.typeSelect, 'cpu (cores)');
+    expect(calls.merge).toHaveLength(1);
+    expect(calls.series).toHaveLength(1);
+  });
+
+  test('View, search and focus changes replace the URL without adding history', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    const before = await pm.profilesPage.historyLength();
+    await pm.profilesPage.switchView('flame');
+    await pm.profilesPage.search('json');
+    await pm.profilesPage.expectUrlParam('search', 'json');
+    await pm.profilesPage.search('');
+    await pm.profilesPage.clickFrame(F.db_query, 'db_query');
+    await pm.profilesPage.expectUrlParam('focus', F.db_query.path);
+    expect(await pm.profilesPage.historyLength()).toBe(before);
+  });
+
+  test('Garbage URL seeds fall back without breaking the page', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'bogus' });
+    await pm.profilesPage.expectViewActive('top');
+    await pm.profilesPage.expectUrlParam('view', 'top');
+    await pm.profilesPage.gotoSeeded({ stream: ref.stream, from: ref.window.to, to: ref.window.from, service: 'checkout' });
+    await pm.profilesPage.expectUrlParam('period', '15m');
+    await pm.profilesPage.expectDateButtonText('Past 15 Minutes');
+    await pm.profilesPage.mockStreamList([ref.stream]);
+    await pm.profilesPage.gotoSeeded({ stream: 'e2e_prof_nope', ...ref.window, service: 'checkout' });
+    await pm.profilesPage.expectSelected(pm.profilesPage.streamSelect, ref.stream);
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+  });
+
+  test('Share is disabled when there is no data', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoSeeded({
+      stream: ref.stream,
+      from: ref.window.from - 180 * MINUTE_MS * 1000,
+      to: ref.window.from - 120 * MINUTE_MS * 1000,
+      service: 'checkout',
+    });
+    await pm.profilesPage.expectState('noResults');
+    await pm.profilesPage.expectShareDisabled(true);
+  });
+
+  test('Share copies a short link that restores the run with an absolute window', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoSeeded({
+      stream: ref.stream,
+      period: '15m',
+      service: 'checkout',
+      view: 'tree',
+      filters: 'service_version=v1.5.0',
+    });
+    await pm.profilesPage.expectShareDisabled(false);
+    const link = await pm.profilesPage.clickShareAndReadClipboard();
+    expect(link).toMatch(/\/web\/short\/[0-9a-f]+\?org_identifier=/);
+    await pm.profilesPage.gotoUrl(link);
+    await pm.profilesPage.expectUrlParam('stream', ref.stream);
+    await pm.profilesPage.expectUrlParam('service_name', 'checkout');
+    await pm.profilesPage.expectUrlParam('filters', 'service_version=v1.5.0');
+    await pm.profilesPage.expectUrlParam('view', 'tree');
+    const query = pm.profilesPage.currentQuery();
+    expect(query.period).toBeUndefined();
+    expect(Number(query.to) - Number(query.from)).toBe(15 * MINUTE_MS * 1000);
+    await pm.profilesPage.expectFilterChip('service_version', 'v1.5.0');
+    await pm.profilesPage.expectViewActive('tree');
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/Profiles/profiles-states-edge.spec.js b/tests/ui-testing/playwright-tests/Profiles/profiles-states-edge.spec.js
new file mode 100644
index 0000000000..864d0c30a3
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Profiles/profiles-states-edge.spec.js
@@ -0,0 +1,177 @@
+// Continuous Profiling page states (no results, errors, partial, loading), deep stacks, theme, mobile and edge data.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const { CHECKOUT_FRAMES: F, CATALOG_FRAMES: C } = require('../../pages/profilesPages/profilesPage.js');
+const {
+  seedReferenceStream,
+  seedProfilesStream,
+  zeroValueResources,
+  unknownServiceResources,
+  deleteProfilesStream,
+  MINUTE_MS,
+} = require('../utils/profiles-ingestion.js');
+
+test.describe('Profiles states and edges', () => {
+  test.describe.configure({ mode: 'parallel' });
+  let api;
+  let ref;
+  let zero;
+  let unknown;
+  let pm;
+
+  test.beforeAll(async ({ playwright }) => {
+    api = await playwright.request.newContext();
+    ref = await seedReferenceStream(api, 'states');
+    zero = await seedProfilesStream(api, 'stzero', zeroValueResources, { service: 'zero-svc' });
+    unknown = await seedProfilesStream(api, 'stunknown', unknownServiceResources, {
+      service: 'unknown_service:mybin',
+      total: 1_000_000_000,
+    });
+  });
+
+  test.afterAll(async () => {
+    await deleteProfilesStream(api, ref.stream);
+    await deleteProfilesStream(api, zero.stream);
+    await deleteProfilesStream(api, unknown.stream);
+    await api.dispose();
+  });
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    pm = new PageManager(page);
+    await pm.profilesPage.mockServerConfig();
+    await pm.profilesPage.hideFlameZoomHint();
+    await navigateToBase(page);
+  });
+
+  test.afterEach(async ({}, testInfo) => {
+    await pm.profilesPage.teardown();
+    testLogger.testEnd(testInfo.title, testInfo.status);
+  });
+
+  test('An empty window shows No profiles found and disables Share', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    await pm.profilesPage.gotoSeeded({
+      stream: ref.stream,
+      from: ref.window.from - 180 * MINUTE_MS * 1000,
+      to: ref.window.from - 120 * MINUTE_MS * 1000,
+      service: 'checkout',
+    });
+    await pm.profilesPage.expectState('noResults', {
+      title: 'No profiles found',
+      description: "Your time window doesn't contain any profile data from this stream.",
+    });
+    await pm.profilesPage.expectShareDisabled(true);
+  });
+
+  test('A load error shows Retry and recovers once the bad filter is removed', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    const calls = pm.profilesPage.trackRequests();
+    await pm.profilesPage.gotoRef(ref, { filters: 'a%3Bb=x' });
+    await pm.profilesPage.expectState('error', { description: 'invalid filter key: a;b' });
+    const before = calls.merge.length;
+    await pm.profilesPage.clickStateAction('error');
+    await expect.poll(() => calls.merge.length).toBeGreaterThan(before);
+    await pm.profilesPage.waitForRunIdle();
+    await pm.profilesPage.expectState('error', { description: 'invalid filter key: a;b' });
+    await pm.profilesPage.removeFilter('a;b');
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectStateHidden('error');
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+  });
+
+  test('A failed re-run keeps the data and shows an error banner with Retry', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.mockApi('merge', { status: 500, json: { code: 500, message: 'x' } });
+    await pm.profilesPage.clickRun();
+    await pm.profilesPage.expectErrorBannerText('x');
+    await pm.profilesPage.expectTopTableVisible();
+    await pm.profilesPage.unrouteApi('merge');
+    await pm.profilesPage.clickErrorBannerRetry();
+    await pm.profilesPage.waitForRunIdle();
+    await pm.profilesPage.expectStateHidden('errorBanner');
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+  });
+
+  test('A truncated merge says what share of samples is shown', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.patchApiResponse('merge', () => ({ truncated: true, total: 200, merged_total: 150 }));
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectState('partial', {
+      title: 'Showing 75.00% of samples. Less common call stacks are left out of this view.',
+    });
+  });
+
+  test('Loading shows skeletons in every view', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    const release = await pm.profilesPage.holdApi('merge');
+    await pm.profilesPage.openSeededNoWait({ stream: ref.stream, ...ref.window, service: 'checkout', view: 'flame' });
+    await pm.profilesPage.expectSkeleton('series');
+    await pm.profilesPage.expectSkeleton('flame');
+    await pm.profilesPage.switchViewWhileLoading('sandwich');
+    await pm.profilesPage.expectSkeleton('sandwich');
+    await pm.profilesPage.switchViewWhileLoading('top');
+    await pm.profilesPage.expectTopTableLoading();
+    release();
+    await pm.profilesPage.waitForRunIdle();
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query', self: '6 s' });
+  });
+
+  test('A 1100-frame stack renders with its truncated root', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { service: 'catalog', view: 'flame' });
+    await pm.profilesPage.hoverFrame(C.truncated, '[truncated]');
+    await pm.profilesPage.expectFlameTooltipContains('[truncated]', ['1 s', '18.13%']);
+    await pm.profilesPage.switchView('top');
+    await pm.profilesPage.expectTopRow(0, { name: 'deep_0000', self: '1 s' });
+  });
+
+  test('Rows whose values are all zero show no results', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.gotoRef(zero, { service: 'zero-svc' });
+    await pm.profilesPage.expectState('noResults', { title: 'No profiles found' });
+  });
+
+  test('Switching theme recolours a live flame graph', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'flame' });
+    await pm.profilesPage.hoverFrame(F.db_query, 'db_query');
+    const before = await pm.profilesPage.framePixel(F.db_query);
+    await pm.themePage.toggleThemeMode();
+    await expect.poll(async () => JSON.stringify(await pm.profilesPage.framePixel(F.db_query))).not.toBe(JSON.stringify(before));
+    await pm.profilesPage.expectViewActive('flame');
+  });
+
+  test('In dark mode the chart has no background of its own', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.themePage.toggleThemeMode();
+    await pm.themePage.waitForDarkModeApplied();
+    await expect
+      .poll(async () => {
+        const { chart, card } = await pm.profilesPage.chartAndCardBackground();
+        return Math.max(Math.abs(chart.r - card.r), Math.abs(chart.g - card.g), Math.abs(chart.b - card.b));
+      })
+      .toBeLessThan(4);
+  });
+
+  test('At phone width the views move into a menu and the page does not scroll sideways', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.setViewport(390, 844);
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.openMobileViewMenu();
+    expect(await pm.profilesPage.mobileViewMenuItems()).toEqual([
+      'profiles-view-top-item',
+      'profiles-view-flame-item',
+      'profiles-view-tree-item',
+      'profiles-view-sandwich-item',
+      'profiles-view-compare-item',
+    ]);
+    await pm.profilesPage.pressEscape();
+    expect(await pm.profilesPage.hasHorizontalPageScroll()).toBe(false);
+    await pm.profilesPage.rowMenuAction('top', 0, 'details');
+    await pm.profilesPage.expectDetails({ name: 'db_query', self: '6 s · 50.00%' });
+    expect(await pm.profilesPage.detailsSitsBelowTable()).toBe(true);
+    await pm.profilesPage.pickMobileView('tree');
+    await pm.profilesPage.expectUrlParam('view', 'tree');
+  });
+
+  test('A profile without service.name is listed as unknown_service', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(unknown, { service: 'unknown_service:mybin' });
+    expect(await pm.profilesPage.selectOptionLabels(pm.profilesPage.serviceSelect)).toEqual(['unknown_service:mybin']);
+    await pm.profilesPage.expectTopRow(0, { name: 'bin_work', self: '1 s', selfPercent: '100.00%' });
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/Profiles/profiles-views.spec.js b/tests/ui-testing/playwright-tests/Profiles/profiles-views.spec.js
new file mode 100644
index 0000000000..14102f77cd
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Profiles/profiles-views.spec.js
@@ -0,0 +1,229 @@
+// Continuous Profiling result views: Top Table, Call Tree, Sandwich, Function details.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const { CHECKOUT_FRAMES } = require('../../pages/profilesPages/profilesPage.js');
+const { seedReferenceStream, deleteProfilesStream, XSS_FUNCTION } = require('../utils/profiles-ingestion.js');
+
+test.describe('Profiles views', () => {
+  test.describe.configure({ mode: 'parallel' });
+  let api;
+  let ref;
+  let pm;
+
+  test.beforeAll(async ({ playwright }) => {
+    api = await playwright.request.newContext();
+    ref = await seedReferenceStream(api, 'views');
+  });
+
+  test.afterAll(async () => {
+    await deleteProfilesStream(api, ref.stream);
+    await api.dispose();
+  });
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    pm = new PageManager(page);
+    await pm.profilesPage.mockServerConfig();
+    await pm.profilesPage.hideFlameZoomHint();
+    await navigateToBase(page);
+  });
+
+  test.afterEach(async ({}, testInfo) => {
+    await pm.profilesPage.teardown();
+    testLogger.testEnd(testInfo.title, testInfo.status);
+  });
+
+  test('Top Table shows exact self and total per function', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectTopRowNames([
+      'db_query',
+      'json_encode',
+      'handle_order',
+      'process_payment',
+      'gc_sweep',
+      XSS_FUNCTION,
+      'main',
+      'runtime_main',
+    ]);
+    await pm.profilesPage.expectTopRow(0, { self: '6 s', selfPercent: '50.00%', total: '6 s', totalPercent: '50.00%' });
+    await pm.profilesPage.expectTopRow(1, { self: '4 s', selfPercent: '33.33%', total: '4 s' });
+    await pm.profilesPage.expectTopRow(2, { self: '1.5 s', selfPercent: '12.50%', total: '11.85 s', totalPercent: '98.75%' });
+    await pm.profilesPage.expectTopRow(3, { self: '250 ms', selfPercent: '2.08%' });
+    await pm.profilesPage.expectTopRow(4, { self: '150 ms', selfPercent: '1.25%' });
+    await pm.profilesPage.expectTopRow(5, { self: '100 ms', selfPercent: '0.83%' });
+    await pm.profilesPage.expectTopRow(6, { self: '0 ns', selfPercent: '0.00%', total: '11.85 s', totalPercent: '98.75%' });
+    await pm.profilesPage.expectTopRow(7, { self: '0 ns', total: '150 ms', totalPercent: '1.25%' });
+  });
+
+  test('Sorting by Total reorders the Top Table both ways', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.sortTopBy('total');
+    await pm.profilesPage.expectTopSort('total', 'descending');
+    await pm.profilesPage.expectTopRow(2, { name: 'db_query', total: '6 s' });
+    await pm.profilesPage.expectTopRow(7, { name: XSS_FUNCTION, total: '100 ms' });
+    await pm.profilesPage.expectTopRow(0, { total: '11.85 s' });
+    await pm.profilesPage.expectTopRow(1, { total: '11.85 s' });
+    await pm.profilesPage.sortTopBy('total');
+    await pm.profilesPage.expectTopSort('total', 'ascending');
+    await pm.profilesPage.expectTopRow(0, { name: XSS_FUNCTION, total: '100 ms' });
+    await pm.profilesPage.expectTopRow(5, { name: 'db_query', total: '6 s' });
+  });
+
+  test('Search filters the Top Table, highlights the match and summarises the share', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.search('json');
+    await pm.profilesPage.expectTopRowNames(['json_encode']);
+    await pm.profilesPage.expectSearchSummary('1 function · 33.33% of samples');
+    await pm.profilesPage.expectMarkedText('json');
+    await pm.profilesPage.expectUrlParam('search', 'json');
+  });
+
+  test('Search with no match says so and empties the table', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.search('zzz');
+    await pm.profilesPage.expectSearchSummary('No matches');
+    await pm.profilesPage.expectTopRowCount(0);
+  });
+
+  test('Row menu Copy puts the function name on the clipboard', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.rowMenuAction('top', 0, 'copy');
+    await pm.profilesPage.expectCopiedToast();
+    expect(await pm.profilesPage.readClipboard()).toBe('db_query');
+  });
+
+  test('Row menu Search fills the search box with the function', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.rowMenuAction('top', 1, 'search');
+    await pm.profilesPage.expectSearchValue('json_encode');
+    await pm.profilesPage.expectTopRowNames(['json_encode']);
+  });
+
+  test('Row menu Show in Flame Graph switches view and highlights the function', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.rowMenuAction('top', 2, 'show');
+    await pm.profilesPage.expectViewActive('flame');
+    await pm.profilesPage.expectSearchValue('handle_order');
+    await pm.profilesPage.expectUrlParam('view', 'flame');
+    await pm.profilesPage.expectUrlParam('search', 'handle_order');
+  });
+
+  test('Function details shows exact self, total, callers and callees', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.rowMenuAction('top', 2, 'details');
+    await pm.profilesPage.expectDetails({
+      name: 'handle_order',
+      self: '1.5 s · 12.50%',
+      total: '11.85 s · 98.75%',
+      calledBy: ['main'],
+      calls: ['db_query', 'json_encode', 'process_payment', XSS_FUNCTION],
+      hasPackage: false,
+    });
+    expect(await pm.profilesPage.detailsListRowCount('calls')).toBe(4);
+    expect(await pm.profilesPage.detailsListRowCount('calledBy')).toBe(1);
+    await pm.profilesPage.expectUrlParam('details', 'handle_order');
+  });
+
+  test('Function details actions copy, open sandwich, show in flame and close', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { extra: { details: 'handle_order' } });
+    await pm.profilesPage.expectDetails({ name: 'handle_order', self: '1.5 s · 12.50%' });
+    await pm.profilesPage.clickDetails('copy');
+    await pm.profilesPage.expectCopiedToast();
+    expect(await pm.profilesPage.readClipboard()).toBe('handle_order');
+    await pm.profilesPage.clickDetails('sandwich');
+    await pm.profilesPage.expectViewActive('sandwich');
+    await pm.profilesPage.expectSandwichFunction('handle_order');
+    await pm.profilesPage.clickDetails('show');
+    await pm.profilesPage.expectViewActive('flame');
+    await pm.profilesPage.expectSearchValue('handle_order');
+    await pm.profilesPage.clickDetails('close');
+    await pm.profilesPage.expectDetailsHidden();
+    await pm.profilesPage.expectUrlParamAbsent('details');
+  });
+
+  test('Function details is hidden in Compare', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { extra: { details: 'db_query' } });
+    await pm.profilesPage.expectDetails({ name: 'db_query', self: '6 s · 50.00%' });
+    await pm.profilesPage.switchView('compare');
+    await pm.profilesPage.waitForCompareIdle();
+    await pm.profilesPage.expectDetailsHidden();
+  });
+
+  test('Call Tree shows child and node counts and expands and collapses', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'tree' });
+    await pm.profilesPage.expectTreeRow(0, { name: 'total', counts: '2 children · 8 nodes', total: '12 s' });
+    await pm.profilesPage.expectTreeRow(1, { name: 'main', counts: '1 child · 5 nodes', total: '11.85 s' });
+    await pm.profilesPage.expectTreeRow(2, { name: 'runtime_main', counts: '1 child · 1 node', total: '150 ms' });
+    await pm.profilesPage.expectTreeRowCount(3);
+    await pm.profilesPage.toggleTreeRow(1);
+    await pm.profilesPage.expectTreeRow(2, { name: 'handle_order', counts: '4 children · 4 nodes', self: '1.5 s' });
+    await pm.profilesPage.toggleTreeRow(2);
+    await pm.profilesPage.expectTreeRow(3, { name: 'db_query', counts: null, self: '6 s' });
+    await pm.profilesPage.expectTreeRowCount(8);
+    await pm.profilesPage.toggleTreeRow(1);
+    await pm.profilesPage.expectTreeRowExpanded(1, false);
+    await pm.profilesPage.expectTreeRowCount(3);
+  });
+
+  test('Call Tree Focus in Flame Graph focuses that exact frame', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'tree' });
+    await pm.profilesPage.toggleTreeRow(1);
+    await pm.profilesPage.toggleTreeRow(2);
+    await pm.profilesPage.expectTreeRow(3, { name: 'db_query' });
+    await pm.profilesPage.rowMenuAction('tree', 3, 'show');
+    await pm.profilesPage.expectViewActive('flame');
+    await pm.profilesPage.expectUrlParam('focus', CHECKOUT_FRAMES.db_query.path);
+  });
+
+  test('Sandwich defaults to the top self function and follows the picked one', { tag: ['@all', '@profiles', '@P1'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { view: 'sandwich' });
+    await pm.profilesPage.expectSandwichFunction('db_query');
+    await pm.profilesPage.expectRootAtBottom(true);
+    await pm.profilesPage.pickSandwichFunction('handle_order');
+    await pm.profilesPage.expectUrlParam('fn', 'handle_order');
+    await pm.profilesPage.expectSandwichCoverage(false);
+  });
+
+  test('Sandwich notes partial coverage when the call tree is cut', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.forceMergeMaxNodes(50);
+    await pm.profilesPage.gotoRef(ref, { service: 'catalog', view: 'sandwich' });
+    await pm.profilesPage.expectSandwichFunction('deep_0000');
+    await pm.profilesPage.expectSandwichCoverageText("The call tree holds 0.00% of this function's samples");
+  });
+
+  test('A script-like function name renders as text everywhere', { tag: ['@all', '@profiles', '@P0'] }, async () => {
+    await pm.profilesPage.gotoRef(ref);
+    await pm.profilesPage.expectTopRow(5, { name: XSS_FUNCTION });
+    await pm.profilesPage.search('onerror');
+    await pm.profilesPage.expectTopRowNames([XSS_FUNCTION]);
+    await pm.profilesPage.expectMarkedText('onerror');
+    await pm.profilesPage.rowMenuAction('top', 0, 'details');
+    await pm.profilesPage.expectDetails({ name: XSS_FUNCTION, calledBy: ['handle_order'] });
+    await pm.profilesPage.search('');
+    await pm.profilesPage.switchView('flame');
+    await pm.profilesPage.hoverFrame({ depth: 3, left: 85.417, width: 0.833 }, XSS_FUNCTION);
+    await pm.profilesPage.switchView('tree');
+    await pm.profilesPage.toggleTreeRow(1);
+    await pm.profilesPage.toggleTreeRow(2);
+    await pm.profilesPage.expectTreeRow(6, { name: XSS_FUNCTION });
+    expect(await pm.profilesPage.isXssExecuted()).toBe(false);
+  });
+
+  test('Stale details and sandwich function seeds fall back safely', { tag: ['@all', '@profiles', '@P3'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { extra: { details: 'no_such_fn' } });
+    await pm.profilesPage.expectTopRow(0, { name: 'db_query' });
+    await pm.profilesPage.expectDetailsHidden();
+    await pm.profilesPage.gotoRef(ref, { view: 'sandwich', extra: { fn: 'no_such_fn' } });
+    await pm.profilesPage.expectSandwichFunction('db_query');
+  });
+
+  test('Memory profiles use binary byte units', { tag: ['@all', '@profiles', '@P2'] }, async () => {
+    await pm.profilesPage.gotoRef(ref, { service: 'payments', type: 'alloc_space', unit: 'bytes' });
+    await pm.profilesPage.expectTopRow(0, { name: 'alloc_buffer', self: '1 MiB', selfPercent: '66.67%' });
+    await pm.profilesPage.expectTopRow(1, { name: 'alloc_json', self: '512 KiB', selfPercent: '33.33%' });
+    await pm.profilesPage.switchView('flame');
+    await pm.profilesPage.expectFlameRootSummary('Total: 1.5 MiB (bytes)');
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/cleanup.spec.js b/tests/ui-testing/playwright-tests/cleanup.spec.js
index 09e7259912..d3bd7ffce7 100644
--- a/tests/ui-testing/playwright-tests/cleanup.spec.js
+++ b/tests/ui-testing/playwright-tests/cleanup.spec.js
@@ -409,11 +409,15 @@ test.describe("Pre-Test Cleanup", () => {
       [
         /^sdr_traces_/,                // sdr_traces_* (traces SDR test streams: redact/drop/hash × ingestion/query)
         /^trace_genai_parts_/,         // trace_genai_parts_* (GenAI v5 parts rendering test streams)
+        /^e2e_prof_trace_/,            // Profiles/profiles-navigation-entry.spec.js linked-span traces stream
       ],
       ['default'],                     // protect the default traces stream
       { streamType: 'traces' }
     );
 
+    // Profiles specs delete their e2e_prof_* streams in afterAll; this sweeps what a crashed run left behind.
+    await pm.apiCleanup.cleanupStreams([/^e2e_prof_/], ['default'], { streamType: 'profiles' });
+
     // Note: Pipeline regression test streams (e2e_test_cpu_usage for metrics, e2e_test_traces for traces)
     // are created by pipeline-regression.spec.js for Issue #9901 regression tests.
     // Custom traces stream uses "stream-name" header (ZO_GRPC_STREAM_HEADER_KEY config).
@@ -458,11 +462,6 @@ test.describe("Pre-Test Cleanup", () => {
     // This avoids conflicts both within a test run (parallelIndex) and across test runs (testRunId)
     // The cleanup patterns above will clean up old test streams via regex matching
 
-    // Clean up test semantic groups created by correlation settings tests
-    // Groups: k8s-cluster, k8s-namespace, k8s-deployment, service
-    // These are created by ensureSemanticGroupsExist() in correlationSettingsPage.js
-    await pm.apiCleanup.cleanupCorrelationSettings();
-
     // Clean up service graph test screenshots
     const path = require('path');
     const screenshotDir = path.join(__dirname, '..', 'test-results', 'screenshots');
diff --git a/tests/ui-testing/playwright-tests/utils/profiles-ingestion.js b/tests/ui-testing/playwright-tests/utils/profiles-ingestion.js
new file mode 100644
index 0000000000..4a0385a785
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/utils/profiles-ingestion.js
@@ -0,0 +1,446 @@
+// Profiles OTLP/JSON ingestion, readiness gates and a reference dataset whose totals are computed by hand.
+
+const crypto = require('crypto');
+const { expect } = require('@playwright/test');
+const testLogger = require('./test-logger.js');
+const { getAuthHeaders, getOrgIdentifier } = require('./cloud-auth.js');
+const { ingestBase } = require('./ingest-url.js');
+
+const SECOND_NS = 1_000_000_000;
+const MINUTE_MS = 60_000;
+const READY_TIMEOUT_MS = 60_000;
+const READY_INTERVALS = [500, 1_000, 2_000];
+
+const XSS_FUNCTION = '<img src=x onerror=window.__xss=1>';
+
+function baseUrl() {
+  return (process.env.ZO_BASE_URL || '').replace(/\/+$/, '');
+}
+
+function randomHex(bytes) {
+  return crypto.randomBytes(bytes).toString('hex');
+}
+
+/** Unique per-run stream name, e.g. `e2e_prof_views_1a2b3c4d`. */
+function uniqueProfilesStream(spec) {
+  return `e2e_prof_${spec}_${randomHex(4)}`;
+}
+
+/** Start of the current minute − 10 min + 5 s, in ms: every profile sits alone in a one-minute bucket. */
+function referenceT0Ms(now = Date.now()) {
+  return Math.floor(now / MINUTE_MS) * MINUTE_MS - 10 * MINUTE_MS + 5_000;
+}
+
+/** Absolute window around the reference data in microseconds (T0 − 1 min … T0 + 9 min). */
+function referenceWindowUs(t0Ms) {
+  return { from: (t0Ms - MINUTE_MS) * 1000, to: (t0Ms + 9 * MINUTE_MS) * 1000 };
+}
+
+function resourceAttrs({ service, version, env, instance, host, exe, extra = {} }) {
+  const attrs = [];
+  const add = (key, value) => {
+    if (value !== undefined && value !== null) attrs.push({ key, value: { stringValue: String(value) } });
+  };
+  add('service.name', service);
+  add('service.version', version);
+  add('deployment.environment', env);
+  add('service.instance.id', instance);
+  add('host.name', host);
+  add('process.executable.name', exe);
+  for (const [key, value] of Object.entries(extra)) add(key, value);
+  return attrs;
+}
+
+/** One OTLP/JSON export with a shared dictionary; a sample is { stack: [leaf … root], value, link? }. */
+function buildProfilesRequest(resources) {
+  const strings = [''];
+  const stringIndex = new Map([['', 0]]);
+  const functions = [{}];
+  const functionIndex = new Map();
+  const locations = [{}];
+  const stacks = [{}];
+  const stackIndex = new Map();
+  const links = [{}];
+  const linkIndex = new Map();
+
+  const str = (value) => {
+    if (!stringIndex.has(value)) {
+      stringIndex.set(value, strings.length);
+      strings.push(value);
+    }
+    return stringIndex.get(value);
+  };
+  const fn = (name) => {
+    if (!functionIndex.has(name)) {
+      functionIndex.set(name, functions.length);
+      functions.push({ nameStrindex: str(name) });
+      locations.push({ lines: [{ functionIndex: functions.length - 1 }] });
+    }
+    return functionIndex.get(name);
+  };
+  const stack = (frames) => {
+    const key = frames.join('\u0000');
+    if (!stackIndex.has(key)) {
+      stackIndex.set(key, stacks.length);
+      stacks.push({ locationIndices: frames.map((frame) => fn(frame)) });
+    }
+    return stackIndex.get(key);
+  };
+  const link = ({ traceId, spanId }) => {
+    const key = `${traceId}/${spanId}`;
+    if (!linkIndex.has(key)) {
+      linkIndex.set(key, links.length);
+      links.push({ traceId, spanId });
+    }
+    return linkIndex.get(key);
+  };
+
+  const resourceProfiles = resources.map((resource) => ({
+    resource: { attributes: resourceAttrs(resource.attrs) },
+    scopeProfiles: [
+      {
+        scope: { name: 'e2e-profiles', version: '1.0.0' },
+        profiles: resource.profiles.map((profile) => ({
+          sampleType: { typeStrindex: str(profile.type), unitStrindex: str(profile.unit) },
+          timeUnixNano: String(BigInt(resource.timeMs) * 1_000_000n),
+          durationNano: String(10 * SECOND_NS),
+          samples: profile.samples.map((sample) => ({
+            stackIndex: stack(sample.stack),
+            values: [String(sample.value)],
+            ...(sample.link ? { linkIndex: link(sample.link) } : {}),
+          })),
+        })),
+      },
+    ],
+  }));
+
+  return {
+    dictionary: {
+      stringTable: strings,
+      functionTable: functions,
+      locationTable: locations,
+      stackTable: stacks,
+      linkTable: links,
+    },
+    resourceProfiles,
+  };
+}
+
+const cpu = (samples) => ({ type: 'cpu', unit: 'nanoseconds', samples });
+const s = (frames, value, link) => ({ stack: frames.split('<-'), value, ...(link ? { link } : {}) });
+
+/** Reference dataset: checkout totals 12 s (v1.4.0 4 s, v1.5.0 8 s), payments 3.5 s cpu, catalog 5.515 s; `link` tags checkout's process_payment. */
+function referenceResources(t0Ms, link) {
+  const at = (minutes) => t0Ms + minutes * MINUTE_MS;
+  const wide = Array.from({ length: 300 }, (_, i) =>
+    s(`wide_fn_${String(i).padStart(3, '0')}<-wide_root<-catalog_main`, (i + 1) * 100_000),
+  );
+  const deep = {
+    stack: Array.from({ length: 1100 }, (_, i) => `deep_${String(i).padStart(4, '0')}`),
+    value: SECOND_NS,
+  };
+  return [
+    {
+      attrs: { service: 'checkout', version: 'v1.4.0', env: 'prod', instance: 'checkout-1', host: 'host-a' },
+      timeMs: at(0),
+      profiles: [
+        cpu([
+          s('db_query<-handle_order<-main', 2 * SECOND_NS),
+          s('json_encode<-handle_order<-main', SECOND_NS),
+          s('handle_order<-main', SECOND_NS),
+        ]),
+      ],
+    },
+    {
+      attrs: { service: 'payments', version: 'v1.4.0', env: 'prod', instance: 'payments-1', host: 'host-d' },
+      timeMs: at(2),
+      profiles: [
+        cpu([s('charge_card<-process<-main', 1_200_000_000), s('validate<-process<-main', 800_000_000)]),
+        {
+          type: 'alloc_space',
+          unit: 'bytes',
+          samples: [s('alloc_buffer<-process<-main', 1_048_576), s('alloc_json<-process<-main', 524_288)],
+        },
+        { type: 'inuse_space', unit: 'bytes', samples: [s('cache_put<-process<-main', 2_097_152)] },
+      ],
+    },
+    {
+      attrs: { service: 'checkout', version: 'v1.5.0', env: 'prod', instance: 'checkout-2', host: 'host-b' },
+      timeMs: at(4),
+      profiles: [
+        cpu([
+          s('db_query<-handle_order<-main', 4 * SECOND_NS),
+          s('json_encode<-handle_order<-main', 3 * SECOND_NS),
+          s('handle_order<-main', 500_000_000),
+          s(`${XSS_FUNCTION}<-handle_order<-main`, 100_000_000),
+          s('process_payment<-handle_order<-main', 250_000_000, link),
+        ]),
+      ],
+    },
+    {
+      attrs: { service: 'payments', version: 'v1.5.0', env: 'prod', instance: 'payments-2', host: 'host-e' },
+      timeMs: at(5),
+      profiles: [
+        cpu([s('charge_card<-process<-main', 1_500_000_000)]),
+        { type: 'inuse_space', unit: 'bytes', samples: [s('cache_put<-process<-main', 4_194_304)] },
+      ],
+    },
+    {
+      attrs: { service: 'checkout', version: 'v1.5.0', env: 'stage', instance: 'checkout-3', host: 'host-c' },
+      timeMs: at(6),
+      profiles: [cpu([s('gc_sweep<-runtime_main', 150_000_000)])],
+    },
+    {
+      attrs: { service: 'catalog', version: 'v1.5.0', env: 'stage', instance: 'catalog-1', host: 'host-f' },
+      timeMs: at(7),
+      profiles: [cpu([...wide, deep])],
+    },
+  ];
+}
+
+/** Twelve checkout versions (v1.1.0 … v1.12.0), one cpu profile each, for Breakdown "Others". */
+function manyVersionsResources(t0Ms) {
+  return Array.from({ length: 12 }, (_, i) => ({
+    attrs: { service: 'checkout', version: `v1.${i + 1}.0`, env: 'prod', instance: `mv-${i}`, host: 'host-mv' },
+    timeMs: t0Ms + (i % 9) * MINUTE_MS,
+    profiles: [cpu([s('work<-main', (i + 1) * 100_000_000)])],
+  }));
+}
+
+/** One profile with no service.name (falls back to unknown_service:mybin). */
+function unknownServiceResources(t0Ms) {
+  return [{ attrs: { exe: 'mybin' }, timeMs: t0Ms, profiles: [cpu([s('bin_work<-bin_main', SECOND_NS)])] }];
+}
+
+/** Rows whose every value is 0: the stream has a service but no samples to draw. */
+function zeroValueResources(t0Ms) {
+  return [{ attrs: { service: 'zero-svc' }, timeMs: t0Ms, profiles: [cpu([s('idle<-main', 0)])] }];
+}
+
+/** Rows with only service.name, so the stream has no label to compare by. */
+function noLabelResources(t0Ms) {
+  return [{ attrs: { service: 'bare-svc' }, timeMs: t0Ms, profiles: [cpu([s('bare_work<-main', SECOND_NS)])] }];
+}
+
+async function postProfiles(request, stream, body) {
+  const org = getOrgIdentifier();
+  const url = `${ingestBase(baseUrl())}/api/${org}/v1/profiles`;
+  const response = await request.post(url, {
+    headers: { ...getAuthHeaders(), 'Content-Type': 'application/json', 'stream-name': stream },
+    data: body,
+  });
+  const text = await response.text();
+  if (response.status() !== 200) {
+    throw new Error(`Profiles ingest to ${stream} failed: ${response.status()} ${text}`);
+  }
+  if (text.includes('partialSuccess')) {
+    throw new Error(`Profiles ingest to ${stream} rejected some profiles: ${text}`);
+  }
+  testLogger.info('Ingested profiles', { stream, resources: body.resourceProfiles.length });
+}
+
+async function ingestProfiles(request, stream, resources) {
+  await postProfiles(request, stream, buildProfilesRequest(resources));
+}
+
+/** Ingests the reference dataset into a fresh stream, gates on its exact totals, returns { stream, t0Ms, window, link }. */
+async function seedReferenceStream(request, spec) {
+  const stream = uniqueProfilesStream(spec);
+  const t0Ms = referenceT0Ms();
+  const link = { traceId: randomHex(16), spanId: randomHex(8) };
+  await ingestProfiles(request, stream, referenceResources(t0Ms, link));
+  const window = referenceWindowUs(t0Ms);
+  await waitForProfilesTotal(request, stream, {
+    window,
+    service: 'checkout',
+    type: 'cpu',
+    unit: 'nanoseconds',
+    total: 12_000_000_000,
+  });
+  await waitForProfilesTotal(request, stream, {
+    window,
+    service: 'catalog',
+    type: 'cpu',
+    unit: 'nanoseconds',
+    total: 5_515_000_000,
+  });
+  await waitForProfilesTotal(request, stream, {
+    window,
+    service: 'payments',
+    type: 'inuse_space',
+    unit: 'bytes',
+    total: 6_291_456,
+  });
+  return { stream, t0Ms, window, link };
+}
+
+/** Ingests `build(t0Ms)` into a fresh stream and gates on `service` (and its exact cpu `total` when given). */
+async function seedProfilesStream(request, spec, build, { service, total }) {
+  const stream = uniqueProfilesStream(spec);
+  const t0Ms = referenceT0Ms();
+  await ingestProfiles(request, stream, build(t0Ms));
+  const window = referenceWindowUs(t0Ms);
+  await waitForProfilesService(request, stream, { window, service });
+  if (total !== undefined) {
+    await waitForProfilesTotal(request, stream, { window, service, type: 'cpu', unit: 'nanoseconds', total });
+  }
+  return { stream, t0Ms, window };
+}
+
+async function profilesApi(request, method, stream, path, body) {
+  const org = getOrgIdentifier();
+  const url = `${baseUrl()}/api/${org}/${stream}/profiles/${path}`;
+  const options = { headers: { ...getAuthHeaders(), 'Content-Type': 'application/json' } };
+  const response =
+    method === 'post' ? await request.post(url, { ...options, data: body }) : await request.get(url, options);
+  const text = await response.text();
+  return { status: response.status(), body: text ? JSON.parse(text) : null, text };
+}
+
+/** Polls /profiles/merge until `total` matches exactly; fails loudly with the last response. */
+async function waitForProfilesTotal(request, stream, { window, service, type, unit, filters = [], total }) {
+  const body = {
+    start_time: window.from,
+    end_time: window.to,
+    ...(service ? { service_name: service } : {}),
+    profile_type: type,
+    profile_unit: unit,
+    filters,
+  };
+  let last = null;
+  await expect
+    .poll(
+      async () => {
+        last = await profilesApi(request, 'post', stream, 'merge', body);
+        return last.status === 200 ? last.body?.total : `HTTP ${last.status} ${last.text.slice(0, 300)}`;
+      },
+      { timeout: READY_TIMEOUT_MS, intervals: READY_INTERVALS, message: `profiles merge total on ${stream}` },
+    )
+    .toBe(total);
+  return last.body;
+}
+
+/** Polls /profiles/meta until `service` is listed in the window. */
+async function waitForProfilesService(request, stream, { window, service }) {
+  let last = null;
+  await expect
+    .poll(
+      async () => {
+        last = await profilesApi(request, 'get', stream, `meta?start_time=${window.from}&end_time=${window.to}`);
+        return last.status === 200 ? last.body?.services ?? [] : [`HTTP ${last.status}`];
+      },
+      { timeout: READY_TIMEOUT_MS, intervals: READY_INTERVALS, message: `profiles meta services on ${stream}` },
+    )
+    .toContain(service);
+  return last.body;
+}
+
+/** Deletes a profiles stream; logs instead of throwing so teardown never masks a test failure. */
+async function deleteProfilesStream(request, stream) {
+  const org = getOrgIdentifier();
+  try {
+    const response = await request.delete(
+      `${baseUrl()}/api/${org}/streams/${stream}?type=profiles&delete_all=true`,
+      { headers: getAuthHeaders() },
+    );
+    testLogger.info('Deleted profiles stream', { stream, status: response.status() });
+  } catch (error) {
+    testLogger.warn('Profiles stream delete failed', { stream, error: error.message });
+  }
+}
+
+/** Ingests one trace with a sibling span per id in `spanIds` (all same start/duration), into its own traces stream. */
+async function ingestTraceSpans(request, stream, { traceId, spanIds, startMs, durationMs = 1_000, service = 'checkout' }) {
+  const org = getOrgIdentifier();
+  const start = BigInt(startMs) * 1_000_000n;
+  const end = start + BigInt(durationMs) * 1_000_000n;
+  const body = {
+    resourceSpans: [
+      {
+        resource: { attributes: [{ key: 'service.name', value: { stringValue: service } }] },
+        scopeSpans: [
+          {
+            scope: { name: 'e2e-profiles', version: '1.0.0' },
+            spans: spanIds.map((spanId) => ({
+              traceId,
+              spanId,
+              name: `op_${spanId}`,
+              kind: 2,
+              startTimeUnixNano: String(start),
+              endTimeUnixNano: String(end),
+              attributes: [],
+              status: { code: 1 },
+            })),
+          },
+        ],
+      },
+    ],
+  };
+  const response = await request.post(`${ingestBase(baseUrl())}/api/${org}/v1/traces`, {
+    headers: { ...getAuthHeaders(), 'Content-Type': 'application/json', 'stream-name': stream },
+    data: body,
+  });
+  if (response.status() !== 200) {
+    throw new Error(`Trace ingest to ${stream} failed: ${response.status()} ${await response.text()}`);
+  }
+  await waitForTraceSearchable(request, stream, { traceId, startMs, endMs: startMs + durationMs });
+}
+
+async function waitForTraceSearchable(request, stream, { traceId, startMs, endMs }) {
+  const org = getOrgIdentifier();
+  await expect
+    .poll(
+      async () => {
+        const response = await request.post(`${baseUrl()}/api/${org}/_search?type=traces`, {
+          headers: { ...getAuthHeaders(), 'Content-Type': 'application/json' },
+          data: {
+            query: {
+              sql: `SELECT trace_id FROM "${stream}" WHERE trace_id = '${traceId}'`,
+              start_time: (startMs - MINUTE_MS) * 1000,
+              end_time: (endMs + MINUTE_MS) * 1000,
+              from: 0,
+              size: 10,
+            },
+          },
+        });
+        if (response.status() !== 200) return -response.status();
+        return ((await response.json()).hits ?? []).length;
+      },
+      { timeout: READY_TIMEOUT_MS, intervals: READY_INTERVALS, message: `trace ${traceId} searchable in ${stream}` },
+    )
+    .toBeGreaterThan(0);
+}
+
+async function deleteTracesStream(request, stream) {
+  const org = getOrgIdentifier();
+  try {
+    await request.delete(`${baseUrl()}/api/${org}/streams/${stream}?type=traces&delete_all=true`, {
+      headers: getAuthHeaders(),
+    });
+  } catch (error) {
+    testLogger.warn('Traces stream delete failed', { stream, error: error.message });
+  }
+}
+
+module.exports = {
+  XSS_FUNCTION,
+  MINUTE_MS,
+  randomHex,
+  uniqueProfilesStream,
+  referenceT0Ms,
+  referenceWindowUs,
+  buildProfilesRequest,
+  referenceResources,
+  manyVersionsResources,
+  unknownServiceResources,
+  zeroValueResources,
+  noLabelResources,
+  ingestProfiles,
+  seedReferenceStream,
+  seedProfilesStream,
+  waitForProfilesTotal,
+  waitForProfilesService,
+  deleteProfilesStream,
+  ingestTraceSpans,
+  deleteTracesStream,
+};
diff --git a/web/src/assets/dashboards/host_metrics.dashboard.json b/web/src/assets/dashboards/host_metrics.dashboard.json
index 9f487af3be..696f5e3827 100644
--- a/web/src/assets/dashboards/host_metrics.dashboard.json
+++ b/web/src/assets/dashboards/host_metrics.dashboard.json
@@ -98,7 +98,7 @@
           "queryType": "promql",
           "queries": [
             {
-              "query": "100 * (1 - avg(irate(system_cpu_time{state=\"idle\",host_name=~\"$host_name\"}[5m])))",
+              "query": "100 * (1 - sum(irate(system_cpu_time{state=\"idle\",host_name=~\"$host_name\"}[5m])) / sum(irate(system_cpu_time{host_name=~\"$host_name\"}[5m])))",
               "vrlFunctionQuery": "",
               "customQuery": true,
               "fields": {
@@ -379,7 +379,7 @@
           "queryType": "promql",
           "queries": [
             {
-              "query": "topk(10, 100 * (1 - avg by (host_name)(irate(system_cpu_time{state=\"idle\",host_name=~\"$host_name\"}[5m]))))",
+              "query": "topk(10, 100 * (1 - sum by (host_name)(irate(system_cpu_time{state=\"idle\",host_name=~\"$host_name\"}[5m])) / sum by (host_name)(irate(system_cpu_time{host_name=~\"$host_name\"}[5m]))))",
               "vrlFunctionQuery": "",
               "customQuery": true,
               "fields": {
@@ -629,7 +629,7 @@
           "queryType": "promql",
           "queries": [
             {
-              "query": "100 * (1 - avg by (host_name)(irate(system_cpu_time{state=\"idle\",host_name=~\"$host_name\"}[5m])))",
+              "query": "100 * (1 - sum by (host_name)(irate(system_cpu_time{state=\"idle\",host_name=~\"$host_name\"}[5m])) / sum by (host_name)(irate(system_cpu_time{host_name=~\"$host_name\"}[5m])))",
               "vrlFunctionQuery": "",
               "customQuery": true,
               "fields": {
@@ -690,7 +690,7 @@
           "queryType": "promql",
           "queries": [
             {
-              "query": "avg by (state)(irate(system_cpu_time{host_name=~\"$host_name\",state!=\"idle\"}[5m]))",
+              "query": "sum by (state)(irate(system_cpu_time{host_name=~\"$host_name\",state!=\"idle\"}[5m])) / ignoring(state) group_left sum(irate(system_cpu_time{host_name=~\"$host_name\"}[5m]))",
               "vrlFunctionQuery": "",
               "customQuery": true,
               "fields": {
diff --git a/web/src/assets/images/dashboard/charts/boxplot.svg b/web/src/assets/images/dashboard/charts/boxplot.svg
new file mode 100644
index 0000000000..4d6d7ffa13
--- /dev/null
+++ b/web/src/assets/images/dashboard/charts/boxplot.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" style="color-scheme:light dark">
+  <path d="M15.5 10V20M15.5 38V50M11 10H20M11 50H20M31.5 16V26M31.5 40V54M27 16H36M27 54H36M47.5 8V16M47.5 30V42M43 8H52M43 42H52" stroke="#131313" stroke-width="2" style="stroke:light-dark(#131313,#FFFFFF)"/>
+  <rect x="9" y="20" width="13" height="18" fill="#006BFF"/>
+  <rect x="25" y="26" width="13" height="14" fill="#0ED290"/>
+  <rect x="41" y="16" width="13" height="14" fill="#FE9738"/>
+  <path d="M9 29H22M25 33H38M41 23H54" stroke="#FFFFFF" stroke-width="2"/>
+  <circle cx="47.5" cy="52" r="2" fill="#FE0364"/>
+  <path d="M4 4.5H6V58H61.5V60H4Z" fill="#131313" style="fill:light-dark(#131313,#FFFFFF)"/>
+</svg>
diff --git a/web/src/assets/images/dashboard/charts/logs.svg b/web/src/assets/images/dashboard/charts/logs.svg
new file mode 100644
index 0000000000..1065a7b49f
--- /dev/null
+++ b/web/src/assets/images/dashboard/charts/logs.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" style="color-scheme:light dark">
+  <rect x="6" y="9" width="6" height="7" rx="1" fill="#006BFF"/>
+  <rect x="16" y="10.5" width="42" height="4" rx="2" fill="#131313" style="fill:light-dark(#131313,#FFFFFF)"/>
+  <rect x="6" y="21" width="6" height="7" rx="1" fill="#FED402"/>
+  <rect x="16" y="22.5" width="34" height="4" rx="2" fill="#131313" style="fill:light-dark(#131313,#FFFFFF)"/>
+  <rect x="6" y="33" width="6" height="7" rx="1" fill="#FE0364"/>
+  <rect x="16" y="34.5" width="40" height="4" rx="2" fill="#131313" style="fill:light-dark(#131313,#FFFFFF)"/>
+  <rect x="6" y="45" width="6" height="7" rx="1" fill="#0ED290"/>
+  <rect x="16" y="46.5" width="28" height="4" rx="2" fill="#131313" style="fill:light-dark(#131313,#FFFFFF)"/>
+</svg>
diff --git a/web/src/components/CodeQueryEditor.spec.ts b/web/src/components/CodeQueryEditor.spec.ts
index 7d8ba53d96..e982a62ec4 100644
--- a/web/src/components/CodeQueryEditor.spec.ts
+++ b/web/src/components/CodeQueryEditor.spec.ts
@@ -777,6 +777,44 @@ describe("CodeQueryEditor", () => {
         expect(wrapper.emitted("update:query")).toBeFalsy();
       });
 
+      it("passes whether the text is blank and was blank, counting a programmatic restore", async () => {
+        const lines = (...text: string[]) => {
+          mockModel.getLineCount.mockReturnValue(text.length);
+          mockModel.getLineContent.mockImplementation((line: number) => text[line - 1]);
+        };
+        const wrapper = await mountAndSetup();
+        mockEditorObj.setValue.mockImplementation(() => changeHandler()({ isFlush: false }));
+        lines("level='error'");
+        const editorApi = wrapper.vm as unknown as { setValue: (value: string) => void };
+        editorApi.setValue("level='error'");
+        expect(wrapper.emitted("user-edit")).toBeFalsy();
+
+        lines("  ", "");
+        changeHandler()({ isFlush: false });
+        lines("", "u");
+        changeHandler()({ isFlush: false });
+        expect(wrapper.emitted("user-edit")).toEqual([
+          [true, false],
+          [false, true],
+        ]);
+        lines("");
+      });
+
+      it("reads only up to the first non-blank line on an edit, never the whole document", async () => {
+        await mountAndSetup();
+        mockModel.getLineCount.mockReturnValue(10_000);
+        mockModel.getLineContent.mockImplementation((line: number) => (line === 1 ? "up" : "x"));
+        mockModel.getLineContent.mockClear();
+        mockModel.getValue.mockClear();
+        mockEditorObj.getValue.mockClear();
+        changeHandler()({ isFlush: false });
+        expect(mockModel.getLineContent).toHaveBeenCalledTimes(1);
+        expect(mockModel.getValue).not.toHaveBeenCalled();
+        expect(mockEditorObj.getValue).not.toHaveBeenCalled();
+        mockModel.getLineCount.mockReturnValue(1);
+        mockModel.getLineContent.mockImplementation(() => "");
+      });
+
       it("ignores a flush (a whole-model replace)", async () => {
         const wrapper = await mountAndSetup();
         changeHandler()({ isFlush: true });
diff --git a/web/src/components/CodeQueryEditor.vue b/web/src/components/CodeQueryEditor.vue
index eea90e96c3..64c59d18d0 100644
--- a/web/src/components/CodeQueryEditor.vue
+++ b/web/src/components/CodeQueryEditor.vue
@@ -102,6 +102,7 @@ const loadMonaco = (): Promise<any> => {
 };
 
 import { vrlLanguageDefinition } from "@/utils/query/vrlLanguageDefinition";
+import { recentCompletionItems } from "@/utils/queryHistory/recentCompletions";
 
 /**
  * Per-editor configuration, keyed by model URI.
@@ -130,6 +131,8 @@ interface EditorConfig {
   showHint: (text: string | null) => void;
   /** Set when the value lookup searches a caller's own time range instead of the default lookback. */
   valuesTimeRange: () => { startTime: number; endTime: number } | null;
+  /** The user's recent queries, offered as clock rows that replace the editor text. */
+  recents: () => string[];
 }
 
 interface ChainState {
@@ -267,6 +270,15 @@ const editorConfigs = new Map<string, EditorConfig>();
 const registeredLanguages = new Set<string>();
 const modelKey = (model: any): string => model?.uri?.toString?.() ?? "";
 
+// Stops at the first non-blank line, so an edit never copies the whole document.
+const modelIsBlank = (model: any): boolean => {
+  const lines: number = model?.getLineCount?.() ?? 0;
+  for (let line = 1; line <= lines; line++) {
+    if (model.getLineContent(line).trim()) return false;
+  }
+  return true;
+};
+
 // Global commands report here; the model says which editor accepted.
 const onSuggestAccepted = (editor: any, lane: SuggestLane | "", chained: boolean) => {
   const config = editorConfigs.get(modelKey(editor?.getModel?.()));
@@ -392,6 +404,10 @@ export default defineComponent({
       type: Array,
       default: null,
     },
+    recentQueries: {
+      type: Array as PropType<string[]>,
+      default: () => [],
+    },
     debounceTime: {
       type: Number,
       default: 500,
@@ -805,6 +821,7 @@ export default defineComponent({
         announce: announceMenu,
         showHint,
         valuesTimeRange: () => props.valuesTimeRange ?? null,
+        recents: () => props.recentQueries,
       });
     };
 
@@ -1010,7 +1027,11 @@ export default defineComponent({
         hintDecorations?.clear();
         syncValueQuoteKey();
       });
+      // Programmatic writes update it too, so a restore followed by a clear reads as non-empty → empty.
+      let isBlank = modelIsBlank(editorObj.getModel());
       editorObj.onDidChangeModelContent((e: any) => {
+        const wasBlank = isBlank;
+        isBlank = modelIsBlank(editorObj.getModel());
         const [change] = e?.changes ?? [];
         const chainSpace =
           chainState.typingSpace && e?.changes?.length === 1 && change.text === " ";
@@ -1020,7 +1041,7 @@ export default defineComponent({
           : null;
         if (!e?.isFlush && !programmatic) {
           pendingUserEdit = true;
-          emit("user-edit");
+          emit("user-edit", isBlank, wasBlank);
         } else {
           // The debounce emits the latest value, so a write landing on a typed one owns the origin.
           pendingUserEdit = false;
@@ -1909,7 +1930,19 @@ export default defineComponent({
           if (language === "promql" && context?.triggerCharacter === "=")
             return { suggestions: [] };
 
-          return reply(catalogEntries(config, model, position, textUntilPosition, word.word));
+          const catalog = reply(
+            catalogEntries(config, model, position, textUntilPosition, word.word),
+          );
+          const recents = recentCompletionItems(
+            config.recents(),
+            model,
+            position,
+            kinds().Reference,
+            t("recentSearches.recentRow"),
+          );
+          return recents.length
+            ? { ...catalog, suggestions: [...recents, ...catalog.suggestions] }
+            : catalog;
         },
       });
 
diff --git a/web/src/components/DateTime.spec.ts b/web/src/components/DateTime.spec.ts
index 6922dc9ebe..5c4ba8eb57 100644
--- a/web/src/components/DateTime.spec.ts
+++ b/web/src/components/DateTime.spec.ts
@@ -807,4 +807,20 @@ describe("DateTime Component", () => {
       expect(prev(wrapper).props("disabled")).toBe(true);
     });
   });
+
+  describe("hideSeconds", () => {
+    const units = (list: Array<{ value: string }>) => list.map((period) => period.value);
+
+    it("offers Seconds by default, as every existing picker has it", () => {
+      wrapper = createWrapper();
+      expect(units(wrapper.vm.relativePeriods)).toEqual(["s", "m", "h", "d", "w", "M"]);
+      expect(units(wrapper.vm.relativePeriodsSelect)).toEqual(["s", "m", "h", "d", "w", "M"]);
+    });
+
+    it("drops Seconds from the rows and the custom unit when the parent asks", () => {
+      wrapper = createWrapper({ hideSeconds: true });
+      expect(units(wrapper.vm.relativePeriods)).toEqual(["m", "h", "d", "w", "M"]);
+      expect(units(wrapper.vm.relativePeriodsSelect)).toEqual(["m", "h", "d", "w", "M"]);
+    });
+  });
 });
diff --git a/web/src/components/DateTime.vue b/web/src/components/DateTime.vue
index 1da1a913bb..1ce243a0a9 100644
--- a/web/src/components/DateTime.vue
+++ b/web/src/components/DateTime.vue
@@ -580,6 +580,11 @@ export default defineComponent({
       type: Boolean,
       default: false,
     },
+    /** Drops the relative Seconds unit, for a caller that accepts only whole minutes. */
+    hideSeconds: {
+      type: Boolean,
+      default: false,
+    },
   },
 
   emits: ["on:date-change", "on:timezone-change", "hide", "show"],
@@ -678,16 +683,9 @@ export default defineComponent({
       { label: t("common.days"), value: "d" },
       { label: t("common.weeks"), value: "w" },
       { label: t("common.months"), value: "M" },
-    ];
+    ].filter((period) => !props.hideSeconds || period.value !== "s");
 
-    let relativePeriodsSelect = ref([
-      { label: t("common.seconds"), value: "s" },
-      { label: t("common.minutes"), value: "m" },
-      { label: t("common.hours"), value: "h" },
-      { label: t("common.days"), value: "d" },
-      { label: t("common.weeks"), value: "w" },
-      { label: t("common.months"), value: "M" },
-    ]);
+    let relativePeriodsSelect = ref([...relativePeriods]);
 
     const relativeDates: Record<string, number[]> = {
       s: [1, 5, 10, 15, 30, 45],
diff --git a/web/src/components/QueryEditor.vue b/web/src/components/QueryEditor.vue
index 83c5274522..4794b88a55 100644
--- a/web/src/components/QueryEditor.vue
+++ b/web/src/components/QueryEditor.vue
@@ -99,8 +99,9 @@
         :free-text-decorations="freeTextDecorations ?? null"
         :filter-mode="filterMode"
         :values-time-range="valuesTimeRange ?? null"
+        :recent-queries="recentQueries ?? []"
         @update:query="handleQueryUpdate"
-        @user-edit="emit('user-edit')"
+        @user-edit="(isBlank: boolean, wasBlank: boolean) => emit('user-edit', isBlank, wasBlank)"
         @run-query="emit('run-query')"
         @focus="handleEditorFocus"
         @blur="handleEditorBlur"
@@ -189,6 +190,7 @@ interface Props {
   freeTextDecorations?: { ranges: { start: number; end: number }[]; hover: I18nText } | null;
   filterMode?: boolean; // The query is a bare WHERE fragment (Logs without SQL mode)
   valuesTimeRange?: { startTime: number; endTime: number } | null; // Range field values are looked up in (microseconds)
+  recentQueries?: string[]; // The user's recent queries, offered as clock rows while typing
 
   // NL Mode (optional external control)
   nlpMode?: boolean; // External NLP mode control (undefined = internal control)
@@ -226,7 +228,7 @@ const props = withDefaults(defineProps<Props>(), {
 
 const emit = defineEmits<{
   "update:query": [query: string, origin?: QueryChangeOrigin];
-  "user-edit": [];
+  "user-edit": [isBlank: boolean, wasBlank: boolean];
   "language-change": [language: Language];
   "ask-ai": [naturalLanguage: string, language: Language];
   "run-query": [];
diff --git a/web/src/components/alerts/AddAlert.anomalyEdit.spec.ts b/web/src/components/alerts/AddAlert.anomalyEdit.spec.ts
index 5e3fcc8a95..f13380c0df 100644
--- a/web/src/components/alerts/AddAlert.anomalyEdit.spec.ts
+++ b/web/src/components/alerts/AddAlert.anomalyEdit.spec.ts
@@ -96,7 +96,6 @@ const stubs = {
   QueryConfig: true,
   AlertSettings: true,
   CompareWithPast: true,
-  Deduplication: true,
   Advanced: true,
   PreviewAlert: true,
   AlertSummary: true,
diff --git a/web/src/components/alerts/AddAlert.drafts.spec.ts b/web/src/components/alerts/AddAlert.drafts.spec.ts
index 5911d35523..457b949064 100644
--- a/web/src/components/alerts/AddAlert.drafts.spec.ts
+++ b/web/src/components/alerts/AddAlert.drafts.spec.ts
@@ -151,7 +151,6 @@ const stubs = {
   QueryConfig: true,
   AlertSettings: true,
   CompareWithPast: true,
-  Deduplication: true,
   Advanced: true,
   PreviewAlert: true,
   AlertSummary: true,
diff --git a/web/src/components/alerts/AddAlert.panelPrefill.spec.ts b/web/src/components/alerts/AddAlert.panelPrefill.spec.ts
index 298f020608..2cceeed60d 100644
--- a/web/src/components/alerts/AddAlert.panelPrefill.spec.ts
+++ b/web/src/components/alerts/AddAlert.panelPrefill.spec.ts
@@ -113,7 +113,6 @@ vi.mock("@/services/reodotdev_analytics", () => ({ useReo: () => ({ track: vi.fn
 const stubs = {
   AlertSettings: true,
   CompareWithPast: true,
-  Deduplication: true,
   Advanced: true,
   PanelSchemaRenderer: true,
   AlertSummary: true,
diff --git a/web/src/components/alerts/AddAlert.prefill.spec.ts b/web/src/components/alerts/AddAlert.prefill.spec.ts
index 3aef922cae..aea1f51a8e 100644
--- a/web/src/components/alerts/AddAlert.prefill.spec.ts
+++ b/web/src/components/alerts/AddAlert.prefill.spec.ts
@@ -132,7 +132,6 @@ vi.mock("@/services/reodotdev_analytics", () => ({ useReo: () => ({ track: vi.fn
 const stubs = {
   AlertSettings: true,
   CompareWithPast: true,
-  Deduplication: true,
   Advanced: true,
   PanelSchemaRenderer: true,
   AlertSummary: true,
diff --git a/web/src/components/alerts/AddAlert.schema.ts b/web/src/components/alerts/AddAlert.schema.ts
index 3b1750fa4a..df90217f86 100644
--- a/web/src/components/alerts/AddAlert.schema.ts
+++ b/web/src/components/alerts/AddAlert.schema.ts
@@ -16,7 +16,7 @@
 // AddAlert orchestrator schema.
 //
 // AddAlert owns the ONE <OForm> for the whole wizard. The step children
-// (QueryConfig, AlertSettings, Advanced, Deduplication) render as descendants
+// (QueryConfig, AlertSettings, Advanced) render as descendants
 // and bind their fields by nested `name=` into THIS form, so the schema below
 // must cover every nested path they bind. This file composes their exported
 // rules (single source of truth) and adds the topbar scalars:
@@ -55,7 +55,7 @@ export const ALERT_NAME_UNSUPPORTED_CHARS = /[:#?\s'"%&]+/;
 export const isBlank = (v: unknown): boolean =>
   v === undefined || v === null || (typeof v === "string" && v.trim() === "");
 
-// Step-B field schemas (Advanced / Deduplication / CompareWithPast wizard step
+// Step-B field schemas (Advanced / CompareWithPast wizard step
 // children). All optional/permissive. The step components bind these exact paths
 // by nested `name=` into THIS orchestrator form.
 
@@ -89,18 +89,6 @@ export const advancedShape = {
 export const createAdvancedSchema = () => z.looseObject({ ...advancedShape });
 export type AdvancedForm = z.infer<ReturnType<typeof createAdvancedSchema>>;
 
-/** Deduplication (scheduled-only). All fields optional. `enabled` is derived
- *  from `fingerprint_fields.length > 0` by the component; `time_window_minutes`
- *  is sanitized to number|undefined by the component — the raw form state may
- *  transiently hold a string, so the union keeps validation permissive (never
- *  rejects while typing). */
-export const deduplicationSchema = z.object({
-  enabled: z.boolean().optional(),
-  fingerprint_fields: z.array(z.string()).optional(),
-  time_window_minutes: z.union([z.number(), z.string(), z.undefined()]).optional(),
-});
-export type DeduplicationForm = z.infer<typeof deduplicationSchema>;
-
 /** Compare-with-past reference-window row. `offSet` is a relative-time string
  *  (e.g. "15m") edited by the bare CustomDateTimePicker. `uuid` is the row
  *  identity used as the v-for `:key` — correct here because the row is bound by
@@ -136,10 +124,9 @@ export const makeAddAlertSchema = (t: Translator) =>
       trigger_condition: z.looseObject({}).optional(),
       query_condition: z.looseObject({}).optional(),
       logGroupBy: z.array(z.string()).optional(),
-      // Step-B fields (Advanced / Deduplication tabs). Permissive pass-throughs,
+      // Step-B fields (Advanced tab). Permissive pass-throughs,
       // not validated — the superRefine below adds no issues for them.
       context_attributes: contextAttributesSchema.optional(),
-      deduplication: deduplicationSchema.optional(),
       template: z.string().optional(),
       description: z.string().optional(),
       row_template: z.string().optional(),
diff --git a/web/src/components/alerts/AddAlert.spec.ts b/web/src/components/alerts/AddAlert.spec.ts
index 03159d1af9..1d993b11be 100644
--- a/web/src/components/alerts/AddAlert.spec.ts
+++ b/web/src/components/alerts/AddAlert.spec.ts
@@ -135,7 +135,6 @@ const stubs = {
   QueryConfig: true,
   AlertSettings: true,
   CompareWithPast: true,
-  Deduplication: true,
   Advanced: true,
   PreviewAlert: true,
   AlertSummary: true,
@@ -680,6 +679,7 @@ describe("AddAlert (OForm owner)", () => {
           "notify_on_recovery",
           "recovery_destinations",
           "keep_firing_for",
+          "suppress_repeats",
         ].sort(),
       );
 
diff --git a/web/src/components/alerts/AddAlert.vue b/web/src/components/alerts/AddAlert.vue
index ee2655961c..b7a3cfb41d 100644
--- a/web/src/components/alerts/AddAlert.vue
+++ b/web/src/components/alerts/AddAlert.vue
@@ -417,15 +417,6 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                     @update:multiTimeRange="updateMultiTimeRange"
                   />
                 </div>
-
-                <!-- Deduplication (scheduled only) -->
-                <div v-if="formData.is_real_time === 'false'">
-                  <Deduplication
-                    :deduplication="formData.deduplication"
-                    :columns="filteredColumns"
-                    @update:deduplication="updateDeduplication"
-                  />
-                </div>
               </div>
 
               <div v-show="activeTab === 'anomaly-config'" data-tab-pane="anomaly-config">
@@ -650,7 +641,6 @@ import JsonEditor from "../common/JsonEditor.vue";
 import QueryConfig from "./steps/QueryConfig.vue";
 import AlertSettings from "./steps/AlertSettings.vue";
 import CompareWithPast from "./steps/CompareWithPast.vue";
-import Deduplication from "./steps/Deduplication.vue";
 import Advanced from "./steps/Advanced.vue";
 import InlineSelectFolderDropdown from "../common/sidebar/InlineSelectFolderDropdown.vue";
 import PreviewAlert from "./PreviewAlert.vue";
@@ -712,7 +702,6 @@ export default defineComponent({
     QueryConfig,
     AlertSettings,
     CompareWithPast,
-    Deduplication,
     Advanced,
     PreviewAlert,
     AlertSummary,
diff --git a/web/src/components/alerts/AlertHistory.ack.spec.ts b/web/src/components/alerts/AlertHistory.ack.spec.ts
index a9083dbc55..2f69c2d0f5 100644
--- a/web/src/components/alerts/AlertHistory.ack.spec.ts
+++ b/web/src/components/alerts/AlertHistory.ack.spec.ts
@@ -46,7 +46,6 @@ const run = {
   is_realtime: false,
   is_silenced: false,
   retries: 0,
-  dedup_enabled: false,
 };
 
 const hits = [
@@ -60,6 +59,7 @@ const hits = [
     ack_source: "slack",
   },
   { ...run, timestamp: 1_786_498_000_000_000, status: "firing" },
+  { ...run, timestamp: 1_786_497_000_000_000, status: "firing", repeat_suppressed: true },
 ];
 
 let wrapper: VueWrapper<any>;
@@ -95,9 +95,9 @@ describe("AlertHistory ack rows", () => {
 
   it("shows an ack-suppressed run as Acknowledged, with whose ack suppressed it", async () => {
     await mountHistory();
-    expect(rowsOf()).toHaveLength(3);
+    expect(rowsOf()).toHaveLength(4);
     expect(cell(0, "status").text()).toContain("Acknowledged");
-    expect(cell(0, "dedup").text()).toContain("suppressed by ack (bob)");
+    expect(cell(0, "suppression").text()).toContain("suppressed by ack (bob)");
   });
 
   it("gives an ack event its own row with who, how and no run fields", async () => {
@@ -105,12 +105,18 @@ describe("AlertHistory ack rows", () => {
     expect(cell(1, "status").text()).toContain("Ack event");
     expect(cell(1, "condition").text()).toContain("Acknowledged by bob@acme.io from Slack");
     expect(cell(1, "duration").text()).toBe("—");
-    expect(cell(1, "dedup").text()).toBe("—");
+    expect(cell(1, "suppression").text()).toBe("—");
   });
 
   it("leaves an ordinary run as it was", async () => {
     await mountHistory();
     expect(cell(2, "status").text()).toContain("Firing");
-    expect(cell(2, "dedup").text()).not.toContain("suppressed by ack");
+    expect(cell(2, "suppression").text()).not.toContain("suppressed by ack");
+    expect(cell(2, "suppression").text()).toBe("—");
+  });
+
+  it("marks a run whose notification was withheld as a repeat", async () => {
+    await mountHistory();
+    expect(cell(3, "suppression").text()).toContain("Suppressed as a repeat");
   });
 });
diff --git a/web/src/components/alerts/AlertHistory.vue b/web/src/components/alerts/AlertHistory.vue
index 66adcf29d3..8d56088880 100644
--- a/web/src/components/alerts/AlertHistory.vue
+++ b/web/src/components/alerts/AlertHistory.vue
@@ -247,7 +247,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             <template v-else>{{ row.retries }}</template>
           </template>
 
-          <template #cell-dedup="{ row }">
+          <template #cell-suppression="{ row }">
             <span v-if="isAckEventRow(row)" class="text-text-secondary">—</span>
             <OTruncatedText
               v-else-if="ackSuppressedBy(row)"
@@ -256,19 +256,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             >
               {{ t("alerts.ack.history.dedupSuppressed", { who: raw(ackSuppressedBy(row)) }) }}
             </OTruncatedText>
-            <span v-else-if="!row.dedup_enabled" class="text-text-secondary">-</span>
-            <div v-else-if="row.dedup_suppressed" class="text-status-error-text">
-              <OIcon name="block" size="sm">
-                <OTooltip>
-                  <template #content>
-                    {{ t("alerts.suppressedByDeduplication") }}
-                    <div v-if="row.dedup_count">
-                      {{ t("alerts.occurrence", { count: row.dedup_count }, row.dedup_count) }}
-                    </div>
-                  </template>
-                </OTooltip>
-              </OIcon>
-            </div>
+            <OTruncatedText
+              v-else-if="row.repeat_suppressed === true"
+              class="text-text-secondary text-xs"
+              data-test="alert-history-repeat-suppressed"
+            >
+              {{ t("alerts.suppressedAsRepeat") }}
+            </OTruncatedText>
             <div v-else-if="row.grouped" class="text-primary flex items-center justify-center">
               <OIcon name="group-work" size="md">
                 <OTooltip>
@@ -280,21 +274,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               </OIcon>
               <span class="ms-1 text-xs">×{{ row.group_size || 1 }}</span>
             </div>
-            <div v-else class="text-status-positive flex items-center justify-center">
-              <OIcon name="check-circle" size="md">
-                <OTooltip>
-                  <template #content>
-                    {{ t("alerts.notificationSent") }}
-                    <div v-if="row.dedup_count && row.dedup_count > 1">
-                      {{ row.dedup_count }} {{ t("alerts.occurrencesDeduplicated") }}
-                    </div>
-                  </template>
-                </OTooltip>
-              </OIcon>
-              <span v-if="row.dedup_count && row.dedup_count > 1" class="ms-1 text-xs">
-                ×{{ row.dedup_count }}
-              </span>
-            </div>
+            <span v-else class="text-text-secondary">—</span>
           </template>
 
           <template #cell-actions="{ row }">
@@ -777,11 +757,11 @@ const columns = ref<OTableColumnDef[]>([
     meta: { align: "right" },
   },
   {
-    id: "dedup",
-    header: t("alerts.dedup"),
+    id: "suppression",
+    header: t("alerts.suppression"),
     sortable: false,
-    size: 80,
-    maxSize: 80,
+    size: 112,
+    maxSize: 112,
     cell: " ",
     meta: { align: "left" },
   },
diff --git a/web/src/components/alerts/AlertInsights.spec.ts b/web/src/components/alerts/AlertInsights.spec.ts
index e03ee02b1f..32bd769d4e 100644
--- a/web/src/components/alerts/AlertInsights.spec.ts
+++ b/web/src/components/alerts/AlertInsights.spec.ts
@@ -107,7 +107,7 @@ async function mountComp(props: Record<string, any> = {}) {
         AlertInsightsContextMenu: {
           template: '<div data-test="context-menu-stub"></div>',
           props: ["x", "y", "value", "panelTitle", "panelId"],
-          emits: ["close", "filter", "configure-dedup", "edit-alert", "view-history"],
+          emits: ["close", "filter", "edit-alert", "view-history"],
         },
       },
     },
diff --git a/web/src/components/alerts/AlertInsights.vue b/web/src/components/alerts/AlertInsights.vue
index 34394eb42a..3e37a05ef0 100644
--- a/web/src/components/alerts/AlertInsights.vue
+++ b/web/src/components/alerts/AlertInsights.vue
@@ -156,17 +156,6 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <strong>{{ selectedAlertForAction }}</strong></span
       >
 
-      <OButton
-        variant="ghost-primary"
-        size="sm"
-        @click="openDedupConfig"
-        data-test="configure-dedup-btn"
-        icon-left="settings"
-      >
-        {{ t("alerts.insights.actions.configureDedup") }}
-        <OTooltip :content="t('alerts.insights.actions.configureDedupTooltip')" />
-      </OButton>
-
       <OButton
         variant="ghost-primary"
         size="sm"
@@ -245,7 +234,6 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :panel-id="contextMenu.panelId"
       @close="contextMenu.show = false"
       @filter="handleContextMenuFilter"
-      @configure-dedup="handleConfigureDedup"
       @edit-alert="handleEditAlert"
       @view-history="handleViewHistory"
     />
@@ -593,42 +581,6 @@ const handleContextMenuFilter = (filter: any) => {
   refreshDashboard();
 };
 
-const handleConfigureDedup = async (alertName: string) => {
-  try {
-    // Use cached alerts list
-    const alert = alertsList.value.find((a: any) => a.name === alertName);
-
-    if (!alert) {
-      toast({
-        variant: "error",
-        message: t("toastMessages.alerts.alertNotFoundInAlerts", {
-          name: alertName,
-          count: alertsList.value.length,
-        }),
-      });
-      return;
-    }
-
-    // Navigate to alert edit page with dedup section
-    await router.push({
-      name: "alertList",
-      query: {
-        action: "update",
-        alert_id: alert.alert_id, // Use alert_id instead of id
-        name: alert.name,
-        org_identifier: store.state.selectedOrganization.identifier,
-        folder: alert.folder_id || "default",
-        section: "dedup",
-      },
-    });
-  } catch (error) {
-    toast({
-      variant: "error",
-      message: t("toastMessages.alerts.failedToNavigateToAlert"),
-    });
-  }
-};
-
 const handleEditAlert = async (alertName: string) => {
   try {
     // Use cached alerts list
@@ -678,22 +630,6 @@ const formatFilterValue = (value: number): string => {
 };
 
 // Action button methods
-const openDedupConfig = () => {
-  // `caption` predates OToast and is not rendered; cast keeps the object untouched.
-  toast({
-    variant: "info",
-    message: t("toastMessages.alerts.openingDedupConfig", { name: selectedAlertForAction.value }),
-    caption: "This would navigate to alert edit page with dedup section focused",
-  } as unknown as ToastOptions);
-
-  // TODO: Navigate to alert edit page with dedup section
-  // router.push({
-  //   name: 'alertEdit',
-  //   params: { alertName: selectedAlertForAction.value },
-  //   query: { section: 'dedup' }
-  // });
-};
-
 const editAlert = () => {
   toast({
     variant: "info",
diff --git a/web/src/components/alerts/AlertInsightsContextMenu.spec.ts b/web/src/components/alerts/AlertInsightsContextMenu.spec.ts
index 773a646a6c..e646adf4e9 100644
--- a/web/src/components/alerts/AlertInsightsContextMenu.spec.ts
+++ b/web/src/components/alerts/AlertInsightsContextMenu.spec.ts
@@ -58,7 +58,6 @@ describe("AlertInsightsContextMenu - rendering", () => {
 
   it("shows alert-specific menu items when isAlertNameContext=true", async () => {
     const w = await mountComp({ value: "my-alert", panelId: alertNamePanelId });
-    expect(w.find('[data-test="context-menu-configure-dedup"]').exists()).toBe(true);
     expect(w.find('[data-test="context-menu-edit-alert"]').exists()).toBe(true);
     expect(w.find('[data-test="context-menu-view-history"]').exists()).toBe(true);
     expect(w.find('[data-test="context-menu-cancel"]').exists()).toBe(true);
@@ -103,14 +102,6 @@ describe("AlertInsightsContextMenu - isAlertNameContext computed", () => {
 });
 
 describe("AlertInsightsContextMenu - action clicks", () => {
-  it("clicking configure-dedup emits configure-dedup and close", async () => {
-    const w = await mountComp({ value: "my-alert", panelId: alertNamePanelId });
-    await w.find('[data-test="context-menu-configure-dedup"]').trigger("click");
-    expect(w.emitted("configure-dedup")).toBeTruthy();
-    expect(w.emitted("configure-dedup")![0]).toEqual(["my-alert"]);
-    expect(w.emitted("close")).toBeTruthy();
-  });
-
   it("clicking edit-alert emits edit-alert and close", async () => {
     const w = await mountComp({ value: "my-alert", panelId: alertNamePanelId });
     await w.find('[data-test="context-menu-edit-alert"]').trigger("click");
diff --git a/web/src/components/alerts/AlertInsightsContextMenu.vue b/web/src/components/alerts/AlertInsightsContextMenu.vue
index 8fc4c2a6ce..58bf1247e2 100644
--- a/web/src/components/alerts/AlertInsightsContextMenu.vue
+++ b/web/src/components/alerts/AlertInsightsContextMenu.vue
@@ -29,14 +29,6 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <!-- Alert-specific actions (shown for Dedup and similar panels) -->
     <template v-if="isAlertNameContext">
       <div class="menu-section px-0 py-1">
-        <div
-          class="menu-item hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm [transition:background-color_0.2s]"
-          @click="configureDedupForAlert"
-          data-test="context-menu-configure-dedup"
-        >
-          <OIcon name="tune" size="sm" class="me-2" />
-          <span>{{ t("alerts.insights.actions.configureDedup") }}</span>
-        </div>
         <div
           class="menu-item hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm [transition:background-color_0.2s]"
           @click="editAlert"
@@ -96,7 +88,6 @@ const emit = defineEmits<{
     },
   ];
   "select-alert": [string];
-  "configure-dedup": [string];
   "edit-alert": [string];
   "view-history": [string];
 }>();
@@ -115,13 +106,6 @@ const isAlertNameContext = computed(() => {
   return typeof props.value === "string" && alertNamePanels.includes(props.panelId);
 });
 
-const configureDedupForAlert = () => {
-  if (typeof props.value === "string") {
-    emit("configure-dedup", props.value);
-    emit("close");
-  }
-};
-
 const editAlert = () => {
   if (typeof props.value === "string") {
     emit("edit-alert", props.value);
diff --git a/web/src/components/alerts/AlertList.editorDrafts.spec.ts b/web/src/components/alerts/AlertList.editorDrafts.spec.ts
index c817a86aa2..6c6d9cc804 100644
--- a/web/src/components/alerts/AlertList.editorDrafts.spec.ts
+++ b/web/src/components/alerts/AlertList.editorDrafts.spec.ts
@@ -145,7 +145,6 @@ const stubs = {
   QueryConfig: true,
   AlertSettings: true,
   CompareWithPast: true,
-  Deduplication: true,
   Advanced: true,
   PreviewAlert: true,
   AlertSummary: true,
diff --git a/web/src/components/alerts/DedupSummaryCards.spec.ts b/web/src/components/alerts/DedupSummaryCards.spec.ts
deleted file mode 100644
index 2e6c4f7f48..0000000000
--- a/web/src/components/alerts/DedupSummaryCards.spec.ts
+++ /dev/null
@@ -1,306 +0,0 @@
-// Copyright 2026 OpenObserve Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import { mount, flushPromises, VueWrapper } from "@vue/test-utils";
-import DedupSummaryCards from "./DedupSummaryCards.vue";
-import { createStore } from "vuex";
-import alertsService from "@/services/alerts";
-
-// ---------------------------------------------------------------------------
-// Factories
-// ---------------------------------------------------------------------------
-
-function makeStore(orgId = "test-org") {
-  return createStore({
-    state: { selectedOrganization: { identifier: orgId } },
-  });
-}
-
-function makeSummary(overrides: Record<string, any> = {}) {
-  return {
-    total_alerts: 100,
-    alerts_with_dedup: 50,
-    suppressions_total: 30,
-    passed_total: 20,
-    suppression_rate: 0.6,
-    pending_batches: 5,
-    timestamp: Date.now(),
-    ...overrides,
-  };
-}
-
-async function mountComp(summary = makeSummary(), orgId = "test-org") {
-  const store = makeStore(orgId);
-  vi.spyOn(alertsService, "get_dedup_summary").mockResolvedValue({ data: summary });
-  const w = mount(DedupSummaryCards, { global: { plugins: [store] } });
-  await flushPromises();
-  return w;
-}
-
-function byTestId(wrapper: VueWrapper, id: string) {
-  return wrapper.find(`[data-test="${id}"]`);
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe("DedupSummaryCards", () => {
-  let wrapper: VueWrapper;
-
-  beforeEach(() => vi.clearAllMocks());
-  afterEach(() => {
-    wrapper?.unmount();
-    vi.restoreAllMocks();
-  });
-
-  describe("renders with minimum props", () => {
-    it("renders the root container", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "dedup-summary-cards").exists()).toBe(true);
-    });
-
-    it("renders all four cards", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "total-alerts-card").exists()).toBe(true);
-      expect(byTestId(wrapper, "alerts-with-dedup-card").exists()).toBe(true);
-      expect(byTestId(wrapper, "suppression-rate-card").exists()).toBe(true);
-      expect(byTestId(wrapper, "pending-batches-card").exists()).toBe(true);
-    });
-  });
-
-  describe("Card 1 – Total Alerts", () => {
-    it("displays the total_alerts value", async () => {
-      wrapper = await mountComp(makeSummary({ total_alerts: 150 }));
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("150");
-    });
-
-    it("displays label text", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "total-alerts-label").text()).toBe("Total Alerts");
-    });
-
-    it("shows 0 when no alerts", async () => {
-      wrapper = await mountComp(makeSummary({ total_alerts: 0 }));
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("0");
-    });
-
-    it("shows large numbers correctly", async () => {
-      wrapper = await mountComp(makeSummary({ total_alerts: 99999 }));
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("99999");
-    });
-  });
-
-  describe("Card 2 – Alerts with Dedup", () => {
-    it("displays the alerts_with_dedup value", async () => {
-      wrapper = await mountComp(makeSummary({ alerts_with_dedup: 75 }));
-      expect(byTestId(wrapper, "alerts-with-dedup-value").text()).toBe("75");
-    });
-
-    it("displays label text", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "alerts-with-dedup-label").text()).toContain("Using Deduplication");
-    });
-
-    it("renders the filter-alt icon", async () => {
-      wrapper = await mountComp();
-      const icon = byTestId(wrapper, "dedup-filter-icon");
-      expect(icon.exists()).toBe(true);
-    });
-
-    it("renders the info icon for tooltip", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "dedup-info-icon").exists()).toBe(true);
-    });
-  });
-
-  describe("Card 3 – Suppression Rate", () => {
-    it("formats suppression rate as percentage", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0.75 }));
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("75.0%");
-    });
-
-    it("shows 0% when rate is zero", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0 }));
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("0%");
-    });
-
-    it("rounds to one decimal place", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0.456 }));
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("45.6%");
-    });
-
-    it("renders suppression rate card when rate > 0.5", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0.8 }));
-      expect(byTestId(wrapper, "suppression-rate-card").exists()).toBe(true);
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("80.0%");
-    });
-
-    it("renders suppression rate card when 0 < rate <= 0.5", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0.3 }));
-      expect(byTestId(wrapper, "suppression-rate-card").exists()).toBe(true);
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("30.0%");
-    });
-
-    it("renders suppression rate card when rate is 0", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0 }));
-      expect(byTestId(wrapper, "suppression-rate-card").exists()).toBe(true);
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("0%");
-    });
-
-    it("boundary at exactly 0.5 shows 50%", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0.5 }));
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("50.0%");
-    });
-
-    it("displays label text", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "suppression-rate-label").text()).toContain(
-        "Suppression Rate (24h)",
-      );
-    });
-
-    it("renders the info icon for tooltip", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "suppression-info-icon").exists()).toBe(true);
-    });
-  });
-
-  describe("Card 4 – Pending Batches", () => {
-    it("displays pending_batches value", async () => {
-      wrapper = await mountComp(makeSummary({ pending_batches: 12 }));
-      expect(byTestId(wrapper, "pending-batches-value").text()).toBe("12");
-    });
-
-    it("displays label text", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "pending-batches-label").text()).toContain("Pending Batches");
-    });
-
-    it("renders the group-work icon", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "pending-batches-icon").exists()).toBe(true);
-    });
-
-    it("renders the info icon for tooltip", async () => {
-      wrapper = await mountComp();
-      expect(byTestId(wrapper, "pending-batches-info-icon").exists()).toBe(true);
-    });
-
-    it("shows 0 when no pending batches", async () => {
-      wrapper = await mountComp(makeSummary({ pending_batches: 0 }));
-      expect(byTestId(wrapper, "pending-batches-value").text()).toBe("0");
-    });
-  });
-
-  describe("data fetching", () => {
-    it("calls get_dedup_summary on mount with correct orgId", async () => {
-      const spy = vi.spyOn(alertsService, "get_dedup_summary");
-      wrapper = await mountComp(makeSummary(), "my-org");
-      expect(spy).toHaveBeenCalledWith("my-org");
-    });
-
-    it("updates cards after fetch", async () => {
-      wrapper = await mountComp(makeSummary({ total_alerts: 200, suppression_rate: 0.85 }));
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("200");
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("85.0%");
-    });
-
-    it("keeps initial zero values on fetch error", async () => {
-      vi.clearAllMocks();
-      vi.spyOn(alertsService, "get_dedup_summary").mockRejectedValue(new Error("Network error"));
-      const store = makeStore("test-org");
-      wrapper = mount(DedupSummaryCards, { global: { plugins: [store] } });
-      await flushPromises();
-      expect(wrapper.exists()).toBe(true);
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("0");
-    });
-
-    it("handles null data response gracefully", async () => {
-      vi.clearAllMocks();
-      vi.spyOn(alertsService, "get_dedup_summary").mockResolvedValue({ data: null });
-      const store = makeStore("test-org");
-      wrapper = mount(DedupSummaryCards, { global: { plugins: [store] } });
-      await flushPromises();
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("0");
-    });
-  });
-
-  describe("exposed fetchSummary method", () => {
-    it("is callable from parent", async () => {
-      wrapper = await mountComp();
-      expect(typeof wrapper.vm.fetchSummary).toBe("function");
-    });
-
-    it("re-fetches and updates values when called", async () => {
-      wrapper = await mountComp(makeSummary({ total_alerts: 100 }));
-      vi.spyOn(alertsService, "get_dedup_summary").mockResolvedValue({
-        data: makeSummary({ total_alerts: 150 }),
-      });
-      await wrapper.vm.fetchSummary();
-      await flushPromises();
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("150");
-    });
-  });
-
-  describe("formatPercentage edge cases", () => {
-    it("formats 1.0 as 100.0%", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 1.0 }));
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("100.0%");
-    });
-
-    it("formats small rates correctly", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0.001 }));
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("0.1%");
-    });
-  });
-
-  describe("edge cases", () => {
-    it("handles all-zero values", async () => {
-      wrapper = await mountComp(
-        makeSummary({
-          total_alerts: 0,
-          alerts_with_dedup: 0,
-          suppression_rate: 0,
-          pending_batches: 0,
-        }),
-      );
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("0");
-      expect(byTestId(wrapper, "alerts-with-dedup-value").text()).toBe("0");
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("0%");
-      expect(byTestId(wrapper, "pending-batches-value").text()).toBe("0");
-    });
-
-    it("handles very large numbers", async () => {
-      wrapper = await mountComp(makeSummary({ total_alerts: 999999, pending_batches: 77777 }));
-      expect(byTestId(wrapper, "total-alerts-value").text()).toBe("999999");
-      expect(byTestId(wrapper, "pending-batches-value").text()).toBe("77777");
-    });
-
-    it("updates suppression rate when fetchSummary is called with new data", async () => {
-      wrapper = await mountComp(makeSummary({ suppression_rate: 0.4 }));
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("40.0%");
-
-      vi.spyOn(alertsService, "get_dedup_summary").mockResolvedValue({
-        data: makeSummary({ suppression_rate: 0.7 }),
-      });
-      await wrapper.vm.fetchSummary();
-      await flushPromises();
-
-      expect(byTestId(wrapper, "suppression-rate-value").text()).toBe("70.0%");
-    });
-  });
-});
diff --git a/web/src/components/alerts/DedupSummaryCards.vue b/web/src/components/alerts/DedupSummaryCards.vue
deleted file mode 100644
index 38ddbe28c4..0000000000
--- a/web/src/components/alerts/DedupSummaryCards.vue
+++ /dev/null
@@ -1,188 +0,0 @@
-<!-- Copyright 2026 OpenObserve Inc.
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
--->
-
-<template>
-  <div data-test="dedup-summary-cards" class="dedup-summary-cards mb-4 grid grid-cols-4 gap-4">
-    <!-- Card 1: Total Alerts -->
-    <OCard
-      data-test="total-alerts-card"
-      class="border-border-default border transition-all duration-200 hover:shadow-sm"
-    >
-      <OCardSection class="p-4">
-        <div data-test="total-alerts-value" class="text-2xl font-semibold">
-          {{ summary.total_alerts }}
-        </div>
-        <div data-test="total-alerts-label" class="text-text-secondary text-sm">
-          {{ t("alerts.totalAlerts") }}
-        </div>
-      </OCardSection>
-    </OCard>
-
-    <!-- Card 2: Alerts with Dedup -->
-    <OCard
-      data-test="alerts-with-dedup-card"
-      class="border-border-default border transition-all duration-200 hover:shadow-sm"
-    >
-      <OCardSection class="p-4">
-        <div class="flex items-center gap-2">
-          <div data-test="alerts-with-dedup-value" class="text-2xl font-semibold">
-            {{ summary.alerts_with_dedup }}
-          </div>
-          <OIcon data-test="dedup-filter-icon" name="filter-alt" size="sm" />
-        </div>
-        <div
-          data-test="alerts-with-dedup-label"
-          class="text-text-secondary flex items-center gap-1 text-sm"
-        >
-          {{ t("alerts.usingDeduplication") }}
-          <OIcon data-test="dedup-info-icon" name="info-outline" size="xs" class="cursor-pointer" />
-          <OTooltip :content="t('alerts.deduplicationConfiguredTooltip')" />
-        </div>
-      </OCardSection>
-    </OCard>
-
-    <!-- Card 3: Suppression Rate -->
-    <OCard
-      data-test="suppression-rate-card"
-      class="border-border-default border transition-all duration-200 hover:shadow-sm"
-      :class="{
-        'bg-status-success-bg': summary.suppression_rate > 0.5,
-        'bg-status-warning-bg': summary.suppression_rate > 0 && summary.suppression_rate <= 0.5,
-      }"
-    >
-      <OCardSection class="p-4">
-        <div
-          data-test="suppression-rate-value"
-          class="text-2xl font-semibold"
-          :class="{
-            'text-status-success-text': summary.suppression_rate > 0.5,
-            'text-status-warning-text':
-              summary.suppression_rate > 0 && summary.suppression_rate <= 0.5,
-          }"
-        >
-          {{ formatPercentage(summary.suppression_rate) }}
-        </div>
-        <div
-          data-test="suppression-rate-label"
-          class="text-text-secondary flex items-center gap-1 text-sm"
-        >
-          {{ t("alerts.suppressionRate24h") }}
-          <OIcon
-            data-test="suppression-info-icon"
-            name="info-outline"
-            size="xs"
-            class="cursor-pointer"
-          />
-          <OTooltip>
-            <template #content>
-              {{ summary.suppressions_total }} {{ t("alerts.suppressed") }}
-              {{ summary.suppressions_total + summary.passed_total }} {{ t("alerts.total") }}
-              <div class="mt-1">{{ t("alerts.passedLabel") }} {{ summary.passed_total }}</div>
-            </template>
-          </OTooltip>
-        </div>
-      </OCardSection>
-    </OCard>
-
-    <!-- Card 4: Pending Batches -->
-    <OCard
-      data-test="pending-batches-card"
-      class="border-border-default border transition-all duration-200 hover:shadow-sm"
-    >
-      <OCardSection class="p-4">
-        <div class="flex items-center gap-2">
-          <div data-test="pending-batches-value" class="text-2xl font-semibold">
-            {{ summary.pending_batches }}
-          </div>
-          <OIcon data-test="pending-batches-icon" name="group-work" size="sm" />
-        </div>
-        <div
-          data-test="pending-batches-label"
-          class="text-text-secondary flex items-center gap-1 text-sm"
-        >
-          {{ t("alerts.pendingBatches") }}
-          <OIcon
-            data-test="pending-batches-info-icon"
-            name="info-outline"
-            size="xs"
-            class="cursor-pointer"
-          />
-          <OTooltip :content="t('alerts.pendingBatchesTooltip')" />
-        </div>
-      </OCardSection>
-    </OCard>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { ref, onMounted } from "vue";
-import { useStore } from "vuex";
-import alertsService from "@/services/alerts";
-import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
-import OIcon from "@/lib/core/Icon/OIcon.vue";
-import OCard from "@/lib/core/Card/OCard.vue";
-import OCardSection from "@/lib/core/Card/OCardSection.vue";
-import { useI18nTyped } from "@/types/i18n";
-
-const { t } = useI18nTyped();
-const store = useStore();
-
-interface DedupSummary {
-  total_alerts: number;
-  alerts_with_dedup: number;
-  suppressions_total: number;
-  passed_total: number;
-  suppression_rate: number;
-  pending_batches: number;
-  timestamp: number;
-}
-
-const summary = ref<DedupSummary>({
-  total_alerts: 0,
-  alerts_with_dedup: 0,
-  suppressions_total: 0,
-  passed_total: 0,
-  suppression_rate: 0,
-  pending_batches: 0,
-  timestamp: 0,
-});
-
-onMounted(async () => {
-  await fetchSummary();
-});
-
-async function fetchSummary() {
-  try {
-    const orgId = store.state.selectedOrganization.identifier;
-    const response = await alertsService.get_dedup_summary(orgId);
-    if (response.data) {
-      summary.value = response.data;
-    }
-  } catch (error) {
-    console.error("Failed to fetch dedup summary:", error);
-  }
-}
-
-function formatPercentage(rate: number): string {
-  if (rate === 0) return "0%";
-  return `${(rate * 100).toFixed(1)}%`;
-}
-
-// Expose fetch method for parent to refresh
-defineExpose({
-  fetchSummary,
-});
-</script>
diff --git a/web/src/components/alerts/OrganizationDeduplicationSettings.schema.ts b/web/src/components/alerts/OrganizationDeduplicationSettings.schema.ts
deleted file mode 100644
index 8d142d516a..0000000000
--- a/web/src/components/alerts/OrganizationDeduplicationSettings.schema.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-// Copyright 2026 OpenObserve Inc.
-//
-// Validation schema for OrganizationDeduplicationSettings.vue — the inline
-// org-level alert deduplication settings form.
-//
-// Fields:
-//   • enabled / alert_dedup_enabled — booleans (OFormCheckbox).
-//   • alert_fingerprint_groups — the selected semantic-group ids, modelled as a
-//     string[] driven by an OFormCheckboxGroup (each per-group OCheckbox is a
-//     group member keyed by its id).
-//   • time_window_minutes — the correlation window. Permissive + nullable so a
-//     blank / cleared field still saves (as null); z.coerce.number() only
-//     validates that a typed value is numeric (the number <input> can emit a
-//     numeric string or ""). The @submit handler does the empty/NaN → null
-//     conversion, so the schema itself never blocks this field.
-//
-// superRefine rule: when org-level dedup AND cross-alert dedup are both on, at
-// least one fingerprint group must be selected.
-//
-// Validation TIMING is owned by OForm (submit-then-change via revalidateLogic);
-// this file only describes WHAT is valid.
-
-import { z } from "zod";
-
-/** The persisted org deduplication config shape (edit-prefill source). */
-export interface OrganizationDeduplicationConfig {
-  enabled: boolean;
-  alert_dedup_enabled?: boolean;
-  alert_fingerprint_groups?: string[];
-  time_window_minutes?: number | null;
-}
-
-export const makeOrgDedupSettingsSchema = (t: (_key: string) => string) =>
-  z
-    .object({
-      enabled: z.boolean(),
-      alert_dedup_enabled: z.boolean(),
-      alert_fingerprint_groups: z.array(z.string()).default([]),
-      // Permissive + nullable.
-      time_window_minutes: z.coerce.number().nullish(),
-    })
-    .superRefine((val, ctx) => {
-      if (
-        val.enabled &&
-        val.alert_dedup_enabled &&
-        (!val.alert_fingerprint_groups || val.alert_fingerprint_groups.length === 0)
-      ) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          path: ["alert_fingerprint_groups"],
-          message: t("alerts.correlation.fingerprintGroupsRequired"),
-        });
-      }
-    });
-
-export type OrgDedupSettingsForm = z.infer<ReturnType<typeof makeOrgDedupSettingsSchema>>;
-
-/**
- * Typed defaults, mapped from an optional persisted config. A null config yields
- * the create-time defaults (enabled on, everything else empty).
- */
-export const orgDedupSettingsDefaults = (
-  config?: OrganizationDeduplicationConfig | null,
-): OrgDedupSettingsForm => ({
-  enabled: config?.enabled ?? true,
-  alert_dedup_enabled: config?.alert_dedup_enabled ?? false,
-  alert_fingerprint_groups: config?.alert_fingerprint_groups ?? [],
-  time_window_minutes: config?.time_window_minutes ?? undefined,
-});
diff --git a/web/src/components/alerts/OrganizationDeduplicationSettings.spec.ts b/web/src/components/alerts/OrganizationDeduplicationSettings.spec.ts
deleted file mode 100644
index ea9120e2ee..0000000000
--- a/web/src/components/alerts/OrganizationDeduplicationSettings.spec.ts
+++ /dev/null
@@ -1,280 +0,0 @@
-// Copyright 2026 OpenObserve Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import { describe, expect, it, beforeEach, vi } from "vitest";
-import { mount, flushPromises } from "@vue/test-utils";
-import i18n from "@/locales";
-import store from "@/test/unit/helpers/store";
-
-vi.mock("@/services/alerts", async (importOriginal) => {
-  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
-  return overlayServiceMock(await importOriginal(), {
-    default: {
-      getOrganizationDeduplicationConfig: vi.fn().mockResolvedValue({
-        data: {
-          enabled: true,
-          alert_dedup_enabled: false,
-          alert_fingerprint_groups: [],
-          time_window_minutes: 30,
-        },
-      }),
-      setOrganizationDeduplicationConfig: vi.fn().mockResolvedValue({ data: {} }),
-      getSemanticGroups: vi.fn().mockResolvedValue({
-        data: [
-          { id: "group1", display: "Group 1", fields: ["host"], normalize: false },
-          { id: "group2", display: "Group 2", fields: ["service"], normalize: false },
-        ],
-      }),
-    },
-  });
-});
-
-import OrganizationDeduplicationSettings from "@/components/alerts/OrganizationDeduplicationSettings.vue";
-import alertsService from "@/services/alerts";
-
-async function mountComp(props: Record<string, any> = {}) {
-  return mount(OrganizationDeduplicationSettings, {
-    props: {
-      orgId: "default",
-      config: null,
-      ...props,
-    },
-    global: {
-      plugins: [i18n, store],
-      stubs: {
-        GroupHeader: {
-          template: '<div data-test="group-header-stub"></div>',
-          props: ["title", "showIcon"],
-        },
-      },
-    },
-  });
-}
-
-// The component OWNS its <OForm> (Rule ③ owner pattern) — the single source of
-// truth is the TanStack form on the OForm instance. Drive behavior through it.
-const getForm = (w: any) => (w.findComponent({ name: "OForm" }).vm as any).form;
-
-describe("OrganizationDeduplicationSettings - rendering", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("renders without errors", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    expect(w.exists()).toBe(true);
-  });
-
-  it("renders the enable checkbox", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    expect(w.find('[data-test="organization-deduplication-enable-checkbox"]').exists()).toBe(true);
-  });
-
-  it("renders the refresh button", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    expect(w.find('[data-test="dedup-settings-refresh-btn"]').exists()).toBe(true);
-  });
-
-  it("calls getOrganizationDeduplicationConfig on mount when config is null", async () => {
-    await mountComp();
-    await flushPromises();
-    expect(alertsService.getOrganizationDeduplicationConfig).toHaveBeenCalledWith("default");
-  });
-
-  it("calls getSemanticGroups on mount", async () => {
-    await mountComp();
-    await flushPromises();
-    expect(alertsService.getSemanticGroups).toHaveBeenCalledWith("default");
-  });
-
-  it("does not call service when config prop is provided", async () => {
-    vi.clearAllMocks();
-    const config = { enabled: true, alert_dedup_enabled: false, alert_fingerprint_groups: [] };
-    await mountComp({ config });
-    await flushPromises();
-    expect(alertsService.getOrganizationDeduplicationConfig).not.toHaveBeenCalled();
-  });
-});
-
-describe("OrganizationDeduplicationSettings - cross-alert checkbox visibility", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("shows cross-alert checkbox when enabled=true", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    getForm(w).setFieldValue("enabled", true);
-    await flushPromises();
-    expect(
-      w.find('[data-test="organizationdeduplication-enable-cross-alert-checkbox"]').exists(),
-    ).toBe(true);
-  });
-
-  it("hides cross-alert checkbox when enabled=false", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    getForm(w).setFieldValue("enabled", false);
-    await flushPromises();
-    expect(
-      w.find('[data-test="organizationdeduplication-enable-cross-alert-checkbox"]').exists(),
-    ).toBe(false);
-  });
-});
-
-describe("OrganizationDeduplicationSettings - save (real OForm submit)", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("calls setOrganizationDeduplicationConfig on a valid submit", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    await getForm(w).handleSubmit();
-    await flushPromises();
-    expect(alertsService.setOrganizationDeduplicationConfig).toHaveBeenCalledWith(
-      "default",
-      expect.any(Object),
-    );
-  });
-
-  it("emits saved after a successful save", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    await getForm(w).handleSubmit();
-    await flushPromises();
-    expect(w.emitted("saved")).toBeTruthy();
-  });
-
-  it("blocks save when cross-alert enabled but no fingerprint groups (superRefine restore)", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    const form = getForm(w);
-    form.setFieldValue("enabled", true);
-    form.setFieldValue("alert_dedup_enabled", true);
-    form.setFieldValue("alert_fingerprint_groups", []);
-    await flushPromises();
-    await form.handleSubmit();
-    await flushPromises();
-    expect(form.state.isValid).toBe(false);
-    expect(alertsService.setOrganizationDeduplicationConfig).not.toHaveBeenCalled();
-  });
-
-  it("allows save when cross-alert enabled and fingerprint groups set", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    const form = getForm(w);
-    form.setFieldValue("enabled", true);
-    form.setFieldValue("alert_dedup_enabled", true);
-    form.setFieldValue("alert_fingerprint_groups", ["group1"]);
-    await flushPromises();
-    await form.handleSubmit();
-    await flushPromises();
-    expect(alertsService.setOrganizationDeduplicationConfig).toHaveBeenCalled();
-  });
-});
-
-describe("OrganizationDeduplicationSettings - cancel", () => {
-  it("emits cancel when cancel is triggered", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    await w.vm.$emit("cancel");
-    expect(w.emitted("cancel")).toBeTruthy();
-  });
-});
-
-describe("OrganizationDeduplicationSettings - fingerprint groups", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("renders a checkbox per semantic group when cross-alert dedup is on", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    getForm(w).setFieldValue("alert_dedup_enabled", true);
-    await flushPromises();
-    expect(
-      w.find('[data-test="organizationdeduplication-fingerprint-group1-checkbox"]').exists(),
-    ).toBe(true);
-    expect(
-      w.find('[data-test="organizationdeduplication-fingerprint-group2-checkbox"]').exists(),
-    ).toBe(true);
-  });
-});
-
-describe("OrganizationDeduplicationSettings - external prop sync", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("resets the form from the config prop when it changes", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    await w.setProps({
-      config: {
-        enabled: false,
-        alert_dedup_enabled: true,
-        alert_fingerprint_groups: ["group1"],
-        time_window_minutes: 60,
-      },
-    });
-    await flushPromises();
-    const form = getForm(w);
-    expect(form.state.values.enabled).toBe(false);
-    expect(form.state.values.time_window_minutes).toBe(60);
-  });
-});
-
-describe("OrganizationDeduplicationSettings - time_window sanitization (payload parity)", () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it("submits a zero window without native bounds blocking the schema", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    const input = w.find('[data-test="organizationdeduplication-default-window-input"] input');
-    await input.setValue("0");
-    await flushPromises();
-    expect((input.element as HTMLInputElement).checkValidity()).toBe(true);
-    (w.find("form").element as HTMLFormElement).requestSubmit();
-    await vi.waitFor(() =>
-      expect(alertsService.setOrganizationDeduplicationConfig).toHaveBeenCalled(),
-    );
-    expect(getForm(w).state.isValid).toBe(true);
-    expect(alertsService.setOrganizationDeduplicationConfig).toHaveBeenCalledWith("default", {
-      enabled: true,
-      alert_dedup_enabled: false,
-      alert_fingerprint_groups: [],
-      time_window_minutes: 0,
-    });
-    w.unmount();
-  });
-
-  it("saves null when time_window_minutes is empty", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    const form = getForm(w);
-    form.setFieldValue("time_window_minutes", "");
-    await flushPromises();
-    await form.handleSubmit();
-    await flushPromises();
-    const callArg = (alertsService.setOrganizationDeduplicationConfig as any).mock.calls[0][1];
-    expect(callArg.time_window_minutes).toBeNull();
-  });
-
-  it("saves the number when time_window_minutes is valid", async () => {
-    const w = await mountComp();
-    await flushPromises();
-    const form = getForm(w);
-    form.setFieldValue("time_window_minutes", 45);
-    await flushPromises();
-    await form.handleSubmit();
-    await flushPromises();
-    const callArg = (alertsService.setOrganizationDeduplicationConfig as any).mock.calls[0][1];
-    expect(callArg.time_window_minutes).toBe(45);
-  });
-});
diff --git a/web/src/components/alerts/OrganizationDeduplicationSettings.vue b/web/src/components/alerts/OrganizationDeduplicationSettings.vue
deleted file mode 100644
index 0e8539c879..0000000000
--- a/web/src/components/alerts/OrganizationDeduplicationSettings.vue
+++ /dev/null
@@ -1,292 +0,0 @@
-<!-- Copyright 2026 OpenObserve Inc.
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
--->
-
-<template>
-  <!-- Inline form: OForm renders the <form>, so the footer Save uses
-       type="submit" (Enter submits natively — no form-id needed). The component
-       OWNS the form (it reads `enabled`/`alert_dedup_enabled` to drive the
-       conditional sections) → Rule ③ owner pattern: useOForm + form.useStore +
-       <OForm :form>. -->
-  <OForm
-    id="organization-deduplication-settings-form"
-    :form="form"
-    v-slot="{ isSubmitting }"
-    class="bg-card-glass-bg flex h-full w-full flex-col"
-  >
-    <!-- Scrollable content area -->
-    <div class="flex-1 overflow-y-auto pe-2 pt-4">
-      <div class="mb-4">
-        <div class="text-text-heading text-sm leading-tight font-semibold">
-          {{ t("alerts.correlation.title") }}
-        </div>
-        <div class="text-text-secondary mt-1 text-xs">
-          {{ t("alerts.correlation.description") }}
-        </div>
-        <div class="text-text-secondary mt-1 text-xs italic">
-          {{ t("alerts.correlation.semanticFieldNote") }}
-        </div>
-      </div>
-
-      <OButton
-        data-test="dedup-settings-refresh-btn"
-        variant="outline"
-        size="sm"
-        class="mb-6"
-        @click="loadConfig"
-        >{{ t("common.refresh") }}</OButton
-      >
-
-      <!-- Enable Deduplication -->
-      <div class="mb-6">
-        <OFormCheckbox
-          name="enabled"
-          data-test="organization-deduplication-enable-checkbox"
-          :label="t('alerts.correlation.enableOrgLevel')"
-        >
-          <OTooltip :content="t('alerts.correlation.enableOrgLevelTooltip')" />
-        </OFormCheckbox>
-      </div>
-
-      <!-- Cross-Alert Deduplication -->
-      <div class="mb-6" v-if="enabled">
-        <OFormCheckbox
-          name="alert_dedup_enabled"
-          data-test="organizationdeduplication-enable-cross-alert-checkbox"
-          :label="t('alerts.correlation.enableCrossAlert')"
-        >
-          <OTooltip :content="t('alerts.correlation.enableCrossAlertTooltip')" />
-        </OFormCheckbox>
-      </div>
-
-      <!-- Cross-Alert Fingerprint Groups -->
-      <div class="mb-6" v-if="enabled && alertDedupEnabled">
-        <div class="flex items-center pb-2 font-semibold">
-          {{ t("alerts.correlation.fingerprintGroups") }}
-          <span class="text-status-error-text ms-1">*</span>
-          <OIcon name="info" size="sm" class="ms-1 cursor-pointer" :class="'text-text-secondary'">
-            <OTooltip
-              side="right"
-              align="center"
-              :content="t('alerts.correlation.fingerprintGroupsTooltip')"
-            />
-          </OIcon>
-        </div>
-        <div class="text-text-secondary mb-2 text-sm">
-          {{ t("alerts.correlation.fingerprintGroupsHint") }}
-        </div>
-        <!-- The selected group ids ARE the form's alert_fingerprint_groups
-             array. Each per-group OCheckbox is a group member (value = id); the
-             group's superRefine "at least one required" error renders below. -->
-        <OFormCheckboxGroup name="alert_fingerprint_groups">
-          <OCheckbox
-            v-for="group in localSemanticGroups"
-            :data-test="'organizationdeduplication-fingerprint-' + group.id + '-checkbox'"
-            :key="group.id"
-            :value="group.id"
-            :label="raw(`${group.display} (${group.id})`)"
-          />
-        </OFormCheckboxGroup>
-      </div>
-
-      <!-- Time Window -->
-      <div class="mb-6">
-        <div class="flex items-center pb-2 font-semibold">
-          {{ t("alerts.correlation.defaultWindow") }}
-          <OIcon name="info" size="sm" class="ms-1 cursor-pointer" :class="'text-text-secondary'" />
-          <OTooltip
-            side="right"
-            align="center"
-            :content="t('alerts.correlation.defaultWindowTooltip')"
-          />
-        </div>
-        <div class="text-text-secondary mb-2 text-sm">
-          {{ t("alerts.correlation.defaultWindowDescription") }}
-        </div>
-        <OFormInput
-          name="time_window_minutes"
-          data-test="organizationdeduplication-default-window-input"
-          type="number"
-          min="1"
-          width="md"
-          :placeholder="t('alerts.correlation.defaultWindowPlaceholder')"
-        />
-      </div>
-    </div>
-
-    <!-- Sticky footer with buttons -->
-    <div
-      class="border-border-default sticky bottom-0 flex justify-end gap-3 border-t bg-inherit pt-4 pb-2"
-    >
-      <OButton
-        variant="outline"
-        size="sm-action"
-        :disabled="isSubmitting"
-        @click="$emit('cancel')"
-        >{{ t("alerts.correlation.cancelButton") }}</OButton
-      >
-      <OButton variant="primary" size="sm-action" type="submit" :loading="isSubmitting">{{
-        t("alerts.correlation.saveButton")
-      }}</OButton>
-    </div>
-  </OForm>
-</template>
-
-<script setup lang="ts">
-import { ref, watch } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
-import alertsService from "@/services/alerts";
-import OButton from "@/lib/core/Button/OButton.vue";
-import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
-import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
-import OIcon from "@/lib/core/Icon/OIcon.vue";
-import { toast } from "@/lib/feedback/Toast/useToast";
-import OForm from "@/lib/forms/Form/OForm.vue";
-import OFormCheckbox from "@/lib/forms/Checkbox/OFormCheckbox.vue";
-import OFormCheckboxGroup from "@/lib/forms/Checkbox/OFormCheckboxGroup.vue";
-import OFormInput from "@/lib/forms/Input/OFormInput.vue";
-import { useOForm } from "@/lib/forms/Form/useOForm";
-import {
-  makeOrgDedupSettingsSchema,
-  orgDedupSettingsDefaults,
-  type OrgDedupSettingsForm,
-} from "./OrganizationDeduplicationSettings.schema";
-
-const { t } = useI18nTyped();
-
-interface FieldAlias {
-  id: string;
-  display: string;
-  group?: string;
-  fields: string[];
-  normalize: boolean;
-  is_stable?: boolean;
-}
-
-interface OrganizationDeduplicationConfig {
-  enabled: boolean;
-  alert_dedup_enabled?: boolean;
-  alert_fingerprint_groups?: string[];
-  time_window_minutes?: number | null;
-}
-
-interface Props {
-  orgId: string;
-  config?: OrganizationDeduplicationConfig | null;
-}
-
-const props = withDefaults(defineProps<Props>(), {
-  config: null,
-});
-
-const emit = defineEmits<{
-  (e: "saved"): void;
-  (e: "cancel"): void;
-}>();
-
-// Owner pattern (Rule ③): create the ONE form here so the template can read it
-// reactively (form.useStore) to drive the conditional sections. Loading is
-// form-driven (isSubmitting) — no manual `saving` ref.
-const orgDedupSettingsSchema = makeOrgDedupSettingsSchema(t);
-const form = useOForm<OrgDedupSettingsForm>({
-  defaultValues: orgDedupSettingsDefaults(props.config),
-  schema: orgDedupSettingsSchema,
-  // Forward to saveSettings (defined below) — arrow avoids a setup-time TDZ ref.
-  onSubmit: (value) => saveSettings(value),
-});
-
-// Reactive reads for the parent-side v-if sections (single source of truth).
-const enabled = form.useStore((s: any) => s.values.enabled);
-const alertDedupEnabled = form.useStore((s: any) => s.values.alert_dedup_enabled);
-
-// Available semantic groups (the option list rendered as checkboxes) — NOT form
-// data, so it stays a plain local ref.
-const localSemanticGroups = ref<FieldAlias[]>([]);
-
-const saveSettings = async (value: OrgDedupSettingsForm) => {
-  // @submit fires only when the schema passes, so the cross-alert fingerprint
-  // guard is already enforced (superRefine) — no imperative toast-guard here.
-  try {
-    // Payload parity: build with explicit keys (no {...value} leak) and coerce
-    // time_window_minutes exactly like the pre-migration form (empty/NaN → null,
-    // else a number).
-    const rawWindow = value.time_window_minutes as unknown;
-    const payload = {
-      enabled: value.enabled,
-      alert_dedup_enabled: value.alert_dedup_enabled,
-      alert_fingerprint_groups: value.alert_fingerprint_groups,
-      time_window_minutes:
-        rawWindow == null || rawWindow === "" || isNaN(Number(rawWindow))
-          ? null
-          : Number(rawWindow),
-    };
-    await alertsService.setOrganizationDeduplicationConfig(props.orgId, payload);
-
-    toast({
-      variant: "success",
-      message: t("alerts.correlation.settingsSaved"),
-    });
-
-    emit("saved");
-  } catch (error: any) {
-    console.error("Error saving deduplication settings:", error);
-    toast({
-      variant: "error",
-      message: error?.message || t("alerts.correlation.settingsSaveError"),
-    });
-  }
-};
-
-// Fetch config on mount if not provided. Async data arrives → form.reset() (not
-// a setFieldValue loop / local mirror). Also wired to the refresh button (its
-// exact behavior is preserved; being type="button" it never submits/validates).
-const loadConfig = async () => {
-  if (!props.config) {
-    try {
-      // Load dedup config (does NOT contain semantic groups)
-      const response = await alertsService.getOrganizationDeduplicationConfig(props.orgId);
-      form.reset(orgDedupSettingsDefaults(response.data));
-    } catch (error) {
-      // No dedup config exists yet — use defaults
-      form.reset(orgDedupSettingsDefaults(null));
-    }
-
-    // Always load semantic groups from system_settings (single source of truth)
-    try {
-      const semanticGroupsResponse = await alertsService.getSemanticGroups(props.orgId);
-      localSemanticGroups.value = semanticGroupsResponse.data;
-    } catch (semanticError) {
-      console.error("Failed to load semantic groups:", semanticError);
-      localSemanticGroups.value = [];
-    }
-  }
-};
-
-// Load config on mount
-loadConfig();
-
-// Watch for external changes — reset the form from the EXTERNAL source (props),
-// not a local mirror. Initial values are already seeded via useOForm's
-// defaultValues, so this only handles subsequent prop changes.
-watch(
-  () => props.config,
-  (newVal) => {
-    if (newVal) {
-      form.reset(orgDedupSettingsDefaults(newVal));
-    }
-  },
-  { deep: true },
-);
-</script>
diff --git a/web/src/components/alerts/steps/AlertSettings.schema.ts b/web/src/components/alerts/steps/AlertSettings.schema.ts
index 813892651a..c54e3e6f13 100644
--- a/web/src/components/alerts/steps/AlertSettings.schema.ts
+++ b/web/src/components/alerts/steps/AlertSettings.schema.ts
@@ -97,6 +97,9 @@ export const alertSettingsCreatesIncidentSchema = z.boolean().optional();
 
 export const alertSettingsNotifyOnRecoverySchema = z.boolean().optional();
 
+/** suppress_repeats: optional. Enterprise only; on = notify once per state change. */
+export const alertSettingsSuppressRepeatsSchema = z.boolean().optional();
+
 /** recovery_destinations: optional. Empty = the recovery follows the firing's destinations. */
 export const alertSettingsRecoveryDestinationsSchema = z.array(z.string()).optional();
 
@@ -127,6 +130,7 @@ export const makeAlertSettingsShape = (t: Translator) =>
     notify_on_recovery: alertSettingsNotifyOnRecoverySchema,
     recovery_destinations: alertSettingsRecoveryDestinationsSchema,
     keep_firing_for: makeKeepFiringForSchema(t),
+    suppress_repeats: alertSettingsSuppressRepeatsSchema,
   }) as const;
 
 // ── Mode-conditional composite ──────────────────────────────────────────────
@@ -151,6 +155,7 @@ export const createAlertSettingsSchema = (t: Translator, isRealTime: boolean) =>
     notify_on_recovery: alertSettingsNotifyOnRecoverySchema,
     recovery_destinations: alertSettingsRecoveryDestinationsSchema,
     keep_firing_for: makeKeepFiringForSchema(t),
+    suppress_repeats: alertSettingsSuppressRepeatsSchema,
   });
 
 export type AlertSettingsForm = z.infer<ReturnType<typeof createAlertSettingsSchema>>;
diff --git a/web/src/components/alerts/steps/AlertSettings.vue b/web/src/components/alerts/steps/AlertSettings.vue
index dcca96197c..c3bf2b642d 100644
--- a/web/src/components/alerts/steps/AlertSettings.vue
+++ b/web/src/components/alerts/steps/AlertSettings.vue
@@ -405,6 +405,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               </div>
             </div>
           </div>
+
+          <div v-if="repeatSuppressionAvailable" class="mb-4! flex items-start max-md:gap-3">
+            <div class="text-text-heading flex h-7 w-47.5 items-center font-semibold max-md:w-auto">
+              {{ t("alerts.alertSettings.suppressRepeats") }}
+              <OIcon name="info" size="sm" class="ms-1 cursor-pointer" />
+              <OTooltip :content="t('alerts.alertSettings.suppressRepeatsTooltip')" side="right" />
+            </div>
+            <OFormSwitch
+              name="suppress_repeats"
+              :aria-label="t('alerts.alertSettings.suppressRepeats')"
+              data-test="alert-suppress-repeats-toggle"
+            />
+          </div>
         </template>
       </div>
     </div>
@@ -506,6 +519,8 @@ export default defineComponent({
         (config.isEnterprise === "true" || config.isCloud === "true") &&
         store.state.zoConfig?.incidents_enabled === true,
     );
+    // The backend honours the switch only in enterprise builds.
+    const repeatSuppressionAvailable = config.isEnterprise === "true" || config.isCloud === "true";
 
     // Field refs consumed by the parent's AlertFocusManager (registered off the
     // step ref). Scheduled-only.
@@ -736,6 +751,7 @@ export default defineComponent({
       t,
       store,
       incidentsEnabled,
+      repeatSuppressionAvailable,
       handlePeriodChange,
       // Field refs for the parent focus manager
       periodFieldRef,
diff --git a/web/src/components/alerts/steps/Deduplication.spec.ts b/web/src/components/alerts/steps/Deduplication.spec.ts
deleted file mode 100644
index d5af504b85..0000000000
--- a/web/src/components/alerts/steps/Deduplication.spec.ts
+++ /dev/null
@@ -1,158 +0,0 @@
-// Copyright 2026 OpenObserve Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-// This program is distributed in the hope that it will be useful
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-// Behavior spec for the Deduplication step. The step is a DESCENDANT of the
-// ONE AddAlert <OForm>: an ancestor form provides FORM_CONTEXT_KEY, the fields
-// bind `deduplication.*` by nested `name=` into it, and flushDedup writes the
-// DERIVED `enabled` + SANITIZED `time_window_minutes` back into the parent
-// form (Rule ④ payload parity — getAlertPayload reads the raw form values).
-
-import { describe, it, expect } from "vitest";
-import { mount, flushPromises } from "@vue/test-utils";
-import { defineComponent, nextTick } from "vue";
-import { z } from "zod";
-import Deduplication from "./Deduplication.vue";
-import OForm from "@/lib/forms/Form/OForm.vue";
-import { deduplicationSchema } from "@/components/alerts/AddAlert.schema";
-import i18n from "@/locales";
-import store from "@/test/unit/helpers/store";
-
-const globalCfg = { global: { plugins: [i18n, store] } };
-
-// ── DESCENDANT host (binds into an ancestor OForm — the app wiring) ─────────
-
-function makeDescendantHost(dedupDefaults: Record<string, any> = {}) {
-  return defineComponent({
-    components: { OForm, Deduplication },
-    setup() {
-      const schema = z.looseObject({
-        deduplication: deduplicationSchema.optional(),
-      });
-      const defaultValues = {
-        deduplication: {
-          enabled: false,
-          fingerprint_fields: [] as string[],
-          time_window_minutes: undefined as number | undefined,
-          ...dedupDefaults,
-        },
-      };
-      return { schema, defaultValues };
-    },
-    template: `
-      <OForm :schema="schema" :default-values="defaultValues" @submit="() => {}">
-        <Deduplication :deduplication="defaultValues.deduplication" :columns="['field1','field2','field3']" />
-      </OForm>
-    `,
-  });
-}
-
-function mountDescendant(dedupDefaults: Record<string, any> = {}) {
-  return mount(makeDescendantHost(dedupDefaults), globalCfg);
-}
-
-const hostForm = (host: any) => (host.findComponent({ name: "OForm" }).vm as any).form;
-
-/** flushDedup runs on a microtask after field.handleChange — settle both. */
-const settle = async () => {
-  await flushPromises();
-  await nextTick();
-  await flushPromises();
-};
-
-describe("Deduplication — descendant (binds into ancestor OForm) mode", () => {
-  it("does NOT render its own <OForm>", () => {
-    const host = mountDescendant();
-    expect(host.findAllComponents({ name: "OForm" }).length).toBe(1);
-    expect(host.findComponent(Deduplication).exists()).toBe(true);
-  });
-
-  it("preserves data-tests", () => {
-    const host = mountDescendant();
-    expect(host.find('[data-test="alert-dedup-fingerprint-fields"]').exists()).toBe(true);
-    expect(host.find('[data-test="alert-dedup-time-window"]').exists()).toBe(true);
-  });
-
-  it("selecting fields writes fingerprint_fields + derived enabled into the PARENT form", async () => {
-    const host = mountDescendant();
-    const parentForm = hostForm(host);
-
-    host
-      .findComponent('[data-test="alert-dedup-fingerprint-fields"]')
-      .vm.$emit("update:model-value", ["field1"]);
-    await settle();
-
-    expect(parentForm.state.values.deduplication.fingerprint_fields).toEqual(["field1"]);
-    expect(parentForm.state.values.deduplication.enabled).toBe(true);
-    // descendant mode is form-owned → no emit
-    expect(host.findComponent(Deduplication).emitted("update:deduplication")).toBeFalsy();
-  });
-
-  it("clearing all fields derives enabled=false in the PARENT form", async () => {
-    const host = mountDescendant({
-      enabled: true,
-      fingerprint_fields: ["field1"],
-    });
-    const parentForm = hostForm(host);
-
-    host
-      .findComponent('[data-test="alert-dedup-fingerprint-fields"]')
-      .vm.$emit("update:model-value", []);
-    await settle();
-
-    expect(parentForm.state.values.deduplication.fingerprint_fields).toEqual([]);
-    expect(parentForm.state.values.deduplication.enabled).toBe(false);
-  });
-
-  it("@create adds the custom value to the PARENT form (duplicate ignored)", async () => {
-    const host = mountDescendant();
-    const parentForm = hostForm(host);
-
-    host
-      .findComponent('[data-test="alert-dedup-fingerprint-fields"]')
-      .vm.$emit("create", "customField");
-    await settle();
-
-    expect(parentForm.state.values.deduplication.fingerprint_fields).toEqual(["customField"]);
-    expect(parentForm.state.values.deduplication.enabled).toBe(true);
-
-    // duplicate create is ignored
-    host
-      .findComponent('[data-test="alert-dedup-fingerprint-fields"]')
-      .vm.$emit("create", "customField");
-    await settle();
-    expect(parentForm.state.values.deduplication.fingerprint_fields).toEqual(["customField"]);
-  });
-
-  it("time_window is sanitized to a number in the PARENT form (payload parity)", async () => {
-    const host = mountDescendant();
-    const parentForm = hostForm(host);
-
-    await host.find('[data-test="alert-dedup-time-window"] input').setValue("20");
-    // sanitize runs on a microtask after field.handleChange
-    await settle();
-
-    expect(parentForm.state.values.deduplication.time_window_minutes).toBe(20);
-    expect(typeof parentForm.state.values.deduplication.time_window_minutes).toBe("number");
-  });
-
-  it("an empty time_window is sanitized to undefined in the PARENT form", async () => {
-    const host = mountDescendant({ time_window_minutes: 10 });
-    const parentForm = hostForm(host);
-
-    await host.find('[data-test="alert-dedup-time-window"] input').setValue("");
-    await settle();
-
-    expect(parentForm.state.values.deduplication.time_window_minutes).toBeUndefined();
-  });
-});
diff --git a/web/src/components/alerts/steps/Deduplication.vue b/web/src/components/alerts/steps/Deduplication.vue
deleted file mode 100644
index 6e7ad449bb..0000000000
--- a/web/src/components/alerts/steps/Deduplication.vue
+++ /dev/null
@@ -1,208 +0,0 @@
-<!-- Copyright 2026 OpenObserve Inc.
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
--->
-
-<template>
-  <div class="step-deduplication mx-auto h-full w-full overflow-auto">
-    <!-- DESCENDANT step (Rule ③): the AddAlert orchestrator owns the ONE <OForm>
-         and provides FORM_CONTEXT_KEY. The fields below bind by nested `name=`
-         (deduplication.fingerprint_fields / .time_window_minutes) into that
-         form; flushDedup writes the derived `enabled` + sanitized time window
-         back into it (payload parity). -->
-    <div>
-      <div
-        class="step-content rounded-default bg-surface-overlay border-border-default min-h-full border"
-      >
-        <div
-          class="section-header border-border-default flex items-center gap-0 border-b px-3 py-2.5"
-        >
-          <div
-            class="section-header-accent rounded-default bg-theme-accent me-2 h-4 w-0.75 shrink-0"
-          />
-          <span class="section-header-title text-compact text-text-heading font-semibold">{{
-            t("alerts.steps.deduplication")
-          }}</span>
-        </div>
-        <div class="px-3 py-2">
-          <!-- Fingerprint Fields -->
-          <div class="mb-4">
-            <div class="flex items-center pb-2 font-semibold">
-              {{ t("alerts.deduplication.fingerprintFields") }}
-              <OIcon name="info" size="sm" class="ms-1 cursor-pointer">
-                <OTooltip
-                  :content="t('alerts.deduplication.fingerprintFieldsTooltip')"
-                  side="right"
-                />
-              </OIcon>
-            </div>
-            <div class="text-text-secondary mb-2 text-sm">
-              {{ t("alerts.deduplication.fingerprintFieldsHint") }}
-            </div>
-            <div class="relative">
-              <OFormSelect
-                name="deduplication.fingerprint_fields"
-                :aria-label="t('alerts.deduplication.fingerprintFields')"
-                :options="props.columns || []"
-                multiple
-                creatable
-                data-test="alert-dedup-fingerprint-fields"
-                class="max-w-150 min-w-75"
-                :helpText="t('alerts.deduplication.fingerprintFieldsHelp')"
-                @update:model-value="onFingerprintChange"
-                @create="addFingerprintField"
-              />
-              <OTooltip
-                v-if="fingerprintFields?.length > 0"
-                :content="fingerprintFields.join(', ')"
-                max-width="25rem"
-              />
-            </div>
-          </div>
-
-          <!-- Time Window -->
-          <div class="mb-4">
-            <div class="flex items-center pb-2 font-semibold">
-              {{ t("alerts.deduplication.timeWindow") }}
-              <OIcon name="info" size="sm" class="ms-1 cursor-pointer">
-                <OTooltip :content="t('alerts.deduplication.timeWindowTooltip')" side="right" />
-              </OIcon>
-            </div>
-            <div class="text-text-secondary mb-2 text-sm">
-              {{ t("alerts.deduplication.timeWindowHint") }}
-            </div>
-            <div class="flex items-center">
-              <div class="ms-0 w-52.5">
-                <OFormInput
-                  name="deduplication.time_window_minutes"
-                  :aria-label="t('alerts.deduplication.timeWindow')"
-                  type="number"
-                  min="1"
-                  data-test="alert-dedup-time-window"
-                  :placeholder="t('alerts.placeholders.autoUsesCheckInterval')"
-                  @update:model-value="onTimeWindowChange"
-                />
-              </div>
-              <div
-                style="
-                  min-width: 5.625rem;
-                  margin-left: 0 !important;
-                  height: 1.75rem;
-                  font-weight: normal;
-                "
-                class="bg-surface-subtle flex items-center justify-center"
-              >
-                {{ t("alerts.minutes") }}
-              </div>
-            </div>
-          </div>
-        </div>
-        <!-- end px-3 py-2 -->
-      </div>
-    </div>
-  </div>
-</template>
-
-<script lang="ts">
-import { defineComponent, inject, type PropType } from "vue";
-import OFormInput from "@/lib/forms/Input/OFormInput.vue";
-import OFormSelect from "@/lib/forms/Select/OFormSelect.vue";
-import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
-import { useI18nTyped } from "@/types/i18n";
-import { useStore } from "vuex";
-import OIcon from "@/lib/core/Icon/OIcon.vue";
-import { FORM_CONTEXT_KEY } from "@/lib/forms/Form/OForm.types";
-
-/** number | undefined — "" and non-numeric become undefined (payload parity). */
-const sanitizeTimeWindow = (val: any): number | undefined => {
-  if (val == null || val === "") return undefined;
-  const num = Number(val);
-  return isNaN(num) ? undefined : num;
-};
-
-export default defineComponent({
-  name: "Step5Deduplication",
-  components: { OIcon, OFormInput, OFormSelect, OTooltip },
-  props: {
-    deduplication: {
-      type: Object as PropType<any>,
-      default: () => ({
-        enabled: true,
-        fingerprint_fields: [],
-        time_window_minutes: undefined,
-      }),
-    },
-    columns: {
-      type: Array as PropType<any[]>,
-      default: () => [],
-    },
-  },
-  emits: ["update:deduplication"],
-  setup(props) {
-    const { t } = useI18nTyped();
-    const store = useStore();
-
-    // DESCENDANT step (Rule ③): the AddAlert orchestrator provides
-    // FORM_CONTEXT_KEY — the ONE form the fields bind into by nested `name=`.
-    const form: any = inject(FORM_CONTEXT_KEY, null);
-
-    // Reactive view of the selected fingerprint fields (tooltip + enabled derive).
-    const fingerprintFields = form.useStore(
-      (s: any) => (s.values?.deduplication?.fingerprint_fields ?? []) as string[],
-    );
-
-    // ── flushDedup — the single derive/sanitize step. Deferred to a microtask
-    //    so it runs AFTER the OForm* field.handleChange has stored the raw value
-    //    (their handler order is not guaranteed), making it fully
-    //    order-independent. It derives `enabled` (fingerprint_fields.length > 0)
-    //    and sanitizes `time_window_minutes` to number|undefined, writing both
-    //    back into the ONE form so getAlertPayload (which reads raw form
-    //    values) keeps payload parity. ─────────────────────────────────────────
-    const flushDedup = () => {
-      Promise.resolve().then(() => {
-        const d = (form.getFieldValue("deduplication") as any) ?? {};
-        const fields: string[] = Array.isArray(d.fingerprint_fields) ? d.fingerprint_fields : [];
-        const enabled = fields.length > 0;
-        const cleanWindow = sanitizeTimeWindow(d.time_window_minutes);
-        if (d.enabled !== enabled) form.setFieldValue("deduplication.enabled", enabled);
-        if (cleanWindow !== d.time_window_minutes)
-          form.setFieldValue("deduplication.time_window_minutes", cleanWindow);
-      });
-    };
-
-    const onFingerprintChange = () => flushDedup();
-    const onTimeWindowChange = () => flushDedup();
-
-    // @create only NOTIFIES (OSelect does not add the created term to the model),
-    // so add it here — matching the pre-migration addFingerprintField.
-    const addFingerprintField = (value: string) => {
-      const current = (form.getFieldValue("deduplication.fingerprint_fields") as string[]) ?? [];
-      if (!current.includes(value)) {
-        form.setFieldValue("deduplication.fingerprint_fields", [...current, value]);
-        flushDedup();
-      }
-    };
-
-    return {
-      t,
-      store,
-      props,
-      fingerprintFields,
-      onFingerprintChange,
-      onTimeWindowChange,
-      addFingerprintField,
-    };
-  },
-});
-</script>
diff --git a/web/src/components/autoobserve/data/facts.ts b/web/src/components/autoobserve/data/facts.ts
index c3e6ad0b1d..f1b5317f00 100644
--- a/web/src/components/autoobserve/data/facts.ts
+++ b/web/src/components/autoobserve/data/facts.ts
@@ -3650,9 +3650,9 @@ export const LEDGER: LedgerFact[] = [
     state: "kept",
     confidence: 89,
     evidence:
-      "The 3 alerts fired together 94% of the time in 30 days, so one slowdown paged 3 times.",
-    before: "dedup: off",
-    after: "dedup:\n  window: 15m\n  fields: [service.name]",
+      "Each of the 3 alerts notified on every 1-minute evaluation while it stayed firing, so one 40-minute slowdown paged 120 times.",
+    before: "suppress_repeats: false",
+    after: "suppress_repeats: true",
     day: "monday",
     time: "08:30",
     note: "Kept — checks passed at the end of the review window",
diff --git a/web/src/components/dashboards/PanelContainer.vue b/web/src/components/dashboards/PanelContainer.vue
index 063d29c70b..dc63ba9b6d 100644
--- a/web/src/components/dashboards/PanelContainer.vue
+++ b/web/src/components/dashboards/PanelContainer.vue
@@ -148,6 +148,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               'node-graph',
               'alert-list',
               'flame-graph',
+              'boxplot',
+              'logs',
             ].includes(props.data.type)
           "
           variant="ghost"
diff --git a/web/src/components/dashboards/PanelEditor/PanelEditor.spec.ts b/web/src/components/dashboards/PanelEditor/PanelEditor.spec.ts
index eae6bc12ce..705c15531a 100644
--- a/web/src/components/dashboards/PanelEditor/PanelEditor.spec.ts
+++ b/web/src/components/dashboards/PanelEditor/PanelEditor.spec.ts
@@ -99,6 +99,7 @@ const mockChartData = ref(undefined as any);
 const mockShowLegendsDialog = ref(false);
 const mockNoticeProps = ref<Record<string, unknown>>({});
 const mockRunQuery = vi.fn();
+const mockHandleChartApiError = vi.fn();
 
 // Mock usePanelEditor composable
 vi.mock("./composables/usePanelEditor", () => ({
@@ -129,7 +130,7 @@ vi.mock("./composables/usePanelEditor", () => ({
     currentPanelData: ref({}),
     initChartData: vi.fn(),
     runQuery: mockRunQuery,
-    handleChartApiError: vi.fn(),
+    handleChartApiError: mockHandleChartApiError,
     handleLastTriggeredAtUpdate: vi.fn(),
     handleLimitNumberOfSeriesWarningMessage: vi.fn(),
     handleIsPartialDataUpdate: vi.fn(),
@@ -953,6 +954,22 @@ describe("PanelEditor.vue", () => {
       wrapper.unmount();
     });
 
+    it("rebuilds the other builder tabs when the chart type changes", async () => {
+      const previous = mockDashboardPanelData.data.type;
+      wrapper = shallowMount(PanelEditor, {
+        props: { pageType: "dashboard", editMode: false },
+        global: mountGlobal,
+      });
+      await nextTick();
+      mockRegenerateOtherBuilderQueries.mockClear();
+
+      mockDashboardPanelData.data.type = "boxplot";
+      await nextTick();
+      expect(mockRegenerateOtherBuilderQueries).toHaveBeenCalledTimes(1);
+      mockDashboardPanelData.data.type = previous;
+      wrapper.unmount();
+    });
+
     it("rebuilds the query when the bucket size is edited in place", async () => {
       const config = mockDashboardPanelData.data.config as Record<string, any>;
       config.heatmap_y_bucket = { mode: "size", size: 10 };
@@ -1038,4 +1055,26 @@ describe("PanelEditor.vue", () => {
       ]);
     });
   });
+
+  describe("renderer errors", () => {
+    beforeEach(() => {
+      mockChartData.value = {};
+      mockHandleChartApiError.mockClear();
+    });
+
+    it("shows the renderer's error and hands it to the page as renderer-error", () => {
+      wrapper = shallowMount(PanelEditor, {
+        props: { pageType: "metrics" },
+        global: mountGlobal,
+      });
+      const renderer = wrapper.findComponent({ name: "PanelSchemaRenderer" });
+      const failure = { message: "parse error: unexpected <EOF>", code: 400 };
+      renderer.vm.$emit("error", failure);
+      expect(mockHandleChartApiError).toHaveBeenCalledWith(failure);
+      expect(wrapper.emitted("renderer-error")).toEqual([[failure]]);
+
+      renderer.vm.$emit("error", { message: "", code: "" });
+      expect(wrapper.emitted("renderer-error")?.[1]).toEqual([{ message: "", code: "" }]);
+    });
+  });
 });
diff --git a/web/src/components/dashboards/PanelEditor/PanelEditor.vue b/web/src/components/dashboards/PanelEditor/PanelEditor.vue
index 8f2fba9761..210747d8a8 100644
--- a/web/src/components/dashboards/PanelEditor/PanelEditor.vue
+++ b/web/src/components/dashboards/PanelEditor/PanelEditor.vue
@@ -211,6 +211,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                           'funnel',
                           'node-graph',
                           'flame-graph',
+                          'boxplot',
+                          'logs',
                           'geomap',
                           'maps',
                         ].includes(dashboardPanelData.data.type)
@@ -325,7 +327,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                           handleLimitNumberOfSeriesWarningMessage
                         "
                         @sparkline-warning-update="handleSparklineWarningUpdate"
-                        @error="handleChartApiError"
+                        @error="onRendererError"
                         @updated:data-zoom="handleDataZoom"
                         @updated:vrl-function-field-list="updateVrlFunctionFieldList"
                         @last-triggered-at-update="handleLastTriggeredAtUpdate"
@@ -679,7 +681,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                             handleLimitNumberOfSeriesWarningMessage
                           "
                           @sparkline-warning-update="handleSparklineWarningUpdate"
-                          @error="handleChartApiError"
+                          @error="onRendererError"
                           @updated:data-zoom="handleDataZoom"
                           @updated:vrl-function-field-list="updateVrlFunctionFieldList"
                           @last-triggered-at-update="handleLastTriggeredAtUpdate"
@@ -1347,6 +1349,12 @@ const handleVariablesDataUpdated = (data: PanelEditorVariablesData) => {
   emit("variablesDataUpdated", data);
 };
 
+// The editor shows the error itself; pages that classify a run (Metrics history) need it too.
+const onRendererError = (error: { message?: unknown; code?: unknown } | string | null) => {
+  handleChartApiError(error);
+  emit("renderer-error", error);
+};
+
 const handleDataZoom = (event: any) => {
   const result = onDataZoom(event);
   emit("dataZoom", {
@@ -1459,6 +1467,7 @@ watch(
 
 watch(
   () => [
+    dashboardPanelData.data.type,
     dashboardPanelData.data.config?.heatmap_y_bucket,
     dashboardPanelData.data.config?.heatmap_y_min,
     dashboardPanelData.data.config?.heatmap_y_max,
diff --git a/web/src/components/dashboards/PanelEditor/composables/usePanelEditor.spec.ts b/web/src/components/dashboards/PanelEditor/composables/usePanelEditor.spec.ts
index 9cd5ff5f9f..21b88d3032 100644
--- a/web/src/components/dashboards/PanelEditor/composables/usePanelEditor.spec.ts
+++ b/web/src/components/dashboards/PanelEditor/composables/usePanelEditor.spec.ts
@@ -427,6 +427,29 @@ describe("usePanelEditor", () => {
       ]);
     });
 
+    it("does not list a builder box plot's statistic columns as function fields", () => {
+      dashboardPanelData.data.type = "boxplot";
+      dashboardPanelData.data.queries[0].customQuery = false;
+      dashboardPanelData.data.queries[0].fields.x = [{ alias: "x_axis_1", isDerived: false }];
+      dashboardPanelData.data.queries[0].fields.y = [{ alias: "y_axis_1", isDerived: false }];
+
+      const { updateVrlFunctionFieldList } = usePanelEditor(options);
+      updateVrlFunctionFieldList([
+        "x_axis_1",
+        "y_axis_1_min",
+        "y_axis_1_q1",
+        "y_axis_1_median",
+        "y_axis_1_q3",
+        "y_axis_1_max",
+        "y_axis_1_count",
+        "vrlField",
+      ]);
+
+      expect(dashboardPanelData.meta.stream.vrlFunctionFieldList).toEqual([
+        { name: "vrlField", type: "Utf8" },
+      ]);
+    });
+
     it("should filter out customQueryFields", () => {
       // customQueryFields are read from the per-query cache (meta.queryFields)
       dashboardPanelData.meta.queryFields[0] = {
diff --git a/web/src/components/dashboards/PanelEditor/composables/usePanelEditor.ts b/web/src/components/dashboards/PanelEditor/composables/usePanelEditor.ts
index f31471e7a0..b094973e1f 100644
--- a/web/src/components/dashboards/PanelEditor/composables/usePanelEditor.ts
+++ b/web/src/components/dashboards/PanelEditor/composables/usePanelEditor.ts
@@ -28,6 +28,7 @@ import type {
 } from "../types/panelEditor";
 
 import { checkIfConfigChangeRequiredApiCallOrNot } from "@/utils/dashboard/checkConfigChangeApiCall";
+import { boxplotStatAliases } from "@/utils/dashboard/boxplotStats";
 import { usePanelNotices } from "@/composables/dashboard/usePanelNotices";
 import useCancelQuery from "@/composables/dashboard/useCancelQuery";
 import useNotifications from "@/composables/useNotifications";
@@ -518,7 +519,7 @@ export function usePanelEditor(options: UsePanelEditorOptions) {
     return dashboardPanelData.meta.queryFields[queryIndex];
   };
 
-  const collectAliasesOf = (query: any): string[] => {
+  const collectAliasesOf = (query: any, chartType?: string): string[] => {
     const aliases: string[] = [];
     if (!query) return aliases;
 
@@ -527,6 +528,12 @@ export function usePanelEditor(options: UsePanelEditorOptions) {
         if (!it.isDerived && it.alias) aliases.push(it.alias);
       });
     });
+    // A builder box plot returns its y statistics under derived aliases, not as the y alias itself.
+    if (chartType === "boxplot" && !query.customQuery) {
+      query.fields?.y?.forEach((it: any) => {
+        if (it.alias) aliases.push(...boxplotStatAliases(it.alias));
+      });
+    }
 
     const specialFields = [
       "latitude",
@@ -548,8 +555,8 @@ export function usePanelEditor(options: UsePanelEditorOptions) {
 
   // Results can land after further edits, so the aliases of the query that produced them count too.
   const collectFieldAliasesForQuery = (queryIndex: number): string[] => [
-    ...collectAliasesOf(dashboardPanelData.data.queries[queryIndex]),
-    ...collectAliasesOf(chartData.value?.queries?.[queryIndex]),
+    ...collectAliasesOf(dashboardPanelData.data.queries[queryIndex], dashboardPanelData.data.type),
+    ...collectAliasesOf(chartData.value?.queries?.[queryIndex], chartData.value?.type),
   ];
 
   const buildAliasListForQuery = (queryIndex: number): string[] => {
diff --git a/web/src/components/dashboards/PanelEditor/types/panelEditor.spec.ts b/web/src/components/dashboards/PanelEditor/types/panelEditor.spec.ts
index e4c367162f..1aa25281f1 100644
--- a/web/src/components/dashboards/PanelEditor/types/panelEditor.spec.ts
+++ b/web/src/components/dashboards/PanelEditor/types/panelEditor.spec.ts
@@ -325,6 +325,8 @@ describe("panelEditor types and utilities", () => {
         expect(ALL_CHART_TYPES).toContain("node-graph");
         expect(ALL_CHART_TYPES).toContain("alert-list");
         expect(ALL_CHART_TYPES).toContain("flame-graph");
+        expect(ALL_CHART_TYPES).toContain("boxplot");
+        expect(ALL_CHART_TYPES).toContain("logs");
         expect(ALL_CHART_TYPES).toContain("hostmap");
         expect(ALL_CHART_TYPES).toContain("treemap");
       });
@@ -406,6 +408,8 @@ describe("panelEditor types and utilities", () => {
               "distribution",
               "alert-list",
               "flame-graph",
+              "boxplot",
+              "logs",
             ].includes(type),
         );
 
diff --git a/web/src/components/dashboards/PanelEditor/types/panelEditor.ts b/web/src/components/dashboards/PanelEditor/types/panelEditor.ts
index eb100abf59..a012ad03d8 100644
--- a/web/src/components/dashboards/PanelEditor/types/panelEditor.ts
+++ b/web/src/components/dashboards/PanelEditor/types/panelEditor.ts
@@ -355,6 +355,9 @@ export interface PanelEditorEmits {
    */
   (e: "chartApiError", error: any): void;
 
+  /** Every change of the renderer's error; `{ message: "" }` means the last run succeeded. */
+  (e: "renderer-error", error: { message?: unknown; code?: unknown } | string | null): void;
+
   /**
    * Emitted when user zooms on chart (for datetime update).
    * Parent should update its DateTimePicker with new time range.
@@ -659,6 +662,7 @@ export const ALL_CHART_TYPES = [
   "table",
   "heatmap",
   "state-timeline",
+  "boxplot",
   "distribution",
   "treemap",
   "sunburst",
@@ -671,6 +675,7 @@ export const ALL_CHART_TYPES = [
   "markdown",
   "alert-list",
   "flame-graph",
+  "logs",
   "custom_chart",
 ] as const;
 
diff --git a/web/src/components/dashboards/PanelSchemaRenderer.vue b/web/src/components/dashboards/PanelSchemaRenderer.vue
index e1fb08218c..671e5b70ad 100644
--- a/web/src/components/dashboards/PanelSchemaRenderer.vue
+++ b/web/src/components/dashboards/PanelSchemaRenderer.vue
@@ -112,6 +112,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :data="panelData.chartType == 'flame-graph' ? panelData : null"
           :config="panelSchema.config"
         />
+        <LogsPanelRenderer
+          v-else-if="panelSchema.type == 'logs'"
+          :data="panelData.chartType == 'logs' ? panelData : null"
+          :config="panelSchema.config"
+        />
         <CustomChartRenderer
           v-else-if="panelSchema.type == 'custom_chart'"
           :data="panelData"
@@ -448,6 +453,7 @@ const AlertListPanelRenderer = defineAsyncComponent(
 const FlameGraphPanelRenderer = defineAsyncComponent(
   () => import("./panels/FlameGraphPanelRenderer.vue"),
 );
+const LogsPanelRenderer = defineAsyncComponent(() => import("./panels/LogsPanelRenderer.vue"));
 
 const AddAnnotation = defineAsyncComponent(() => {
   return import("./addPanel/AddAnnotation.vue");
@@ -490,6 +496,7 @@ export default defineComponent({
     MarkdownRenderer,
     AlertListPanelRenderer,
     FlameGraphPanelRenderer,
+    LogsPanelRenderer,
     AddAnnotation,
     CustomChartRenderer,
     LoadingProgress,
@@ -2143,6 +2150,10 @@ export default defineComponent({
         return panelData.value?.root ? "" : "No Data";
       }
 
+      if (type === "logs") {
+        return panelData.value?.rows?.length > 0 ? "" : "No Data";
+      }
+
       // Table renders raw rows; the conversion returns { rows, columns }.
       if (type === "table") {
         return panelData.value?.rows?.length > 0 ? "" : "No Data";
diff --git a/web/src/components/dashboards/PublicLinkForm.schema.spec.ts b/web/src/components/dashboards/PublicLinkForm.schema.spec.ts
index 97029b42f8..1728bc49ee 100644
--- a/web/src/components/dashboards/PublicLinkForm.schema.spec.ts
+++ b/web/src/components/dashboards/PublicLinkForm.schema.spec.ts
@@ -26,6 +26,7 @@ import {
   rangeError,
   rangeFromPicker,
   rangeKey,
+  rangesWindow,
   sortRanges,
   todayIn,
   toPublicLinkConfig,
@@ -241,4 +242,26 @@ describe("PublicLinkForm payload", () => {
     );
     expect(toPublicLinkConfig(named(), {}, "Asia/Kolkata", stored).expires_at).toBeNull();
   });
+
+  describe("rangesWindow", () => {
+    const now = 10_000_000_000;
+    const span = (ranges: PublicLinkRange[]) => {
+      const { start_time, end_time } = rangesWindow(ranges, now);
+      return [start_time.getTime(), end_time.getTime()];
+    };
+
+    it("spans the widest relative range, ending now", () => {
+      expect(span([rel(3600), rel(86400)])).toEqual([now - 86_400_000, now]);
+    });
+
+    it("covers absolute ranges together with the relative ones", () => {
+      const earlier = abs(1_000_000_000, 2_000_000_000);
+      expect(span([rel(3600), earlier])).toEqual([1_000_000, now]);
+      expect(span([earlier, abs(3_000_000_000, 4_000_000_000)])).toEqual([1_000_000, 4_000_000]);
+    });
+
+    it("falls back to the default ranges when there are none", () => {
+      expect(span([])).toEqual([now - 86_400_000, now]);
+    });
+  });
 });
diff --git a/web/src/components/dashboards/PublicLinkForm.schema.ts b/web/src/components/dashboards/PublicLinkForm.schema.ts
index 2398a226c5..d887443cf3 100644
--- a/web/src/components/dashboards/PublicLinkForm.schema.ts
+++ b/web/src/components/dashboards/PublicLinkForm.schema.ts
@@ -189,6 +189,20 @@ export const publicLinkDefaults = (): PublicLinkForm => ({
   expires: "",
 });
 
+/** The window that covers every range at once, relative ones ending at `nowMs`; no ranges reads as the default ones. */
+export const rangesWindow = (
+  ranges: PublicLinkRange[],
+  nowMs: number,
+): { start_time: Date; end_time: Date } => {
+  const spans = (ranges.length ? ranges : publicLinkDefaults().ranges).map((r) =>
+    r.type === "relative" ? [nowMs - r.secs * 1000, nowMs] : [r.start / 1000, r.end / 1000],
+  );
+  return {
+    start_time: new Date(Math.min(...spans.map(([start]) => start))),
+    end_time: new Date(Math.max(...spans.map(([, end]) => end))),
+  };
+};
+
 /** An expiry in UTC microseconds as the YYYY-MM-DD date it falls on in the author's timezone. */
 export const expiryDate = (micros: number, timezone: string): string =>
   formatInTimeZone(micros / 1000, timezone, "yyyy-MM-dd");
diff --git a/web/src/components/dashboards/PublicLinksPanel.spec.ts b/web/src/components/dashboards/PublicLinksPanel.spec.ts
index a155f5fe09..a7bdaf9b5d 100644
--- a/web/src/components/dashboards/PublicLinksPanel.spec.ts
+++ b/web/src/components/dashboards/PublicLinksPanel.spec.ts
@@ -975,6 +975,158 @@ describe("PublicLinksPanel", () => {
       expect(w.findComponent({ name: "ODrawer" }).props("primaryButtonDisabled")).toBe(false);
       expect(await create(w)).toEqual({ qns: "ingress-nginx" });
     });
+
+    it("keeps an edited link's unset value when the dashboard now has one", async () => {
+      const unset = link({ frozen_variables: { qns: null } });
+      vi.mocked(admin.list).mockResolvedValue({ data: { list: [unset] } } as never);
+      vi.mocked(admin.update).mockResolvedValue({ data: unset } as never);
+      const w = realPickers({
+        editLinkId: "l1",
+        dashboardVariables: { getUrlParams: () => ({ "var-qns": "x" }) },
+      });
+      await flushPromises();
+      expect(stream.fetch).not.toHaveBeenCalled();
+
+      (
+        w.vm as unknown as { form: { setFieldValue: (k: string, v: string) => void } }
+      ).form.setFieldValue("name", "NOC wall (renamed)");
+      await submit(w);
+      const cfg = vi.mocked(admin.update).mock.calls[0][3];
+      expect(cfg.name).toBe("NOC wall (renamed)");
+      expect(cfg.frozen_variables.qns).toBeNull();
+    });
+  });
+
+  it("lists variable values for the link's own ranges, not the dashboard's time range", async () => {
+    vi.mocked(admin.list).mockResolvedValue({ data: { list: [] } } as never);
+    const w = build({ timeObj: { start_time: new Date(0), end_time: new Date(900_000) } });
+    await flushPromises();
+    const pickerWindow = () =>
+      w.findComponent({ name: "VariablesValueSelector" }).props("selectedTimeDate") as {
+        start_time: Date;
+        end_time: Date;
+      };
+    expect(Date.now() - pickerWindow().end_time.getTime()).toBeLessThan(60_000);
+    expect(pickerWindow().end_time.getTime() - pickerWindow().start_time.getTime()).toBe(
+      86_400_000,
+    );
+
+    await w.find('[data-test="dashboards-public-links-panel-add-range-btn"]').trigger("click");
+    await flushPromises();
+    expect(pickerWindow().end_time.getTime() - pickerWindow().start_time.getTime()).toBe(
+      604_800_000,
+    );
+  });
+
+  it("offers no seconds in the range pickers, which the form refuses", async () => {
+    vi.mocked(admin.list).mockResolvedValue({ data: { list: [] } } as never);
+    const w = build();
+    await flushPromises();
+    const pickers = w.findAllComponents({ name: "DateTime" });
+    expect(pickers).toHaveLength(2);
+    expect(pickers.every((p) => "hide-seconds" in p.attributes())).toBe(true);
+  });
+
+  it("asks before discarding a changed form, and leaves an untouched one without asking", async () => {
+    vi.mocked(admin.list).mockResolvedValue({ data: { list: [link()] } } as never);
+    const w = build();
+    await flushPromises();
+    const openNew = async () => {
+      await w.find('[data-test="dashboards-public-links-panel-new-btn"]').trigger("click");
+      await flushPromises();
+    };
+    const back = async () => {
+      await w.find('[data-test="dashboards-public-links-panel-back-btn"]').trigger("click");
+      await flushPromises();
+    };
+    const nameValue = () =>
+      (
+        w.find('[data-test="dashboards-public-links-panel-name-input"] input')
+          .element as HTMLInputElement
+      ).value;
+
+    await openNew();
+    await back();
+    expect(confirm).not.toHaveBeenCalled();
+    expect(has(w, "dashboards-public-links-panel-list")).toBe(true);
+
+    await openNew();
+    (
+      w.vm as unknown as { form: { setFieldValue: (k: string, v: string) => void } }
+    ).form.setFieldValue("name", "Draft");
+    await flushPromises();
+    confirm.mockResolvedValueOnce(false);
+    await back();
+    expect(confirm).toHaveBeenCalledWith(
+      expect.objectContaining({ title: "Unsaved changes", confirmLabel: "Discard changes" }),
+    );
+    expect(has(w, "dashboards-public-links-panel-form")).toBe(true);
+    expect(nameValue()).toBe("Draft");
+
+    confirm.mockResolvedValueOnce(true);
+    const guard = w.findComponent({ name: "ODrawer" }).props("closeGuard") as () => boolean;
+    expect(guard()).toBe(false);
+    await flushPromises();
+    expect(confirm).toHaveBeenCalledTimes(2);
+    expect(has(w, "dashboards-public-links-panel-list")).toBe(true);
+  });
+
+  it("reloads the list on every opening and after a refused create", async () => {
+    vi.mocked(admin.list).mockResolvedValue({ data: { list: [link()] } } as never);
+    const w = build();
+    await flushPromises();
+    expect(admin.list).toHaveBeenCalledTimes(1);
+
+    await w.setProps({ modelValue: false });
+    await w.setProps({ modelValue: true });
+    await flushPromises();
+    expect(admin.list).toHaveBeenCalledTimes(2);
+
+    const limit = "This dashboard has reached its limit of 10 public links";
+    vi.mocked(admin.create).mockRejectedValue({
+      response: { status: 400, data: { message: limit } },
+    });
+    await w.find('[data-test="dashboards-public-links-panel-new-btn"]').trigger("click");
+    await flushPromises();
+    (
+      w.vm as unknown as { form: { setFieldValue: (k: string, v: string) => void } }
+    ).form.setFieldValue("name", "NOC wall");
+    await submit(w);
+    expect(notify.error).toHaveBeenCalledWith(limit);
+    expect(admin.list).toHaveBeenCalledTimes(3);
+  });
+
+  it("says when the org has public links off, and holds create, pause and resume", async () => {
+    vi.mocked(admin.list).mockResolvedValue({
+      data: {
+        list: [
+          link({ status: "disabled" }),
+          link({ id: "l2", name: "Lobby", status: "disabled", enabled: false }),
+        ],
+      },
+    } as never);
+    const w = build();
+    await flushPromises();
+    const el = (id: string) => w.find(`[data-test="dashboards-public-links-panel-${id}"]`);
+    expect(el("org-disabled").text()).toContain(
+      "Public links are turned off for this organization",
+    );
+    expect(el("new-btn").attributes("disabled")).toBeDefined();
+    expect(el("l1-pause-btn").attributes("disabled")).toBeDefined();
+    expect(el("l2-resume-btn").attributes("disabled")).toBeDefined();
+    expect(el("l2-resume-menu").attributes("disabled")).toBeDefined();
+    expect(el("l1-status").text()).toBe("Disabled");
+    expect(el("l2-status").text()).toBe("Disabled · Paused");
+  });
+
+  it("shows no org banner while public links are on", async () => {
+    vi.mocked(admin.list).mockResolvedValue({ data: { list: [link()] } } as never);
+    const w = build();
+    await flushPromises();
+    expect(has(w, "dashboards-public-links-panel-org-disabled")).toBe(false);
+    expect(
+      w.find('[data-test="dashboards-public-links-panel-new-btn"]').attributes("disabled"),
+    ).toBeUndefined();
   });
 
   it("finds a link by its slug or a pasted public URL", async () => {
diff --git a/web/src/components/dashboards/PublicLinksPanel.vue b/web/src/components/dashboards/PublicLinksPanel.vue
index 851ad86166..77f4408f17 100644
--- a/web/src/components/dashboards/PublicLinksPanel.vue
+++ b/web/src/components/dashboards/PublicLinksPanel.vue
@@ -175,6 +175,7 @@
                       menu-align="start"
                       auto-apply
                       hide-range-shift
+                      hide-seconds
                       :default-open="row.id === addedRowId"
                       :default-type="row.range.type"
                       :default-relative-time="
@@ -269,7 +270,7 @@
             scope="global"
             :variablesManager="formVars"
             :variablesConfig="{ list: formVars.variablesData.global }"
-            :selectedTimeDate="timeObj"
+            :selectedTimeDate="variablesWindow"
             :showDynamicFilters="false"
             data-test="dashboards-public-links-panel-global-variables"
           />
@@ -286,7 +287,7 @@
               :panelId="group.panelId"
               :variablesManager="formVars"
               :variablesConfig="{ list: group.vars }"
-              :selectedTimeDate="timeObj"
+              :selectedTimeDate="variablesWindow"
               :showDynamicFilters="false"
             />
           </div>
@@ -299,6 +300,15 @@
       class="flex h-full min-h-0 flex-col gap-3"
       data-test="dashboards-public-links-panel-list"
     >
+      <OContent v-if="orgDisabled" class="pt-2">
+        <OBanner
+          variant="warning"
+          icon="warning-amber"
+          dense
+          :content="t('dashboard.publicLinks.orgDisabledBanner')"
+          data-test="dashboards-public-links-panel-org-disabled"
+        />
+      </OContent>
       <OTable
         class="min-h-0 flex-1"
         :data="filteredLinks"
@@ -345,6 +355,7 @@
             <OButton
               variant="primary"
               size="sm"
+              :disabled="orgDisabled"
               data-test="dashboards-public-links-panel-new-btn"
               @click="openForm(null)"
             >
@@ -383,7 +394,11 @@
         <template #cell-status="{ row }">
           <span class="inline-flex min-w-0 items-center gap-1.5">
             <span class="inline-flex" :data-test="`dashboards-public-links-panel-${row.id}-status`">
-              <OTag type="publicLinkStatus" :value="displayStatus(row, linkReports[row.id])" />
+              <OTag
+                type="publicLinkStatus"
+                :value="displayStatus(row, linkReports[row.id])"
+                :label="statusLabel(row, t)"
+              />
               <OTooltip v-if="statusHints[row.id]" side="bottom" :content="statusHints[row.id]" />
             </span>
             <OBadge
@@ -484,7 +499,7 @@
                   row.enabled ? t('dashboard.publicLinks.pause') : t('dashboard.publicLinks.resume')
                 "
                 :loading="busyRows.get(row.id) === 'inline'"
-                :disabled="!canPause(row) || busyRows.has(row.id)"
+                :disabled="!canPause(row) || busyRows.has(row.id) || orgDisabled"
                 :data-test="`dashboards-public-links-panel-${row.id}-${row.enabled ? 'pause' : 'resume'}-btn`"
                 @click="setPaused(row, row.enabled, 'inline')"
               >
@@ -541,7 +556,7 @@
                 v-if="canPause(row) && !takeOverReplacesResume(row, userId)"
                 :icon-left="row.enabled ? 'pause' : 'play-arrow'"
                 class="md:hidden"
-                :disabled="busyRows.has(row.id)"
+                :disabled="busyRows.has(row.id) || orgDisabled"
                 :data-test="`dashboards-public-links-panel-${row.id}-${row.enabled ? 'pause' : 'resume'}-menu`"
                 @select="setPaused(row, row.enabled, 'menu')"
               >
@@ -588,6 +603,7 @@
 <script setup lang="ts">
 import { computed, reactive, ref, watch } from "vue";
 import { useStore } from "vuex";
+import { isEqual } from "lodash-es";
 import { useMutation, useQuery } from "@tanstack/vue-query";
 import { useI18nTyped, raw, type I18nText } from "@/types/i18n";
 import useNotifications from "@/composables/useNotifications";
@@ -609,6 +625,7 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OContent from "@/lib/core/Content/OContent.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OTable from "@/lib/core/Table/OTable.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
@@ -653,6 +670,7 @@ import {
   rangeError,
   rangeFromPicker,
   rangeKey,
+  rangesWindow,
   todayIn,
   toPublicLinkConfig,
   type PickedTime,
@@ -666,8 +684,10 @@ import {
   noDashboardAccess,
   lifecycleStatus,
   longRange,
+  orgSwitchedOff,
   publicLinkColumns,
   publicLinkSearchTerm,
+  statusLabel,
   statusReason,
   forbiddenMessage,
   pauseBlockedReason,
@@ -739,6 +759,10 @@ const open = computed({
 
 // From a dashboard, leaving the form returns to its link list; from the org-wide list it closes the drawer.
 function guardClose(): boolean {
+  if (currentView.value === "form" && isFormDirty()) {
+    void closeForm();
+    return false;
+  }
   if (currentView.value === "list" || !links.value.length || props.editLinkId) return true;
   editing.value = null;
   form.reset(publicLinkDefaults());
@@ -756,6 +780,7 @@ const linksQuery = useQuery(() =>
   }),
 );
 const links = computed(() => linksQuery.data.value ?? []);
+const orgDisabled = computed(() => orgSwitchedOff(links.value));
 const loading = linksQuery.isPending;
 const forbidden = computed(
   () =>
@@ -813,6 +838,8 @@ const formVarsReady = ref(false);
 const variablesPending = computed(
   () => !!props.variablesConfig?.list?.length && (!formVarsReady.value || formVars.isLoading.value),
 );
+// The pickers settle on loaded or auto-selected values, so only a change after that is the author's.
+let settledVariables: string | null = null;
 // Rows with a pause, resume, refresh or revoke in flight, so a second click can't send it again.
 const busyRows = reactive(new Map<string, RowActionSource>());
 
@@ -882,6 +909,13 @@ const rowErrors = computed(() =>
     ),
   ),
 );
+// Variable values are listed for the link's own ranges, not the time range the dashboard behind the drawer is on.
+const variablesWindow = computed(() =>
+  rangesWindow(
+    rows.value.filter((_, i) => !rowErrors.value[i]).map((r) => r.range),
+    Date.now(),
+  ),
+);
 
 // One labelled picker per tab and per panel that has its own scoped variables.
 const scopedGroups = computed(() => {
@@ -1043,6 +1077,7 @@ function withoutEmptyQuerySeeds(
 
 async function seedFormVariables() {
   formVarsReady.value = false;
+  settledVariables = null;
   const list = (props.variablesConfig?.list ?? []) as VariableConfig[];
   if (!list.length) return;
   // Dynamic filters are never part of a public link.
@@ -1050,7 +1085,9 @@ async function seedFormVariables() {
     ...props.dashboardData,
     variables: { ...props.dashboardData?.variables, showDynamicFilters: false },
   });
-  formVars.loadFromUrl({ query: withoutEmptyQuerySeeds(variableSeedParams(), list) });
+  // An edited link's empty value is its stored "not set", so it is seeded as is rather than auto-selected.
+  const seed = variableSeedParams();
+  formVars.loadFromUrl({ query: editing.value ? seed : withoutEmptyQuerySeeds(seed, list) });
   Object.keys(formVars.variablesData.tabs).forEach((id) => formVars.setTabVisibility(id, true));
   Object.keys(formVars.variablesData.panels).forEach((id) => formVars.setPanelVisibility(id, true));
   formVarsReady.value = true;
@@ -1065,10 +1102,28 @@ function openForm(link: PublicLink | null) {
 
 function goBack() {
   if (currentView.value === "created") view.value = "list";
-  else closeForm();
+  else void closeForm();
 }
 
-function closeForm() {
+function isFormDirty(): boolean {
+  if (!isEqual(form.state.values, form.options.defaultValues)) return true;
+  return settledVariables !== null && JSON.stringify(frozenVariables()) !== settledVariables;
+}
+
+async function closeForm() {
+  if (isFormDirty()) {
+    const discard = await confirm({
+      title: t("common.unsavedChanges"),
+      message: t("common.unsavedMessage"),
+      confirmLabel: t("common.discardChanges"),
+      cancelLabel: t("common.cancel"),
+    });
+    if (!discard) return;
+  }
+  leaveForm();
+}
+
+function leaveForm() {
   editing.value = null;
   form.reset(publicLinkDefaults());
   // Opened to edit one link from the org-wide list, so leaving the form returns there.
@@ -1116,12 +1171,14 @@ async function submit(value: PublicLinkForm) {
     });
     if (editing.value) {
       showPositiveNotification(t("dashboard.publicLinks.savedToast"));
-      closeForm();
+      leaveForm();
     } else {
       createdLink.value = saved;
       view.value = "created";
     }
   } catch (e: unknown) {
+    // A refusal such as the per-dashboard link limit means the list here is behind the server's.
+    void linksQuery.refetch();
     const refused = forbiddenMessage(
       e,
       t,
@@ -1221,6 +1278,8 @@ watch(
       createdLink.value = null;
       // A dashboard with no links opens straight on the form, so errors from an earlier attempt must not carry over.
       form.reset(publicLinkDefaults());
+      // A cached list misses links made elsewhere since; without data the query is fetching already.
+      if (linksQuery.data.value) void linksQuery.refetch({ cancelRefetch: false });
     }
     pendingEditId.value = editId ?? null;
   },
@@ -1234,6 +1293,11 @@ watch(
   },
   { immediate: true },
 );
+watch(variablesPending, (pending) => {
+  if (!pending && formVarsReady.value && settledVariables === null) {
+    settledVariables = JSON.stringify(frozenVariables());
+  }
+});
 watch(defaultOptions, (options) => {
   const first = options[0];
   if (first && !options.some((o) => o.value === form.state.values.defaultKey)) {
diff --git a/web/src/components/dashboards/PublicLinksTable.spec.ts b/web/src/components/dashboards/PublicLinksTable.spec.ts
index 8a37d48381..f14bc647ac 100644
--- a/web/src/components/dashboards/PublicLinksTable.spec.ts
+++ b/web/src/components/dashboards/PublicLinksTable.spec.ts
@@ -280,6 +280,60 @@ describe("PublicLinksTable", () => {
     expect(find(w, "dashboards-public-links-off-status").exists()).toBe(false);
   });
 
+  it("says when the org has public links off, holds pause and resume, and keeps a paused link's state", async () => {
+    vi.mocked(admin.listOrg).mockResolvedValue({
+      data: {
+        list: [
+          link({ status: "disabled" }),
+          link({ id: "l2", name: "Lobby", status: "disabled", enabled: false }),
+        ],
+      },
+    } as never);
+    vi.mocked(admin.statusBatch).mockResolvedValue({ data: { list: [] } } as never);
+    const w = build();
+    await flushPromises();
+    expect(find(w, "dashboards-public-links-org-disabled").text()).toContain(
+      "Public links are turned off for this organization",
+    );
+    expect(find(w, "dashboards-public-links-l1-pause-btn").attributes("disabled")).toBeDefined();
+    expect(find(w, "dashboards-public-links-l2-resume-btn").attributes("disabled")).toBeDefined();
+    expect(find(w, "dashboards-public-links-l2-resume-menu").attributes("disabled")).toBeDefined();
+    expect(find(w, "dashboards-public-links-l1-status").text()).toBe("Disabled");
+    expect(find(w, "dashboards-public-links-l2-status").text()).toBe("Disabled · Paused");
+  });
+
+  it("shows no org banner while public links are on", async () => {
+    const w = build();
+    await flushPromises();
+    expect(find(w, "dashboards-public-links-org-disabled").exists()).toBe(false);
+  });
+
+  it("counts never-viewed links on their own tile, so Live matches its badges", async () => {
+    vi.mocked(admin.listOrg).mockResolvedValue({
+      data: {
+        list: [
+          link(),
+          link({ id: "n1", status: "not_viewed", access_count: 0, last_accessed_at: null }),
+          link({ id: "n2", status: "not_viewed", access_count: 0, last_accessed_at: null }),
+        ],
+      },
+    } as never);
+    vi.mocked(admin.statusBatch).mockResolvedValue({ data: { list: [] } } as never);
+    const w = build();
+    await flushPromises();
+    expect(find(w, "dashboards-public-links-summary-live").text()).toContain("1");
+    expect(find(w, "dashboards-public-links-summary-not-viewed").text()).toContain("2");
+    expect(find(w, "dashboards-public-links-summary-not-viewed").text()).toContain("Never viewed");
+
+    await selectTile(w, "live");
+    expect(rows(w)).toHaveLength(1);
+    expect(find(w, "dashboards-public-links-l1-status").text()).toBe("Live");
+
+    await selectTile(w, "not-viewed");
+    expect(rows(w)).toHaveLength(2);
+    expect(find(w, "dashboards-public-links-n1-status").text()).toBe("Never viewed");
+  });
+
   it("searches by name, dashboard, folder and publisher", async () => {
     const w = build();
     await flushPromises();
diff --git a/web/src/components/dashboards/PublicLinksTable.vue b/web/src/components/dashboards/PublicLinksTable.vue
index 5ccbc4bfc7..358a5168f2 100644
--- a/web/src/components/dashboards/PublicLinksTable.vue
+++ b/web/src/components/dashboards/PublicLinksTable.vue
@@ -15,6 +15,15 @@
 -->
 <template>
   <div class="flex h-full flex-col" data-test="dashboards-public-links">
+    <OContent v-if="orgDisabled" class="pt-2">
+      <OBanner
+        variant="warning"
+        icon="warning-amber"
+        dense
+        :content="t('dashboard.publicLinks.orgDisabledBanner')"
+        data-test="dashboards-public-links-org-disabled"
+      />
+    </OContent>
     <OTable
       class="min-h-0 flex-1"
       :data="visibleLinks"
@@ -127,6 +136,7 @@
             <OTag
               type="publicLinkStatus"
               :value="statusOf(row)"
+              :label="statusLabel(row, t)"
               :data-test="`dashboards-public-links-${row.id}-status`"
             />
             <OTooltip v-if="statusHints[row.id]" side="bottom" :content="statusHints[row.id]" />
@@ -257,7 +267,7 @@
                 row.enabled ? t('dashboard.publicLinks.pause') : t('dashboard.publicLinks.resume')
               "
               :loading="busyRows.get(row.id) === 'inline'"
-              :disabled="!canPause(row) || busyRows.has(row.id)"
+              :disabled="!canPause(row) || busyRows.has(row.id) || orgDisabled"
               :data-test="`dashboards-public-links-${row.id}-${row.enabled ? 'pause' : 'resume'}-btn`"
               @click="setPaused(row, row.enabled, 'inline')"
             >
@@ -321,7 +331,7 @@
               v-if="canPause(row) && !takeOverReplacesResume(row, userId)"
               :icon-left="row.enabled ? 'pause' : 'play-arrow'"
               class="md:hidden"
-              :disabled="busyRows.has(row.id)"
+              :disabled="busyRows.has(row.id) || orgDisabled"
               :data-test="`dashboards-public-links-${row.id}-${row.enabled ? 'pause' : 'resume'}-menu`"
               @select="setPaused(row, row.enabled, 'menu')"
             >
@@ -411,6 +421,8 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OInput from "@/lib/forms/Input/OInput.vue";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OContent from "@/lib/core/Content/OContent.vue";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OStatStrip from "@/lib/data/StatStrip/OStatStrip.vue";
 import type { StatItem } from "@/lib/data/StatStrip/OStatStrip.types";
 import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
@@ -432,8 +444,10 @@ import {
   canTakeOver,
   displayStatus,
   noDashboardAccess,
+  orgSwitchedOff,
   publicLinkColumns,
   publicLinkSearchTerm,
+  statusLabel,
   statusReason,
   forbiddenMessage,
   pauseBlockedReason,
@@ -447,12 +461,13 @@ import { useFolderIcons } from "@/composables/useFolderIcons";
 import { foldersQuery } from "@/services/common.queries";
 import PublicLinkExpiresCell from "./PublicLinkExpiresCell.vue";
 
-type StatusFilter = "live" | "paused" | "attention" | "expired" | "all";
+type StatusFilter = "live" | "notViewed" | "paused" | "attention" | "expired" | "all";
 /** Where a row action was clicked, so the spinner shows on that control. */
 type RowActionSource = "inline" | "menu";
 
 const FILTER_STATUSES: Record<Exclude<StatusFilter, "all">, PublicLinkStatus[]> = {
-  live: ["live", "not_viewed"],
+  live: ["live"],
+  notViewed: ["not_viewed"],
   paused: ["paused"],
   attention: ["needs_attention"],
   expired: ["expired"],
@@ -475,6 +490,7 @@ const linksQuery = useQuery(() =>
   Object.assign(publicLinksListQuery(orgId.value), { enabled: !!orgId.value }),
 );
 const links = computed(() => linksQuery.data.value ?? []);
+const orgDisabled = computed(() => orgSwitchedOff(links.value));
 const { iconFor } = useFolderIcons();
 const foldersListQuery = useQuery(() =>
   Object.assign(foldersQuery(orgId.value, "dashboards"), { enabled: !!orgId.value }),
@@ -553,6 +569,14 @@ const summaryStats = computed<StatItem[]>(() => {
       tone: "success",
       dataTest: "dashboards-public-links-summary-live",
     },
+    {
+      key: "notViewed",
+      label: t("components.badge.publicLinkStatus.notViewed"),
+      value: countOf("notViewed"),
+      icon: "visibility-off",
+      tone: "neutral",
+      dataTest: "dashboards-public-links-summary-not-viewed",
+    },
     {
       key: "paused",
       label: t("components.badge.publicLinkStatus.paused"),
diff --git a/web/src/components/dashboards/addPanel/ChartSelection.spec.ts b/web/src/components/dashboards/addPanel/ChartSelection.spec.ts
index a55d15e887..719ac081d1 100644
--- a/web/src/components/dashboards/addPanel/ChartSelection.spec.ts
+++ b/web/src/components/dashboards/addPanel/ChartSelection.spec.ts
@@ -294,4 +294,37 @@ describe("ChartSelection", () => {
     expect(li.className.includes("cursor-not-allowed")).toBe(true);
     dashboardPanelData.data.queryType = previous;
   });
+
+  it("lists box plot with its own icon", async () => {
+    const item = wrapper.find("[data-test='selected-chart-boxplot-item']");
+    expect(item.exists()).toBe(true);
+    expect(item.find("img").attributes("src")).toContain("charts/boxplot.svg");
+    await item.trigger("click");
+    expect(wrapper.emitted()["update:selectedChartType"].at(-1)).toEqual(["boxplot"]);
+  });
+
+  it("in PromQL mode disables box plot", async () => {
+    const { dashboardPanelData } = wrapper.vm;
+    const previous = dashboardPanelData.data.queryType;
+    dashboardPanelData.data.queryType = "promql";
+    await flushPromises();
+    const li = wrapper.find("[data-test='selected-chart-boxplot-item']").element.closest("li");
+    expect(li.className.includes("cursor-not-allowed")).toBe(true);
+    dashboardPanelData.data.queryType = previous;
+  });
+
+  it("lists logs with its own icon, and disables it on PromQL", async () => {
+    const { dashboardPanelData } = wrapper.vm;
+    const item = wrapper.find("[data-test='selected-chart-logs-item']");
+    expect(item.exists()).toBe(true);
+    expect(item.find("img").attributes("src")).toContain("charts/logs.svg");
+    await item.trigger("click");
+    expect(wrapper.emitted()["update:selectedChartType"].at(-1)).toEqual(["logs"]);
+    const previous = dashboardPanelData.data.queryType;
+    dashboardPanelData.data.queryType = "promql";
+    await flushPromises();
+    const li = wrapper.find("[data-test='selected-chart-logs-item']").element.closest("li");
+    expect(li.className.includes("cursor-not-allowed")).toBe(true);
+    dashboardPanelData.data.queryType = previous;
+  });
 });
diff --git a/web/src/components/dashboards/addPanel/ChartSelection.vue b/web/src/components/dashboards/addPanel/ChartSelection.vue
index 815df5f653..02218880cc 100644
--- a/web/src/components/dashboards/addPanel/ChartSelection.vue
+++ b/web/src/components/dashboards/addPanel/ChartSelection.vue
@@ -145,6 +145,11 @@ export default defineComponent({
         title: t("dashboard.heatmapLabel"),
         id: "heatmap",
       },
+      {
+        image: "img:" + getImageURL("images/dashboard/charts/boxplot.svg"),
+        title: t("dashboard.chartSelection.boxplot"),
+        id: "boxplot",
+      },
       {
         image: "img:" + getImageURL("images/dashboard/charts/distribution.svg"),
         title: t("dashboard.chartSelection.distribution"),
@@ -175,6 +180,11 @@ export default defineComponent({
         title: t("dashboard.chartSelection.gauge"),
         id: "gauge",
       },
+      {
+        image: "img:" + getImageURL("images/dashboard/charts/logs.svg"),
+        title: t("dashboard.chartSelection.logs"),
+        id: "logs",
+      },
       {
         image: "img:" + getImageURL("images/dashboard/charts/bar-gauge.svg"),
         title: t("dashboard.chartSelection.barGauge"),
diff --git a/web/src/components/dashboards/addPanel/ConfigPanel.boxplot.spec.ts b/web/src/components/dashboards/addPanel/ConfigPanel.boxplot.spec.ts
new file mode 100644
index 0000000000..d77e2baee3
--- /dev/null
+++ b/web/src/components/dashboards/addPanel/ConfigPanel.boxplot.spec.ts
@@ -0,0 +1,209 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { computed, reactive } from "vue";
+
+vi.mock("@/composables/dashboard/useDashboardPanel", () => ({
+  default: vi.fn(),
+  useDashboardPanelData: vi.fn(),
+}));
+
+vi.mock("@/utils/dashboard/searchLabelsConfig", async (importOriginal) => {
+  const actual = (await importOriginal()) as Record<string, unknown>;
+  const allExpanded = Object.fromEntries(
+    Object.keys(actual.DEFAULT_EXPANDED_SECTIONS as Record<string, boolean>).map((k) => [k, true]),
+  );
+  return { ...actual, DEFAULT_EXPANDED_SECTIONS: allExpanded };
+});
+
+// JSDOM has no layout, so the real virtualizer renders no rows; render them all.
+vi.mock("@tanstack/vue-virtual", async () => {
+  const { computed: vueComputed, unref } = await import("vue");
+  return {
+    useVirtualizer: (options: any) =>
+      vueComputed(() => {
+        const count = unref(options).count;
+        return {
+          getVirtualItems: () =>
+            Array.from({ length: count }, (_, index) => ({
+              index,
+              key: index,
+              start: index * 28,
+              size: 28,
+              end: (index + 1) * 28,
+              lane: 0,
+            })),
+          getTotalSize: () => count * 28,
+          scrollToIndex: () => {},
+          measureElement: () => {},
+        };
+      }),
+  };
+});
+
+import ConfigPanel from "@/components/dashboards/addPanel/ConfigPanel.vue";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import useDashboardPanelData from "@/composables/dashboard/useDashboardPanel";
+
+const makePanel = (type: string, config: Record<string, unknown> = {}) =>
+  reactive<any>({
+    data: {
+      id: "panel-1",
+      title: "Test Panel",
+      description: "",
+      type,
+      queries: [
+        {
+          query: "SELECT * FROM test",
+          queryType: "sql",
+          fields: {
+            breakdown: [],
+            y: [
+              { alias: "y_axis_1", label: "Latency" },
+              { alias: "y_axis_2", label: "Size" },
+            ],
+          },
+          config: { time_shift: [], limit: 1000 },
+        },
+      ],
+      config: {
+        unit: "milliseconds",
+        unit_custom: "",
+        step_value: 0,
+        top_results: 10,
+        trellis: { layout: "horizontal", num_of_columns: 1, group_by_y_axis: false },
+        legend_width: { value: null, unit: "px" },
+        label_option: { position: null, rotate: 0 },
+        map_type: { type: "world" },
+        base_map: { type: "osm" },
+        map_symbol_style: { size: "by Value", size_by_value: { min: 1, max: 100 }, size_fixed: 2 },
+        ...config,
+      },
+    },
+    layout: { currentQueryIndex: 0 },
+    meta: {
+      dateTime: {
+        start_time: new Date("2023-01-01T00:00:00Z"),
+        end_time: new Date("2023-01-01T23:59:59Z"),
+      },
+      stream: { selectedStreamFields: [] },
+    },
+  });
+
+describe("ConfigPanel box plot settings", { timeout: 30_000 }, () => {
+  let wrapper: VueWrapper<any> | undefined;
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = undefined;
+    document.body.innerHTML = "";
+  });
+
+  const mountPanel = (type: string, config: Record<string, unknown> = {}, promql = false) => {
+    const panel = makePanel(type, config);
+    vi.mocked(useDashboardPanelData).mockReturnValue({
+      dashboardPanelData: panel,
+      promqlMode: promql,
+      isPivotMode: computed(() => false),
+      selectedStreamFields: [],
+    } as any);
+    store.state.selectedOrganization = { identifier: "test-org" };
+    wrapper = mount(ConfigPanel, {
+      attachTo: document.body,
+      props: { variablesData: { values: [] }, panelData: {} },
+      global: {
+        plugins: [i18n, store],
+        provide: { dashboardPanelDataPageKey: "dashboard" },
+        stubs: {
+          ColorBySeries: { template: "<div />" },
+          OverrideConfig: { template: "<div />" },
+          ValueMapping: { template: "<div />" },
+        },
+      },
+    });
+    return panel;
+  };
+
+  const has = (test: string) => wrapper!.find(`[data-test="${test}"]`).exists();
+  const isShown = (test: string) => {
+    const el = wrapper!.find(`[data-test="${test}"]`);
+    return el.exists() && el.isVisible();
+  };
+  const whiskerSelect = (): any =>
+    wrapper!
+      .findAllComponents({ name: "OSelect" })
+      .find(
+        (component: any) =>
+          component.attributes("data-test") === "dashboard-config-boxplot_whisker",
+      );
+  const pick = async (test: string, value: string) => {
+    const option = wrapper!.find(`[data-test="${test}-option"][data-test-label="${value}"]`);
+    if (option.exists()) await option.trigger("click");
+    else {
+      const select: any = wrapper!
+        .findAllComponents({ name: "OSelect" })
+        .find((component: any) => component.attributes("data-test") === test);
+      expect(select, test).toBeTruthy();
+      const match = select.props("options").find((entry: any) => entry.label === value);
+      select.vm.$emit("update:modelValue", match.value);
+    }
+    await flushPromises();
+  };
+  it("mounting writes no box plot key", async () => {
+    const panel = mountPanel("boxplot");
+    const before = JSON.stringify(panel.data.config);
+    await flushPromises();
+    expect(JSON.stringify(panel.data.config)).toBe(before);
+  });
+
+  it("box plot: writes the whisker mode", async () => {
+    const panel = mountPanel("boxplot");
+    await flushPromises();
+    expect(isShown("dashboard-config-boxplot_whisker")).toBe(true);
+    await pick("dashboard-config-boxplot_whisker", "1.5 × IQR");
+    expect(panel.data.config.boxplot_whisker).toBe("iqr");
+  });
+
+  it("box plot: summarises in SQL, so the query limit shows no raw-row cap", async () => {
+    mountPanel("boxplot");
+    await flushPromises();
+    expect(
+      wrapper!.find('[data-test="dashboard-config-limit-field"]').attributes("placeholder"),
+    ).toBe("0");
+  });
+
+  it("box plot: the Default whisker choice names min to max and picking it deletes the key", async () => {
+    const panel = mountPanel("boxplot");
+    await flushPromises();
+    const options = whiskerSelect().props("options");
+    expect(options[0].label).toBe("Default (Min to max)");
+    await pick("dashboard-config-boxplot_whisker", "1.5 × IQR");
+    expect(panel.data.config.boxplot_whisker).toBe("iqr");
+    await pick("dashboard-config-boxplot_whisker", "Default (Min to max)");
+    expect("boxplot_whisker" in panel.data.config).toBe(false);
+  });
+
+  it("pie: shows no whisker control", async () => {
+    mountPanel("pie");
+    await flushPromises();
+    expect(has("dashboard-config-boxplot_whisker")).toBe(false);
+    expect(
+      wrapper!.find('[data-test="dashboard-config-limit-field"]').attributes("placeholder"),
+    ).toBe("0");
+  });
+});
diff --git a/web/src/components/dashboards/addPanel/ConfigPanel.logs.spec.ts b/web/src/components/dashboards/addPanel/ConfigPanel.logs.spec.ts
new file mode 100644
index 0000000000..3ebe16addc
--- /dev/null
+++ b/web/src/components/dashboards/addPanel/ConfigPanel.logs.spec.ts
@@ -0,0 +1,316 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { computed, reactive } from "vue";
+
+vi.mock("@/composables/dashboard/useDashboardPanel", () => ({
+  default: vi.fn(),
+  useDashboardPanelData: vi.fn(),
+}));
+
+vi.mock("@/services/common", () => ({
+  default: {
+    list_Folders: vi.fn(async () => ({
+      data: { list: [{ name: "Payments", folderId: "payments", description: "" }] },
+    })),
+  },
+}));
+
+vi.mock("@/utils/dashboard/searchLabelsConfig", async (importOriginal) => {
+  const actual = (await importOriginal()) as Record<string, unknown>;
+  const allExpanded = Object.fromEntries(
+    Object.keys(actual.DEFAULT_EXPANDED_SECTIONS as Record<string, boolean>).map((k) => [k, true]),
+  );
+  return { ...actual, DEFAULT_EXPANDED_SECTIONS: allExpanded };
+});
+
+// JSDOM has no layout, so the real virtualizer renders no rows; render them all.
+vi.mock("@tanstack/vue-virtual", async () => {
+  const { computed: vueComputed, unref } = await import("vue");
+  return {
+    useVirtualizer: (options: any) =>
+      vueComputed(() => {
+        const count = unref(options).count;
+        return {
+          getVirtualItems: () =>
+            Array.from({ length: count }, (_, index) => ({
+              index,
+              key: index,
+              start: index * 28,
+              size: 28,
+              end: (index + 1) * 28,
+              lane: 0,
+            })),
+          getTotalSize: () => count * 28,
+          scrollToIndex: () => {},
+          measureElement: () => {},
+        };
+      }),
+  };
+});
+
+import ConfigPanel from "@/components/dashboards/addPanel/ConfigPanel.vue";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import useDashboardPanelData from "@/composables/dashboard/useDashboardPanel";
+import { markPanelStarterQuery } from "@/composables/dashboard/usePanelAggregation";
+import { QueryClient, VueQueryPlugin } from "@tanstack/vue-query";
+
+const makePanel = (type: string, config: Record<string, unknown> = {}) =>
+  reactive<any>({
+    data: {
+      id: "panel-1",
+      title: "Test Panel",
+      description: "",
+      type,
+      queryType: "sql",
+      queries: [
+        {
+          query: 'SELECT * FROM "demo_app"',
+          customQuery: true,
+          fields: { breakdown: [], x: [], y: [] },
+          config: { time_shift: [], limit: 1000 },
+        },
+      ],
+      config: {
+        unit: null,
+        unit_custom: "",
+        trellis: { layout: null, num_of_columns: 1, group_by_y_axis: false },
+        legend_width: { value: null, unit: "px" },
+        label_option: { position: null, rotate: 0 },
+        map_type: { type: "world" },
+        base_map: { type: "osm" },
+        map_symbol_style: { size: "by Value", size_by_value: { min: 1, max: 100 }, size_fixed: 2 },
+        ...config,
+      },
+    },
+    layout: { currentQueryIndex: 0 },
+    meta: {
+      dateTime: {
+        start_time: new Date("2023-01-01T00:00:00Z"),
+        end_time: new Date("2023-01-01T23:59:59Z"),
+      },
+      stream: {
+        selectedStreamFields: [],
+        customQueryFields: [{ name: "message" }, { name: "level" }, { name: "stack" }],
+      },
+    },
+  });
+
+describe("ConfigPanel logs settings", { timeout: 30_000 }, () => {
+  let wrapper: VueWrapper<any> | undefined;
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = undefined;
+    document.body.innerHTML = "";
+  });
+
+  const mountPanel = async (
+    type: string,
+    config: Record<string, unknown> = {},
+    adjust: (panel: any) => void = () => {},
+  ) => {
+    const panel = makePanel(type, config);
+    adjust(panel);
+    vi.mocked(useDashboardPanelData).mockReturnValue({
+      dashboardPanelData: panel,
+      promqlMode: false,
+      isPivotMode: computed(() => false),
+      selectedStreamFields: [],
+    } as any);
+    store.state.selectedOrganization = { identifier: "test-org" };
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    wrapper = mount(ConfigPanel, {
+      attachTo: document.body,
+      props: { variablesData: { values: [] }, panelData: {} },
+      global: {
+        plugins: [i18n, store, [VueQueryPlugin, { queryClient }]],
+        provide: { dashboardPanelDataPageKey: "dashboard" },
+        stubs: {
+          ColorBySeries: { template: "<div />" },
+          OverrideConfig: { template: "<div />" },
+          ValueMapping: { template: "<div />" },
+        },
+      },
+    });
+    // The section bodies are async components; wait for their imports before asserting.
+    await vi.dynamicImportSettled();
+    await flushPromises();
+    return panel;
+  };
+
+  const has = (test: string) => wrapper!.find(`[data-test="${test}"]`).exists();
+  const isShown = (test: string) => {
+    const el = wrapper!.find(`[data-test="${test}"]`);
+    return el.exists() && el.isVisible();
+  };
+  const selectFor = (test: string) =>
+    wrapper!
+      .findAllComponents({ name: "OSelect" })
+      .find((component: any) => component.attributes("data-test") === test)!;
+  const pick = async (test: string, value: string) => {
+    const option = wrapper!.find(`[data-test="${test}-option"][data-test-label="${value}"]`);
+    if (option.exists()) await option.trigger("click");
+    else {
+      const match = selectFor(test)
+        .props("options")
+        .find((entry: any) => entry.label === value);
+      selectFor(test).vm.$emit("update:modelValue", match.value);
+    }
+    await flushPromises();
+  };
+  const emitFrom = async (name: string, test: string, value: unknown) => {
+    const control = wrapper!
+      .findAllComponents({ name })
+      .find((component: any) => component.attributes("data-test") === test);
+    expect(control, test).toBeTruthy();
+    control!.vm.$emit("update:modelValue", value);
+    await flushPromises();
+  };
+
+  it("mounting writes none of the new keys", async () => {
+    for (const chart of ["logs"]) {
+      const panel = await mountPanel(chart);
+      const before = JSON.stringify(panel.data.config);
+      await flushPromises();
+      expect(JSON.stringify(panel.data.config), chart).toBe(before);
+      wrapper!.unmount();
+      wrapper = undefined;
+    }
+  });
+
+  it("logs: shows only its own settings and the general section", async () => {
+    await mountPanel("logs");
+    expect(isShown("dashboard-config-logs_order")).toBe(true);
+    expect(isShown("dashboard-config-logs_message_field")).toBe(true);
+    expect(isShown("dashboard-config-description")).toBe(true);
+    expect(isShown("dashboard-config-show-legend")).toBe(false);
+    expect(isShown("dashboard-config-unit")).toBe(false);
+  });
+
+  it("logs: writes the order, field names and switches, and clearing a field deletes it", async () => {
+    const panel = await mountPanel("logs");
+    await pick("dashboard-config-logs_order", "Oldest first");
+    await emitFrom("OCombobox", "dashboard-config-logs_message_field", " message ");
+    await emitFrom("OSwitch", "dashboard-config-logs_wrap", true);
+    await emitFrom("OSwitch", "dashboard-config-logs_show_time", false);
+    await emitFrom("OSwitch", "dashboard-config-logs_prettify_json", false);
+    expect(panel.data.config).toMatchObject({
+      logs_order: "oldest",
+      logs_message_field: "message",
+      logs_wrap: true,
+      logs_show_time: false,
+      logs_prettify_json: false,
+    });
+    await emitFrom("OCombobox", "dashboard-config-logs_message_field", "");
+    await emitFrom("OSwitch", "dashboard-config-logs_wrap", false);
+    await emitFrom("OSwitch", "dashboard-config-logs_show_time", true);
+    await emitFrom("OSwitch", "dashboard-config-logs_prettify_json", true);
+    for (const key of ["logs_message_field", "logs_wrap", "logs_show_time", "logs_prettify_json"]) {
+      expect(key in panel.data.config, key).toBe(false);
+    }
+  });
+
+  it("logs: names each default — newest first for the order, auto from data for the fields", async () => {
+    const panel = await mountPanel("logs");
+    const labels = selectFor("dashboard-config-logs_order")
+      .props("options")
+      .map((option: any) => option.label);
+    expect(labels[0]).toBe("Default (Newest first)");
+    await pick("dashboard-config-logs_order", "Oldest first");
+    await pick("dashboard-config-logs_order", "Default (Newest first)");
+    expect("logs_order" in panel.data.config).toBe(false);
+    const field = wrapper!
+      .findAllComponents({ name: "OCombobox" })
+      .find(
+        (component: any) =>
+          component.attributes("data-test") === "dashboard-config-logs_level_field",
+      );
+    expect(field!.props("placeholder")).toBe("Default (auto from data)");
+  });
+
+  it("logs: the order flips an untouched starter query and leaves hand-written SQL alone", async () => {
+    const starter = 'SELECT * FROM "demo_app" ORDER BY _timestamp DESC LIMIT 100';
+    const panel = await mountPanel("logs", {}, (draft) => {
+      draft.data.queries[0].query = starter;
+      markPanelStarterQuery(draft.data.queries[0]);
+    });
+    await pick("dashboard-config-logs_order", "Oldest first");
+    expect(panel.data.queries[0].query).toBe(
+      'SELECT * FROM "demo_app" ORDER BY _timestamp ASC LIMIT 100',
+    );
+    await pick("dashboard-config-logs_order", "Default (Newest first)");
+    expect(panel.data.queries[0].query).toBe(starter);
+    panel.data.queries[0].query = "SELECT * FROM \"demo_app\" WHERE level = 'error'";
+    await pick("dashboard-config-logs_order", "Oldest first");
+    expect(panel.data.queries[0].query).toBe("SELECT * FROM \"demo_app\" WHERE level = 'error'");
+    expect(has("dashboard-config-logs_order-info")).toBe(true);
+  });
+
+  it("logs: offers the stream's columns when the query selects every column", async () => {
+    await mountPanel("logs", {}, (panel) => {
+      panel.data.queries[0].fields.stream = "demo_app";
+      panel.meta.stream.customQueryFields = [];
+      panel.meta.streamFields = {
+        groupedFields: [
+          {
+            name: "demo_app",
+            schema: [{ name: "_timestamp" }, { name: "level" }, { name: "message" }],
+          },
+          { name: "other_stream", schema: [{ name: "unrelated" }] },
+        ],
+      };
+    });
+    const combobox = wrapper!
+      .findAllComponents({ name: "OCombobox" })
+      .find(
+        (component: any) =>
+          component.attributes("data-test") === "dashboard-config-logs_message_field",
+      );
+    expect(combobox!.props("items").map((item: any) => item.value)).toEqual([
+      "_timestamp",
+      "level",
+      "message",
+    ]);
+  });
+
+  it("logs: offers only the query's named columns when it names them", async () => {
+    await mountPanel("logs", {}, (panel) => {
+      panel.meta.streamFields = { groupedFields: [{ name: "demo_app", schema: [{ name: "x" }] }] };
+    });
+    const combobox = wrapper!
+      .findAllComponents({ name: "OCombobox" })
+      .find(
+        (component: any) =>
+          component.attributes("data-test") === "dashboard-config-logs_level_field",
+      );
+    expect(combobox!.props("items").map((item: any) => item.value)).toEqual([
+      "message",
+      "level",
+      "stack",
+    ]);
+  });
+
+  it("other charts show none of the new controls", async () => {
+    await mountPanel("line");
+    for (const key of ["logs_order", "logs_message_field"]) {
+      expect(has(`dashboard-config-${key}`), key).toBe(false);
+    }
+    expect(isShown("dashboard-config-show-legend")).toBe(true);
+  });
+});
diff --git a/web/src/components/dashboards/addPanel/ConfigPanel.vue b/web/src/components/dashboards/addPanel/ConfigPanel.vue
index 28ba2e11e7..add6baff9f 100644
--- a/web/src/components/dashboards/addPanel/ConfigPanel.vue
+++ b/web/src/components/dashboards/addPanel/ConfigPanel.vue
@@ -928,6 +928,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           />
         </template>
 
+        <template v-if="dashboardPanelData.data.type === 'boxplot'">
+          <OSelect
+            v-show="isConfigOptionVisible('data', 'boxplot-whisker')"
+            :label="t('dashboard.boxplotWhisker')"
+            v-model="boxplotWhiskerModel"
+            :options="boxplotWhiskerOptions"
+            data-test="dashboard-config-boxplot_whisker"
+          />
+        </template>
+
         <OSwitch
           v-if="promqlMode && dashboardPanelData.data.type === 'heatmap'"
           v-show="isConfigOptionVisible('data', 'heatmap-histogram-mode')"
@@ -3474,6 +3484,25 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         />
       </div>
     </OCollapsible>
+
+    <OCollapsible
+      variant="config"
+      v-if="dashboardPanelData.data.type == 'logs'"
+      v-show="isSectionVisible('logs')"
+      :model-value="isExpanded('logs')"
+      :icon="SECTION_ICONS.logs"
+      @update:modelValue="
+        (v) => {
+          expandedSections.logs = v;
+        }
+      "
+      :label="t('dashboard.chartSelection.logs')"
+      class="border-card-glass-border border-t border-solid"
+    >
+      <div class="o2-input box-border flex flex-col gap-2.5 overflow-x-hidden px-3 py-2.5">
+        <LogsPanelConfig :is-option-visible="(id: string) => isConfigOptionVisible('logs', id)" />
+      </div>
+    </OCollapsible>
   </div>
 </template>
 
@@ -3515,6 +3544,7 @@ import {
   defaultPlaceholder,
   withDefaultChoice,
 } from "@/utils/dashboard/optionDefaults";
+import { BOXPLOT_WHISKERS, DEFAULT_BOXPLOT_WHISKER } from "@/utils/dashboard/convertBoxplotData";
 import {
   BAR_GAUGE_MODES,
   BAR_GAUGE_ORIENTATIONS,
@@ -3683,6 +3713,7 @@ import { getFieldLabel } from "@/utils/dashboard/fieldLabel";
 
 const AlertListPanelConfig = defineAsyncComponent(() => import("./AlertListPanelConfig.vue"));
 const FlameGraphPanelConfig = defineAsyncComponent(() => import("./FlameGraphPanelConfig.vue"));
+const LogsPanelConfig = defineAsyncComponent(() => import("./LogsPanelConfig.vue"));
 
 export default defineComponent({
   components: {
@@ -3710,6 +3741,7 @@ export default defineComponent({
     SparklineConfig,
     AlertListPanelConfig,
     FlameGraphPanelConfig,
+    LogsPanelConfig,
     PromQLChartConfig,
     OButton,
     OTooltip,
@@ -4033,6 +4065,14 @@ export default defineComponent({
       ],
       DEFAULT_NODE_GRAPH_LAYOUT,
     );
+    const boxplotWhiskerModel = choiceModel("boxplot_whisker", BOXPLOT_WHISKERS);
+    const boxplotWhiskerOptions = withDefault(
+      [
+        { label: t("dashboard.boxplotWhiskerMinMax"), value: "minmax" },
+        { label: t("dashboard.boxplotWhiskerIqr"), value: "iqr" },
+      ],
+      DEFAULT_BOXPLOT_WHISKER,
+    );
     // Absent, the converters label SQL slices by percent and PromQL slices by all three, so the picker starts there.
     const pieLabelContentDefault = () =>
       unref(promqlMode) ? ["name", "value", "percent"] : ["percent"];
@@ -4822,6 +4862,7 @@ export default defineComponent({
         "pie",
         "donut",
         "gauge",
+        "boxplot",
         "bar-gauge",
         "distribution",
         "treemap",
@@ -5177,6 +5218,8 @@ export default defineComponent({
       statTextModeOptions,
       gaugeStyleModel,
       gaugeStyleOptions,
+      boxplotWhiskerModel,
+      boxplotWhiskerOptions,
       barGaugeModeModel,
       barGaugeModeOptions,
       barGaugeRangeModeModel,
diff --git a/web/src/components/dashboards/addPanel/DashboardQueryBuilder.spec.ts b/web/src/components/dashboards/addPanel/DashboardQueryBuilder.spec.ts
index 870a6abafa..883b38f95a 100644
--- a/web/src/components/dashboards/addPanel/DashboardQueryBuilder.spec.ts
+++ b/web/src/components/dashboards/addPanel/DashboardQueryBuilder.spec.ts
@@ -217,6 +217,7 @@ const i18n = createI18n({
         wellGroup: "Group",
         wellSubgroup: "Sub-group",
         wellSize: "Size",
+        wellCategory: "Category",
         joins: "Joins",
         addJoin: "Add Join",
       },
@@ -586,6 +587,15 @@ describe("DashboardQueryBuilder", () => {
       expect(text).not.toContain("X-Axis");
     });
 
+    it("names the box plot wells by their job", () => {
+      const wells = (type: string) => {
+        wrapper?.unmount();
+        wrapper = createWrapper({ "data.type": type });
+        return [wrapper.vm.currentXLabel, wrapper.vm.currentYLabel];
+      };
+      expect(wells("boxplot")).toEqual(["Category", "Value"]);
+    });
+
     it("should handle x-axis field removal", async () => {
       mockUseDashboardPanelData.removeXAxisItem("field1");
       expect(mockUseDashboardPanelData.removeXAxisItem).toHaveBeenCalledWith("field1");
diff --git a/web/src/components/dashboards/addPanel/DashboardQueryBuilder.vue b/web/src/components/dashboards/addPanel/DashboardQueryBuilder.vue
index 49668c229e..f9883dd048 100644
--- a/web/src/components/dashboards/addPanel/DashboardQueryBuilder.vue
+++ b/web/src/components/dashboards/addPanel/DashboardQueryBuilder.vue
@@ -462,7 +462,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       .fields.y[index]
                   "
                   :allowAggregation="
-                    !['heatmap', 'distribution'].includes(dashboardPanelData.data.type)
+                    !['heatmap', 'distribution', 'boxplot'].includes(dashboardPanelData.data.type)
                   "
                   :customQuery="
                     dashboardPanelData.data.queries[dashboardPanelData.layout.currentQueryIndex]
@@ -794,6 +794,8 @@ export default defineComponent({
         case "treemap":
         case "sunburst":
           return { x: t("panel.wellGroup"), y: t("panel.wellSize"), b: t("panel.wellSubgroup") };
+        case "boxplot":
+          return { x: t("panel.wellCategory"), y: t("panel.value"), b: null };
         default:
           return null;
       }
@@ -1214,6 +1216,7 @@ export default defineComponent({
           return t("dashboard.oneFieldMessage");
         case "gauge":
         case "bar-gauge":
+        case "boxplot":
           return t("dashboard.dashboardQueryBuilder.addZeroOrOneLabelField");
         default:
           return t("dashboard.maxtwofieldMessage");
@@ -1247,6 +1250,7 @@ export default defineComponent({
           return t("dashboard.oneValueFieldMessage");
         case "heatmap":
         case "state-timeline":
+        case "boxplot":
         case "hostmap":
           return t("dashboard.oneFieldMessage");
         default:
diff --git a/web/src/components/dashboards/addPanel/DashboardQueryEditor.completionInputs.spec.ts b/web/src/components/dashboards/addPanel/DashboardQueryEditor.completionInputs.spec.ts
index bc6e56c5a4..e89c6ad718 100644
--- a/web/src/components/dashboards/addPanel/DashboardQueryEditor.completionInputs.spec.ts
+++ b/web/src/components/dashboards/addPanel/DashboardQueryEditor.completionInputs.spec.ts
@@ -15,7 +15,7 @@
 
 import { describe, expect, it, beforeEach, vi, afterEach } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
-import { reactive, nextTick } from "vue";
+import { computed, reactive, nextTick } from "vue";
 
 const spies = vi.hoisted(() => ({
   updateAllKeywords: vi.fn(),
@@ -93,6 +93,7 @@ import DashboardQueryEditor from "@/components/dashboards/addPanel/DashboardQuer
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
 import router from "@/test/unit/helpers/router";
+import { RECENT_SEARCHES_EDITOR_HOST } from "@/composables/queryHistory/useRecentSearchesEditorHost";
 
 // Panel pages store Date objects whose getTime() is already in microseconds.
 const MINUTE_US = 60_000_000;
@@ -283,4 +284,45 @@ describe("DashboardQueryEditor completion inputs", () => {
       expect(spies.setValuesTimeRange).toHaveBeenLastCalledWith(null);
     });
   });
+
+  describe("recent searches from the Metrics page", () => {
+    const QueryEditorStub = {
+      name: "QueryEditor",
+      props: ["recentQueries"],
+      emits: ["focus", "user-edit"],
+      template: "<div />",
+    };
+    const mountWith = (provide: Record<string | symbol, unknown>) =>
+      mount(DashboardQueryEditor, {
+        global: {
+          plugins: [i18n, store, router],
+          provide: { dashboardPanelDataPageKey: "metrics", ...provide },
+          stubs: { QueryTypeSelector: true, QueryEditor: QueryEditorStub },
+        },
+      });
+
+    it("offers the page's recent queries and reports focus and edits", async () => {
+      const host = {
+        queries: computed(() => ["rate(http_requests_total[5m])"]),
+        onFocus: vi.fn(),
+        onEdit: vi.fn(),
+        onKeydown: vi.fn(),
+      };
+      wrapper = mountWith({ [RECENT_SEARCHES_EDITOR_HOST as symbol]: host });
+      await flushPromises();
+      const editor = wrapper.findComponent({ name: "QueryEditor" });
+      expect(editor.props("recentQueries")).toEqual(["rate(http_requests_total[5m])"]);
+
+      editor.vm.$emit("focus");
+      expect(host.onFocus).toHaveBeenCalledWith(expect.any(HTMLElement));
+      editor.vm.$emit("user-edit");
+      expect(host.onEdit).toHaveBeenCalled();
+    });
+
+    it("offers nothing on a dashboard, which provides no host", async () => {
+      wrapper = mountWith({});
+      await flushPromises();
+      expect(wrapper.findComponent({ name: "QueryEditor" }).props("recentQueries")).toEqual([]);
+    });
+  });
 });
diff --git a/web/src/components/dashboards/addPanel/DashboardQueryEditor.spec.ts b/web/src/components/dashboards/addPanel/DashboardQueryEditor.spec.ts
index 7a840dba99..7430deba62 100644
--- a/web/src/components/dashboards/addPanel/DashboardQueryEditor.spec.ts
+++ b/web/src/components/dashboards/addPanel/DashboardQueryEditor.spec.ts
@@ -435,6 +435,22 @@ describe("DashboardQueryEditor", () => {
       expect(wrapper.vm.dashboardPanelData.data.queries.length).toBe(2);
     });
 
+    it("warns that a box plot draws only query 1 once a second query exists", async () => {
+      wrapper = createWrapper();
+      const panelData = wrapper.vm.dashboardPanelData.data;
+      const previousType = panelData.type;
+      panelData.type = "boxplot";
+      await wrapper.vm.$nextTick();
+      expect(wrapper.vm.multiQueryWarning).toBeNull();
+
+      // The mocked addQuery pushes onto the raw object, which computed values never see.
+      panelData.queries.push({ query: "", queryType: "sql", customQuery: true });
+      await wrapper.vm.$nextTick();
+      expect(wrapper.vm.multiQueryWarning).toContain("Box plot");
+      panelData.queries.pop();
+      panelData.type = previousType;
+    });
+
     it("should handle query index changes", async () => {
       wrapper = createWrapper();
 
diff --git a/web/src/components/dashboards/addPanel/DashboardQueryEditor.vue b/web/src/components/dashboards/addPanel/DashboardQueryEditor.vue
index 8f813d656a..9bdeedcddb 100644
--- a/web/src/components/dashboards/addPanel/DashboardQueryEditor.vue
+++ b/web/src/components/dashboards/addPanel/DashboardQueryEditor.vue
@@ -257,7 +257,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               <div class="bg-border-default h-full w-1 transition-colors hover:bg-[orange]"></div>
             </template>
             <template #before>
-              <div class="relative h-full w-full">
+              <div
+                ref="queryEditorBoxRef"
+                class="relative h-full w-full"
+                @keydown.capture="recentHost?.onKeydown($event)"
+              >
                 <UnifiedQueryEditor
                   ref="queryEditorRef"
                   :languages="['sql', 'promql']"
@@ -275,8 +279,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :suggestions="currentEditorSuggestions"
                   :field-value-resolver="resolveFieldValues"
                   :values-time-range="valuesTimeRange"
+                  :recent-queries="recentQueries"
                   @update:query="handleQueryUpdate"
-                  @focus="_sqlOnFocus"
+                  @user-edit="
+                    (isBlank: boolean, wasBlank: boolean) => recentHost?.onEdit(isBlank, wasBlank)
+                  "
+                  @focus="onQueryEditorFocus"
                   @blur="_sqlOnBlur"
                   @language-change="handleLanguageChange"
                   @ask-ai="handleAskAI"
@@ -411,6 +419,7 @@ import OSplitter from "@/lib/core/Splitter/OSplitter.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import useBreakpoint from "@/composables/useBreakpoint";
+import { RECENT_SEARCHES_EDITOR_HOST } from "@/composables/queryHistory/useRecentSearchesEditorHost";
 import {
   formulaInputs,
   formulaRefs,
@@ -462,6 +471,9 @@ export default defineComponent({
     const { showErrorNotification, showPositiveNotification } = useNotifications();
     const store = useStore();
     const dashboardPanelDataPageKey = inject("dashboardPanelDataPageKey", "dashboard");
+    // Only the Metrics page provides it; dashboards get no recents.
+    const recentHost = inject(RECENT_SEARCHES_EDITOR_HOST, null);
+    const queryEditorBoxRef = ref<HTMLElement | null>(null);
 
     const { getAllFunctions } = useFunctions();
     const functionList = ref<FunctionListItem[]>([]);
@@ -622,6 +634,12 @@ export default defineComponent({
         });
       }
 
+      if (dashboardPanelData.data.type === "boxplot") {
+        return t("dashboard.multiQueryWarning", {
+          chartType: t("dashboard.chartSelection.boxplot"),
+        });
+      }
+
       return null;
     });
 
@@ -1157,10 +1175,21 @@ export default defineComponent({
       editingQueryName.value = "";
     };
 
+    const recentQueries = computed(() => recentHost?.queries.value ?? []);
+
+    const onQueryEditorFocus = () => {
+      _sqlOnFocus();
+      recentHost?.onFocus(queryEditorBoxRef.value);
+    };
+
     return {
       raw,
       t,
       router,
+      recentHost,
+      queryEditorBoxRef,
+      recentQueries,
+      onQueryEditorFocus,
       onDropDownClick,
       promqlMode,
       dashboardPanelData,
diff --git a/web/src/components/dashboards/addPanel/DrilldownPopUp.vue b/web/src/components/dashboards/addPanel/DrilldownPopUp.vue
index c0e4b4b0e9..9b5a1e5551 100644
--- a/web/src/components/dashboards/addPanel/DrilldownPopUp.vue
+++ b/web/src/components/dashboards/addPanel/DrilldownPopUp.vue
@@ -643,7 +643,7 @@ export default defineComponent({
           });
         });
       } else if (
-        ["pie", "donut", "gauge", "bar-gauge", "treemap", "sunburst", "funnel"].includes(
+        ["pie", "donut", "gauge", "bar-gauge", "treemap", "sunburst", "funnel", "boxplot"].includes(
           dashboardPanelData.data.type,
         )
       ) {
diff --git a/web/src/components/dashboards/addPanel/LogsPanelConfig.vue b/web/src/components/dashboards/addPanel/LogsPanelConfig.vue
new file mode 100644
index 0000000000..06dafb7bc5
--- /dev/null
+++ b/web/src/components/dashboards/addPanel/LogsPanelConfig.vue
@@ -0,0 +1,126 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex flex-col gap-2.5">
+    <template v-if="isOptionVisible('logs-fields')">
+      <OCombobox
+        v-for="field in fieldControls"
+        :key="field.key"
+        :label="field.label"
+        :model-value="config[field.key] ?? ''"
+        :items="queryFieldOptions"
+        :placeholder="defaultFromData(t)"
+        :data-test="`dashboard-config-${field.key}`"
+        @update:model-value="(value: string) => setTextConfig(field.key, value)"
+      >
+        <template #tooltip>
+          <OTooltip :content="t('dashboard.htmlPanelFieldTooltip')" max-width="15.625rem" />
+        </template>
+      </OCombobox>
+    </template>
+    <OSelect
+      v-show="isOptionVisible('logs-order')"
+      v-model="orderModel"
+      :label="t('dashboard.logsOrder')"
+      :options="orderOptions"
+      data-test="dashboard-config-logs_order"
+    >
+      <template #tooltip>
+        <OTooltip :content="t('dashboard.logsOrderTooltip')" max-width="15.625rem" />
+      </template>
+    </OSelect>
+    <OSwitch
+      v-show="isOptionVisible('logs-show-time')"
+      :model-value="config.logs_show_time !== false"
+      :label="t('dashboard.logsShowTime')"
+      data-test="dashboard-config-logs_show_time"
+      size="lg"
+      @update:model-value="(value: any) => setDefaultOnFlag('logs_show_time', value)"
+    />
+    <OSwitch
+      v-show="isOptionVisible('logs-wrap')"
+      :model-value="config.logs_wrap === true"
+      :label="t('dashboard.logsWrap')"
+      data-test="dashboard-config-logs_wrap"
+      size="lg"
+      @update:model-value="(value: any) => setFlagConfig('logs_wrap', value)"
+    />
+    <OSwitch
+      v-show="isOptionVisible('logs-prettify-json')"
+      :model-value="config.logs_prettify_json !== false"
+      :label="t('dashboard.logsPrettifyJson')"
+      data-test="dashboard-config-logs_prettify_json"
+      size="lg"
+      @update:model-value="(value: any) => setDefaultOnFlag('logs_prettify_json', value)"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, inject } from "vue";
+import OCombobox from "@/lib/forms/Combobox/OCombobox.vue";
+import OSelect from "@/lib/forms/Select/OSelect.vue";
+import OSwitch from "@/lib/forms/Switch/OSwitch.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import useDashboardPanelData from "@/composables/dashboard/useDashboardPanel";
+import { DEFAULT_CHOICE, useHtmlPanelConfig } from "@/composables/dashboard/useHtmlPanelConfig";
+import { orderLogsStarter } from "@/composables/dashboard/usePanelAggregation";
+import { useI18nTyped, type I18nText } from "@/types/i18n";
+import {
+  DEFAULT_LOGS_ORDER,
+  LOGS_ORDERS,
+  type LogsOrder,
+} from "@/utils/dashboard/convertLogsPanelData";
+import { defaultFromData, withDefaultChoice } from "@/utils/dashboard/optionDefaults";
+
+withDefaults(defineProps<{ isOptionVisible?: (optionId: string) => boolean }>(), {
+  isOptionVisible: () => true,
+});
+
+const { t } = useI18nTyped();
+const pageKey = inject("dashboardPanelDataPageKey", "dashboard");
+const { dashboardPanelData } = useDashboardPanelData(pageKey, t);
+const { config, setTextConfig, setFlagConfig, setDefaultOnFlag, choiceModel, queryFieldOptions } =
+  useHtmlPanelConfig(dashboardPanelData);
+
+const fieldControls = computed<{ key: string; label: I18nText }[]>(() => [
+  { key: "logs_message_field", label: t("dashboard.logsMessageField") },
+  { key: "logs_level_field", label: t("dashboard.logsLevelField") },
+  { key: "logs_time_field", label: t("dashboard.logsTimeField") },
+]);
+const storedOrder = choiceModel<LogsOrder>("logs_order", LOGS_ORDERS);
+const orderModel = computed({
+  get: () => storedOrder.value,
+  set: (value: string) => {
+    storedOrder.value = value;
+    const stored = config.value.logs_order;
+    const order: LogsOrder = LOGS_ORDERS.includes(stored) ? stored : DEFAULT_LOGS_ORDER;
+    dashboardPanelData.data.queries?.forEach((query: any) => {
+      if (query?.customQuery) orderLogsStarter(query, order);
+    });
+  },
+});
+const orderOptions = withDefaultChoice(
+  t,
+  DEFAULT_CHOICE,
+  [
+    { label: t("dashboard.logsOrderNewest"), value: "newest" as LogsOrder },
+    { label: t("dashboard.logsOrderOldest"), value: "oldest" as LogsOrder },
+  ],
+  DEFAULT_LOGS_ORDER,
+);
+</script>
diff --git a/web/src/components/dashboards/panels/ChartRenderer.spec.ts b/web/src/components/dashboards/panels/ChartRenderer.spec.ts
index b28cd9c5ef..48f31abd6b 100644
--- a/web/src/components/dashboards/panels/ChartRenderer.spec.ts
+++ b/web/src/components/dashboards/panels/ChartRenderer.spec.ts
@@ -21,6 +21,7 @@ import { raw } from "@/types/i18n";
 import store from "@/test/unit/helpers/store";
 import { use as echartsUse } from "echarts/core";
 import {
+  BoxplotChart,
   FunnelChart,
   GraphChart,
   LineChart,
@@ -77,6 +78,7 @@ vi.mock("echarts/charts", () => ({
   TreemapChart: vi.fn(),
   SunburstChart: vi.fn(),
   FunnelChart: vi.fn(),
+  BoxplotChart: vi.fn(),
 }));
 
 vi.mock("echarts/features", () => ({
@@ -148,6 +150,9 @@ describe("ChartRenderer series registration", () => {
   it("registers the graph series the node graph draws", () => {
     expect(registeredAtImport).toContain(GraphChart);
   });
+  it("registers the box plot series", () => {
+    expect(registeredAtImport).toContain(BoxplotChart);
+  });
 });
 
 describe("ChartRenderer", () => {
diff --git a/web/src/components/dashboards/panels/ChartRenderer.vue b/web/src/components/dashboards/panels/ChartRenderer.vue
index 0ce4d2ab9e..01fc432b35 100644
--- a/web/src/components/dashboards/panels/ChartRenderer.vue
+++ b/web/src/components/dashboards/panels/ChartRenderer.vue
@@ -101,6 +101,7 @@ import {
   TreemapChart,
   SunburstChart,
   FunnelChart,
+  BoxplotChart,
 } from "echarts/charts";
 import {
   TitleComponent,
@@ -172,6 +173,7 @@ echarts.use([
   TreemapChart,
   SunburstChart,
   FunnelChart,
+  BoxplotChart,
   LabelLayout,
   UniversalTransition,
   CanvasRenderer,
diff --git a/web/src/components/dashboards/panels/GeoMapRenderer.spec.ts b/web/src/components/dashboards/panels/GeoMapRenderer.spec.ts
index 79dc6d3e61..1e89f0d104 100644
--- a/web/src/components/dashboards/panels/GeoMapRenderer.spec.ts
+++ b/web/src/components/dashboards/panels/GeoMapRenderer.spec.ts
@@ -85,6 +85,7 @@ vi.mock("echarts/charts", () => ({
   SunburstChart: vi.fn(),
   PictorialBarChart: vi.fn(),
   FunnelChart: vi.fn(),
+  BoxplotChart: vi.fn(),
 }));
 
 // Mock ECharts components
diff --git a/web/src/components/dashboards/panels/LogsPanelRenderer.spec.ts b/web/src/components/dashboards/panels/LogsPanelRenderer.spec.ts
new file mode 100644
index 0000000000..ef4b6fa886
--- /dev/null
+++ b/web/src/components/dashboards/panels/LogsPanelRenderer.spec.ts
@@ -0,0 +1,178 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+// JSDOM has no layout, so the real virtualizer renders no rows; render them all.
+vi.mock("@tanstack/vue-virtual", async () => {
+  const { computed: vueComputed, unref } = await import("vue");
+  return {
+    useVirtualizer: (options: any) =>
+      vueComputed(() => {
+        const count = unref(options).count;
+        return {
+          getVirtualItems: () =>
+            Array.from({ length: count }, (_, index) => ({
+              index,
+              key: index,
+              start: index * 28,
+              size: 28,
+              end: (index + 1) * 28,
+              lane: 0,
+            })),
+          getTotalSize: () => count * 28,
+          scrollToIndex: () => {},
+          measureElement: () => {},
+        };
+      }),
+  };
+});
+
+import LogsPanelRenderer from "@/components/dashboards/panels/LogsPanelRenderer.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import JsonPreview from "@/plugins/logs/JsonPreview.vue";
+import { severityIndicatorColor } from "@/utils/logs/statusParser";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import { convertLogsPanelData } from "@/utils/dashboard/convertLogsPanelData";
+
+const schema = (config: Record<string, unknown> = {}) => ({ queries: [{ config: {} }], config });
+const rows = [
+  {
+    _timestamp: 1793057797456039,
+    level: "info",
+    message: "GET /api/search/update 26ms",
+    payload: '{"user":"u138","cart_items":5}',
+  },
+  {
+    _timestamp: 1793057797456037,
+    level: "error",
+    message: "upstream inventory failed: timeout after 103ms",
+    payload: '{"user":"u278","cart_items":5}',
+  },
+];
+
+let wrapper: VueWrapper<any> | undefined;
+afterEach(() => {
+  wrapper?.unmount();
+  wrapper = undefined;
+});
+
+const mountPanel = async (config: Record<string, unknown> = {}, panelRows = rows) => {
+  const data = convertLogsPanelData(schema(config), [panelRows], {
+    state: { timezone: "UTC", zoConfig: {} },
+  });
+  wrapper = mount(LogsPanelRenderer, {
+    props: { data, config },
+    global: { plugins: [i18n, store] },
+  });
+  await flushPromises();
+  return wrapper;
+};
+
+describe("LogsPanelRenderer", () => {
+  const table = () => wrapper!.findComponent(OTable);
+  const expandFirst = async () => {
+    table().vm.$emit("update:expandedIds", ["0"]);
+    await flushPromises();
+  };
+
+  it("renders through the logs table with a timestamp and message column, newest first", async () => {
+    await mountPanel();
+    const columns = table().props("columns") as any[];
+    expect(columns.map((col) => col.id)).toEqual(["_timestamp", "message"]);
+    expect(String(columns[0].header)).toContain("UTC");
+    expect(columns[0].size).toBe(236);
+    const data = table().props("data") as any[];
+    expect(data.map((row) => row.level)).toEqual(["info", "error"]);
+    expect(columns[0].accessorFn(data[0])).toMatch(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\.\d{3}$/);
+    expect(table().props("pinnedFirstColumn")).toBe("_timestamp");
+  });
+
+  it("colours each row's severity rail from the level field, like the logs table", async () => {
+    await mountPanel();
+    const data = table().props("data") as any[];
+    const color = table().props("getRowStatusColor") as (row: any) => string;
+    const error = { level: "error", source: "field", field: "level", notFetched: false } as const;
+    expect(color(data[1])).toBe(severityIndicatorColor(error));
+    expect(color(data[1])).not.toBe(color(data[0]));
+  });
+
+  it("keeps the logs page's Original tab out of the expanded row", async () => {
+    await mountPanel({}, [{ ...rows[0], _o2_id: 7 }]);
+    await expandFirst();
+    expect(wrapper!.findComponent(JsonPreview).props("value")).not.toHaveProperty("_o2_id");
+  });
+
+  it("expands a row into the logs page's read-only JSON preview", async () => {
+    await mountPanel();
+    await expandFirst();
+    const preview = wrapper!.findComponent(JsonPreview);
+    expect(preview.exists()).toBe(true);
+    expect(preview.props("mode")).toBe("expanded");
+    expect(preview.props("value")).toMatchObject({ level: "info" });
+    for (const flag of [
+      "hideViewRelated",
+      "hideViewTrace",
+      "hideSearchTermActions",
+      "hideFieldOptions",
+      "hideAddFieldToTable",
+    ]) {
+      expect(preview.props(flag), flag).toBe(true);
+    }
+  });
+
+  it("opens and closes a row's JSON on a row click", async () => {
+    await mountPanel();
+    const first = (table().props("data") as any[])[0];
+    table().vm.$emit("row-click", first, new MouseEvent("click"));
+    await flushPromises();
+    expect(table().props("expandedIds")).toEqual(["0"]);
+    table().vm.$emit("row-click", first, new MouseEvent("click"));
+    await flushPromises();
+    expect(table().props("expandedIds")).toEqual([]);
+  });
+
+  it("shows the row as stored, on one line, when pretty JSON is off", async () => {
+    await mountPanel({ logs_prettify_json: false });
+    await expandFirst();
+    expect(wrapper!.findComponent(JsonPreview).exists()).toBe(false);
+    expect(wrapper!.find('[data-test="dashboard-logs-panel-json"]').text()).toContain(
+      '"payload":"{\\"user\\":\\"u138\\"',
+    );
+  });
+
+  it("hides the timestamp column and wraps cells when configured", async () => {
+    await mountPanel({ logs_show_time: false, logs_wrap: true });
+    expect((table().props("columns") as any[]).map((col) => col.id)).toEqual(["message"]);
+    expect(table().props("wrap")).toBe(true);
+    expect(table().props("pinnedFirstColumn")).toBeUndefined();
+  });
+
+  it("falls back to the logs table's source column when the rows have no message field", async () => {
+    const data = convertLogsPanelData(schema(), [[{ _timestamp: 1793057797456039, code: 7 }]], {
+      state: { timezone: "UTC", zoConfig: {} },
+    });
+    wrapper = mount(LogsPanelRenderer, {
+      props: { data, config: {} },
+      global: { plugins: [i18n, store] },
+    });
+    await flushPromises();
+    const columns = table().props("columns") as any[];
+    expect(columns.map((col) => col.id)).toEqual(["_timestamp", "source"]);
+    expect(columns[1].accessorFn({ code: 7 })).toBe('{"code":7}');
+  });
+});
diff --git a/web/src/components/dashboards/panels/LogsPanelRenderer.vue b/web/src/components/dashboards/panels/LogsPanelRenderer.vue
new file mode 100644
index 0000000000..ec1603411a
--- /dev/null
+++ b/web/src/components/dashboards/panels/LogsPanelRenderer.vue
@@ -0,0 +1,245 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex h-full min-h-0 w-full flex-col" data-test="dashboard-logs-panel">
+    <OTable
+      class="logs-panel-table min-h-0 w-full flex-1"
+      :columns="columns"
+      :data="sourceRows"
+      :wrap="wrap"
+      :cell-overflow-tooltip="false"
+      :row-key="rowKey"
+      :row-height="20"
+      virtual-scroll
+      measure-expanded-rows
+      :default-columns="false"
+      :show-global-filter="false"
+      :frame="false"
+      pagination="none"
+      sorting="none"
+      :pinned-first-column="timeColumnId"
+      :enable-column-resize="true"
+      :get-row-status-color="rowStatusColor"
+      expansion="multiple"
+      :expanded-ids="expandedIds"
+      data-test="dashboard-logs-panel-table"
+      @update:expanded-ids="(ids: string[]) => (expandedIds = ids)"
+      @row-click="toggleRow"
+    >
+      <!-- Empty slot opts out of OTable's default banner, as the logs table does. -->
+      <template #loading-banner />
+
+      <template v-for="col in columns" :key="col.id" #[`cell-${col.id}`]="{ row, value }">
+        <span
+          v-if="cellHtml(col.id, row)"
+          class="log-cell-html"
+          :data-test="`dashboard-logs-panel-cell-${col.id}`"
+          v-html="cellHtml(col.id, row)"
+        />
+        <span v-else :data-test="`dashboard-logs-panel-cell-${col.id}`">{{ value }}</span>
+      </template>
+
+      <template #expansion="{ row }">
+        <JsonPreview
+          v-if="prettify"
+          :value="previewValue(row)"
+          mode="expanded"
+          class="px-2 py-1.5"
+          hide-view-related
+          hide-view-trace
+          hide-search-term-actions
+          hide-field-options
+          hide-add-field-to-table
+          data-test="dashboard-logs-panel-json"
+          @copy="copyRow"
+        />
+        <OCodeBlock
+          v-else
+          class="px-2 py-1.5"
+          lang="json"
+          wrap
+          :code="JSON.stringify(row)"
+          data-test="dashboard-logs-panel-json"
+        />
+      </template>
+    </OTable>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { useStore } from "vuex";
+import OTable from "@/lib/core/Table/OTable.vue";
+import JsonPreview from "@/plugins/logs/JsonPreview.vue";
+import OCodeBlock from "@/lib/core/Code/OCodeBlock.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import { useLogsHighlighter } from "@/composables/useLogsHighlighter";
+import { severityIndicatorColor } from "@/utils/logs/statusParser";
+import { byString } from "@/utils/json";
+import { copyToClipboard } from "@/utils/clipboard";
+import { timestampToTimezoneDate } from "@/utils/timezone";
+import { raw, useI18nTyped } from "@/types/i18n";
+import {
+  toEpochMillis,
+  type LogsPanelFields,
+  type LogsPanelRow,
+} from "@/utils/dashboard/convertLogsPanelData";
+
+const props = defineProps<{
+  data: { rows?: LogsPanelRow[]; fields?: LogsPanelFields } | null | undefined;
+  config?: Record<string, any> | null;
+}>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+
+// Same width the logs table gives its timestamp column.
+const TIMESTAMP_COLUMN_SIZE = 236;
+// Same format the logs table shows its timestamps in.
+const TIMESTAMP_FORMAT = "yyyy-MM-dd HH:mm:ss.SSS";
+
+const rows = computed<LogsPanelRow[]>(() => props.data?.rows ?? []);
+const fields = computed<LogsPanelFields>(
+  () => props.data?.fields ?? { time: null, level: null, message: null },
+);
+const showTime = computed(() => props.config?.logs_show_time !== false);
+const wrap = computed(() => props.config?.logs_wrap === true);
+const prettify = computed(() => props.config?.logs_prettify_json !== false);
+
+// The table shows the rows exactly as the query returned them, in the panel's order.
+const sourceRows = computed(() => rows.value.map((row) => row.source));
+const rowsBySource = computed(() => {
+  const map = new Map<unknown, { index: number; row: LogsPanelRow }>();
+  rows.value.forEach((row, index) => map.set(row.source, { index, row }));
+  return map;
+});
+const rowKey = (row: any): string => String(rowsBySource.value.get(row)?.index ?? -1);
+
+const timeColumnId = computed(() =>
+  showTime.value && fields.value.time ? fields.value.time : undefined,
+);
+
+const columns = computed<OTableColumnDef<any>[]>(() => {
+  const timezone = store.state.timezone;
+  const out: any[] = [];
+  const timeField = timeColumnId.value;
+  if (timeField) {
+    const format = (row: any) => {
+      const millis = toEpochMillis(row?.[timeField]);
+      return millis === null ? "" : timestampToTimezoneDate(millis, timezone, TIMESTAMP_FORMAT);
+    };
+    out.push({
+      name: timeField,
+      id: timeField,
+      accessorFn: format,
+      prop: format,
+      label: t("search.timestampWithTimezone", { timezone }),
+      header: t("search.timestampWithTimezone", { timezone }),
+      align: "left",
+      enableResizing: false,
+      meta: { closable: false, showWrap: false, wrapContent: false },
+      size: TIMESTAMP_COLUMN_SIZE,
+    });
+  }
+  const messageField = fields.value.message;
+  if (messageField) {
+    out.push({
+      name: messageField,
+      id: messageField,
+      accessorFn: (row: any) => byString(row, messageField),
+      header: raw(messageField),
+      enableResizing: true,
+      meta: { closable: false, showWrap: true, wrapContent: false, autoWidth: true },
+    });
+  } else {
+    out.push({
+      name: "source",
+      id: "source",
+      accessorFn: (row: any) => JSON.stringify(row),
+      cell: (info: any) => info.getValue(),
+      header: raw("source"),
+      resizable: false,
+      meta: { closable: false, showWrap: false, wrapContent: false, autoWidth: true },
+    });
+  }
+  return out;
+});
+
+// The logs table's colourised cells: same highlighter, keyed by column and row position.
+const { processedResults, processHitsInChunks } = useLogsHighlighter(t);
+const cellHtml = (columnId: string, row: any): string | null => {
+  const index = rowsBySource.value.get(row)?.index;
+  if (index === undefined) return null;
+  return (processedResults.value as Record<string, string>)[`${columnId}_${index}`] ?? null;
+};
+const reprocess = (clearCache: boolean) =>
+  processHitsInChunks(sourceRows.value, columns.value as any[], clearCache, "", 100, []);
+watch(columns, () => reprocess(true), { immediate: true });
+watch(sourceRows, () => reprocess(true));
+
+// The logs table's severity rail, read from the panel's level field.
+const rowStatusColor = (row: any): string =>
+  severityIndicatorColor({
+    level: rowsBySource.value.get(row)?.row.level ?? "unknown",
+    source: "field",
+    field: fields.value.level,
+    notFetched: false,
+  });
+
+const expandedIds = ref<string[]>([]);
+// Keys are row positions, so an open row would point at a different line after a reload.
+watch(rows, () => {
+  if (expandedIds.value.length) expandedIds.value = [];
+});
+
+// JsonPreview fetches the Original tab from the logs page's stream, not the panel's, so the row must not offer it.
+const previewValue = (row: Record<string, unknown>) => {
+  const { _o2_id: _omitted, ...rest } = row;
+  return rest;
+};
+
+const copyRow = (value: unknown) =>
+  copyToClipboard(typeof value === "string" ? value : JSON.stringify(value, null, 2), t);
+
+// The panel has no details drawer, so a row click opens the row's JSON in place.
+const toggleRow = (row: any) => {
+  const key = rowKey(row);
+  expandedIds.value = expandedIds.value.includes(key)
+    ? expandedIds.value.filter((id) => id !== key)
+    : [...expandedIds.value, key];
+};
+</script>
+
+<style scoped>
+/* keep(lib-override:logs-cell-font): the logs table's monospace cell font, copied from the logs page's scoped style; only data cells, so the expanded JSON keeps its own typography. */
+.logs-panel-table :deep(td[data-test^="o2-table-cell-"]) {
+  font-family: var(--font-mono);
+  font-size: var(--text-xs);
+  line-height: 1.125rem;
+}
+
+/* keep(lib-override:logs-row-height): the logs table's compact expand button, so the default button does not set a taller floor under every row. */
+.logs-panel-table :deep([data-test^="o2-table-expand-"]) {
+  height: 1.25rem !important;
+  width: 1rem !important;
+  min-height: 0 !important;
+}
+.logs-panel-table :deep([data-test^="o2-table-expand-"] svg) {
+  width: 0.875rem !important;
+  height: 0.875rem !important;
+}
+</style>
diff --git a/web/src/components/dashboards/publicLinkDisplay.spec.ts b/web/src/components/dashboards/publicLinkDisplay.spec.ts
index 8beb1a9402..017dd5b6aa 100644
--- a/web/src/components/dashboards/publicLinkDisplay.spec.ts
+++ b/web/src/components/dashboards/publicLinkDisplay.spec.ts
@@ -20,11 +20,13 @@ import {
   displayStatus,
   lifecycleStatus,
   longRange,
+  orgSwitchedOff,
   printedWindow,
   publicLinkColumns,
   publicLinkSearchTerm,
   publicLinkUrl,
   shortRange,
+  statusLabel,
   statusReason,
   takeOverError,
 } from "@/components/dashboards/publicLinkDisplay";
@@ -145,6 +147,14 @@ describe("public link status", () => {
     expect(statusReason(row({}), undefined, gt)).toBeNull();
   });
 
+  it("reads the org switch from the links, and keeps a disabled link's paused state in its label", () => {
+    expect(orgSwitchedOff([row({}), row({ status: "disabled" })])).toBe(true);
+    expect(orgSwitchedOff([row({}), row({ status: "paused" })])).toBe(false);
+    expect(statusLabel(row({ status: "disabled", enabled: false }), gt)).toBe("Disabled · Paused");
+    expect(statusLabel(row({ status: "disabled", enabled: true }), gt)).toBeUndefined();
+    expect(statusLabel(row({ status: "paused", enabled: false }), gt)).toBeUndefined();
+  });
+
   it("shows Last viewed from the access time, not an update time", () => {
     const ids = publicLinkColumns(gt).map((c) => c.id);
     expect(ids).toContain("last_viewed");
diff --git a/web/src/components/dashboards/publicLinkDisplay.ts b/web/src/components/dashboards/publicLinkDisplay.ts
index 17888f38ef..1d105ae7c1 100644
--- a/web/src/components/dashboards/publicLinkDisplay.ts
+++ b/web/src/components/dashboards/publicLinkDisplay.ts
@@ -191,6 +191,18 @@ export function statusReason(
   return attentionReason(report, t);
 }
 
+// The list carries no org setting; the server marks a link disabled only while the org switch is off.
+export function orgSwitchedOff(links: PublicLink[]): boolean {
+  return links.some((link) => link.status === "disabled");
+}
+
+/** The status tag's label when its state alone hides something: a paused link of a switched-off org. */
+export function statusLabel(link: PublicLink, t: TranslateFn): I18nText | undefined {
+  return link.status === "disabled" && !link.enabled
+    ? t("dashboard.publicLinks.disabledPaused")
+    : undefined;
+}
+
 // Expired and orphaned links can't be resumed, so their pause toggle is disabled.
 export function canPause(link: PublicLink): boolean {
   return link.status !== "expired" && link.status !== "dashboard_deleted";
diff --git a/web/src/components/fleet/FleetInstallDialog.spec.ts b/web/src/components/fleet/FleetInstallDialog.spec.ts
index f250e60cae..28fa6147f2 100644
--- a/web/src/components/fleet/FleetInstallDialog.spec.ts
+++ b/web/src/components/fleet/FleetInstallDialog.spec.ts
@@ -428,6 +428,37 @@ describe("FleetInstallDialog", () => {
     );
   });
 
+  it("polls for the collector of a token created in place and shows it connected", async () => {
+    vi.useFakeTimers({ shouldAdvanceTime: true });
+    const created = token({ id: "t9", name: "new", fleet: { id: "empty", name: "empty" } });
+    vi.mocked(fleet.createToken).mockResolvedValue({
+      data: { ...created, token: "o2ft_fresh" },
+    } as any);
+    vi.mocked(fleet.listCollectors).mockResolvedValue({ data: { total: 0, items: [] } } as any);
+    wrapper = mountDialog({ fleetId: "empty" });
+    await flushPromises();
+    vi.mocked(fleet.listTokens).mockResolvedValue({ data: { items: [created] } } as any);
+    const form = (wrapper.findComponent({ name: "OForm" }).vm as any).form;
+    form.setFieldValue("name", "new");
+    await wrapper.find("form").trigger("submit");
+    await vi.waitFor(async () => {
+      await flushPromises();
+      expect(wrapper.findComponent(FleetInstallCommand).exists()).toBe(true);
+    });
+    await pollWith([]);
+    await pollWith([
+      collector({
+        id: "c9",
+        name: "node-new",
+        token_id: "t9",
+        fleet: { id: "empty", name: "empty" },
+      }),
+    ]);
+    expect(wrapper.find('[data-test="fleet-install-dialog-connected"]').text()).toContain(
+      "node-new",
+    );
+  });
+
   it("keeps a create started for one fleet out of another fleet's dialog", async () => {
     let resolve!: (v: unknown) => void;
     vi.mocked(fleet.createToken).mockReturnValue(new Promise((r) => (resolve = r)) as any);
diff --git a/web/src/components/fleet/FleetInstallDialog.vue b/web/src/components/fleet/FleetInstallDialog.vue
index 949bbce3a5..09800f20a4 100644
--- a/web/src/components/fleet/FleetInstallDialog.vue
+++ b/web/src/components/fleet/FleetInstallDialog.vue
@@ -271,6 +271,10 @@ const collectors = useQuery(() =>
   }),
 );
 const collectorsForbidden = computed(() => isForbidden(collectors.error.value));
+// The poll stops while no token is selected, so a token created here must start it again.
+watch(selectedId, (id) => {
+  if (props.open && id) void collectors.refetch({ cancelRefetch: false });
+});
 
 watch(
   () => props.fleetId,
diff --git a/web/src/components/fleet/FleetTokenForm.schema.ts b/web/src/components/fleet/FleetTokenForm.schema.ts
index f89f03acab..8e7d1c1534 100644
--- a/web/src/components/fleet/FleetTokenForm.schema.ts
+++ b/web/src/components/fleet/FleetTokenForm.schema.ts
@@ -31,4 +31,4 @@ export const makeTokenSchema = (t: TranslateFn) =>
 
 export type TokenForm = z.infer<ReturnType<typeof makeTokenSchema>>;
 
-export const tokenDefaults = (): TokenForm => ({ name: "", expiry: "90", maxUses: "100" });
+export const tokenDefaults = (): TokenForm => ({ name: "", expiry: "never", maxUses: "100" });
diff --git a/web/src/components/fleet/FleetTokens.spec.ts b/web/src/components/fleet/FleetTokens.spec.ts
index 98ff2180fa..6442266b50 100644
--- a/web/src/components/fleet/FleetTokens.spec.ts
+++ b/web/src/components/fleet/FleetTokens.spec.ts
@@ -409,6 +409,20 @@ describe("FleetTokens", () => {
     expect(fleet.listTokens).toHaveBeenCalledTimes(2);
   });
 
+  it("defaults to a token that never expires", async () => {
+    vi.mocked(fleet.createToken).mockResolvedValue({
+      data: { ...token({ id: "t7" }), token: "o2ft_y" },
+    } as any);
+    wrapper = await mountTokens();
+    await fillAndSubmit(wrapper, { name: "n" });
+    expect(fleet.createToken).toHaveBeenCalledWith(expect.any(String), {
+      name: "n",
+      expires_in_days: null,
+      max_uses: 100,
+      fleet: "f1",
+    });
+  });
+
   it("sends null for never-expiring and unlimited tokens", async () => {
     vi.mocked(fleet.createToken).mockResolvedValue({
       data: { ...token({ id: "t8" }), token: "o2ft_x" },
diff --git a/web/src/components/iam/roles/EditRole.spec.js b/web/src/components/iam/roles/EditRole.spec.js
index 5557168ada..63c3e066bc 100644
--- a/web/src/components/iam/roles/EditRole.spec.js
+++ b/web/src/components/iam/roles/EditRole.spec.js
@@ -59,12 +59,21 @@ const ctl = vi.hoisted(() => ({
   // Mutable so a spec can shrink the org's metric streams (the zero-match case).
   metricStreams: null,
   logStreams: null,
+  // Every stream list the page reads, in order, so a test can tell an eager load from a lazy one.
+  streamCalls: [],
+  // Set to a pending promise to hold every stream list, so a test can act while a preset is still staging.
+  streamGate: null,
+  // Stream types whose list read fails, as a 403 or a dropped request would.
+  failStreamTypes: [],
 }));
 
 // Mock composable useStreams
 vi.mock("@/composables/useStreams", () => ({
   default: () => ({
     getStreams: vi.fn(async (type) => {
+      ctl.streamCalls.push(type);
+      await ctl.streamGate;
+      if (ctl.failStreamTypes.includes(type)) throw new Error("403");
       const map = {
         logs: { list: ctl.logStreams ?? [{ name: "app" }, { name: "sys" }] },
         metrics: {
@@ -627,6 +636,9 @@ beforeEach(() => {
   ctl.resources = RESOURCE_CATALOG;
   ctl.metricStreams = null;
   ctl.logStreams = null;
+  ctl.streamCalls = [];
+  ctl.streamGate = null;
+  ctl.failStreamTypes = [];
   router.currentRoute.value.query = {};
 });
 
@@ -924,8 +936,10 @@ describe("EditRole - save and cancel", () => {
     await wrapper.vm.saveRole();
     await flushPromises();
 
-    // toast is called with variant: "success" after a successful update
-    expect(mockToast).toHaveBeenCalledWith(expect.objectContaining({ variant: "success" }));
+    expect(mockToast).toHaveBeenCalledWith({
+      variant: "success",
+      message: "Saved 1 change in 1 module.",
+    });
     expect(Object.keys(wrapper.vm.addedPermissions).length).toBe(0);
   });
 });
@@ -3653,3 +3667,409 @@ describe("EditRole - all modules", () => {
     expect(wrapper.find('[data-test^="edit-role-module-pane-bulk-"]').exists()).toBe(false);
   });
 });
+
+describe("EditRole - Review Changes footer", () => {
+  const reviewButton = (wrapper) => wrapper.find('[data-test="edit-role-review-changes-btn"]');
+
+  it("disables Review Changes with no change and nothing missing", async () => {
+    const wrapper = await mountEditRole();
+
+    expect(reviewButton(wrapper).attributes("disabled")).toBeDefined();
+    expect(wrapper.find('[data-test="edit-role-unsaved-count"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="edit-role-review-missing-icon"]').exists()).toBe(false);
+  });
+
+  it("counts the staged changes on the badge", async () => {
+    const wrapper = await mountEditRole();
+    wrapper.vm.updatePermissionMappings("logs:app:AllowGet");
+    await flushPromises();
+
+    expect(reviewButton(wrapper).attributes("disabled")).toBeUndefined();
+    expect(wrapper.find('[data-test="edit-role-unsaved-count"]').text()).toBe("1");
+  });
+
+  // A saved dashboard folder with no stream grant cannot load panels, so the role is flagged with nothing staged.
+  it("enables Review Changes with a warning when a module is missing and nothing is staged", async () => {
+    const wrapper = await mountWithSaved([{ object: "dfolder:f1", permission: "AllowGet" }]);
+    await flushPromises();
+
+    expect(reviewButton(wrapper).attributes("disabled")).toBeUndefined();
+    expect(wrapper.find('[data-test="edit-role-review-missing-icon"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="edit-role-unsaved-count"]').exists()).toBe(false);
+    expect(
+      wrapper
+        .findAllComponents({ name: "OTooltip" })
+        .some(
+          (tooltip) =>
+            tooltip.props("content") ===
+            i18n.global.t("iam.editRole.reviewMissingTooltip", { count: 1 }, 1),
+        ),
+    ).toBe(true);
+  });
+
+  // A missing module is advice, not an edit, so it must not hold the user on the page.
+  it("does not count a missing module as unsaved", async () => {
+    const wrapper = await mountWithSaved([{ object: "dfolder:f1", permission: "AllowGet" }]);
+
+    expect(wrapper.vm.companionGaps.length).toBe(1);
+    expect(wrapper.vm.isAnyDirty).toBe(false);
+  });
+});
+
+describe("EditRole - review drawer wiring", () => {
+  const drawer = (wrapper) => wrapper.findComponent({ name: "UnsavedChangesDrawer" });
+
+  it("hands the drawer the grouped changes and the missing modules", async () => {
+    const wrapper = await mountWithSaved([{ object: "dfolder:f1", permission: "AllowGet" }]);
+    wrapper.vm.updatePermissionMappings("logs:app:AllowGet");
+    await flushPromises();
+
+    expect(
+      drawer(wrapper)
+        .props("groups")
+        .map((group) => group.key),
+    ).toEqual(["stream"]);
+    expect(
+      drawer(wrapper)
+        .props("gaps")
+        .map((gap) => gap.module),
+    ).toEqual(["stream"]);
+  });
+
+  // Toggle revokes a held key, so a second Add must not take the grant back off.
+  it("adds a companion grant once, however often Add is clicked", async () => {
+    const wrapper = await mountEditRole();
+    const key = `stream:${ALL}:AllowList`;
+
+    drawer(wrapper).vm.$emit("add", [key]);
+    drawer(wrapper).vm.$emit("add", [key]);
+    await flushPromises();
+
+    expect([...wrapper.vm.selectedPermissionsHash]).toEqual([key]);
+    expect(Object.keys(wrapper.vm.addedPermissions)).toEqual([key]);
+  });
+
+  it("restores a grant staged for removal rather than adding it twice", async () => {
+    const key = `stream:${ALL}:AllowList`;
+    const wrapper = await mountWithSaved([{ object: `stream:${ALL}`, permission: "AllowList" }]);
+    wrapper.vm.updatePermissionMappings(key);
+
+    drawer(wrapper).vm.$emit("add", [key]);
+    await flushPromises();
+
+    expect(wrapper.vm.removedPermissions).toEqual({});
+    expect(wrapper.vm.addedPermissions).toEqual({});
+    expect(wrapper.vm.selectedPermissionsHash.has(key)).toBe(true);
+  });
+
+  it("closes the drawer and opens the module for Open Streams", async () => {
+    const wrapper = await mountWithSaved([{ object: "dfolder:f1", permission: "AllowGet" }]);
+    wrapper.vm.activeTab = "users";
+    wrapper.vm.unsavedDrawerOpen = true;
+
+    drawer(wrapper).vm.$emit("open-module", "stream");
+    await flushPromises();
+
+    expect(wrapper.vm.unsavedDrawerOpen).toBe(false);
+    expect(wrapper.vm.activeTab).toBe("permissions");
+    expect(wrapper.vm.activeModule).toBe("stream");
+  });
+
+  it("keeps the drawer open after Undo All while a module is still missing", async () => {
+    const wrapper = await mountWithSaved([{ object: "dfolder:f1", permission: "AllowGet" }]);
+    wrapper.vm.updatePermissionMappings("logs:app:AllowGet");
+    wrapper.vm.unsavedDrawerOpen = true;
+    await flushPromises();
+
+    drawer(wrapper).vm.$emit("undo", ["logs:app:AllowGet"]);
+    await flushPromises();
+
+    expect(wrapper.vm.pendingChanges).toEqual([]);
+    expect(wrapper.vm.unsavedDrawerOpen).toBe(true);
+  });
+
+  it("saves through the page's save path and closes the drawer", async () => {
+    const { updateRole } = await import("@/services/iam");
+    const wrapper = await mountEditRole();
+    vi.mocked(updateRole).mockClear();
+    wrapper.vm.updatePermissionMappings("logs:app:AllowGet");
+    wrapper.vm.unsavedDrawerOpen = true;
+
+    drawer(wrapper).vm.$emit("save");
+    await flushPromises();
+
+    expect(wrapper.vm.unsavedDrawerOpen).toBe(false);
+    expect(vi.mocked(updateRole).mock.calls[0][0].payload.add).toEqual([
+      { object: "logs:app", permission: "AllowGet" },
+    ]);
+  });
+});
+
+describe("EditRole - save toast", () => {
+  useNavigationFixture();
+
+  const toastAfterSave = async (vm) => {
+    mockToast.mockClear();
+    await vm.saveRole();
+    await flushPromises();
+    return mockToast.mock.calls.map(([arg]) => arg);
+  };
+
+  it("names the changes and modules a save touched", async () => {
+    const vm = await mountEditRoleVm();
+    withSaved(vm, ["dfolder:f1:AllowGet"]);
+    vm.updatePermissionMappings("logs:app:AllowGet");
+    vm.updatePermissionMappings("metrics:cpu:AllowGet");
+    vm.updatePermissionMappings("dfolder:f1:AllowGet");
+
+    expect(await toastAfterSave(vm)).toEqual([
+      { variant: "success", message: "Saved 3 changes in 2 modules." },
+    ]);
+  });
+
+  it("keeps the plain success message for a members-only save", async () => {
+    const vm = await mountEditRoleVm();
+    vm.addedUsers.add("new@example.com");
+
+    expect(await toastAfterSave(vm)).toEqual([
+      { variant: "success", message: i18n.global.t("iam.editRole.updateSuccess") },
+    ]);
+  });
+});
+
+describe("EditRole - presets panel wiring", () => {
+  it("announces a preset added from the panel", async () => {
+    const wrapper = await mountEditRole();
+    mockToast.mockClear();
+
+    wrapper.findComponent({ name: "RoleSummary" }).vm.$emit("preset", "readonly");
+    await flushPromises();
+
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({
+        variant: "success",
+        message: expect.stringContaining(i18n.global.t("iam.editRole.presetReadonlyTitle")),
+      }),
+    );
+  });
+
+  it("hands the panel the presets and a preview of each", async () => {
+    const wrapper = await mountEditRole();
+    const summary = wrapper.findComponent({ name: "RoleSummary" });
+
+    expect(summary.props("presets").map((preset) => preset.id)).toContain("readonly");
+    expect(summary.props("previewPreset")("readonly").status).toBe("ready");
+    expect(summary.props("applying")).toBe(false);
+  });
+
+  // Opening a module unmounts the overview, so only the page can remember the closed panel.
+  it("keeps the panel closed after a module is opened and left", async () => {
+    const wrapper = await mountEditRole();
+    await wrapper.find('[data-test="edit-role-presets-close"]').trigger("click");
+
+    wrapper.vm.activeModule = "stream";
+    await flushPromises();
+    expect(wrapper.findComponent({ name: "RoleSummary" }).exists()).toBe(false);
+
+    wrapper.vm.activeModule = "";
+    await flushPromises();
+    expect(wrapper.find('[data-test="edit-role-presets-panel"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="edit-role-presets-open"]').exists()).toBe(true);
+  });
+
+  it("starts with the panel open on a fresh visit after it was closed", async () => {
+    const earlier = await mountEditRole();
+    await earlier.find('[data-test="edit-role-presets-close"]').trigger("click");
+    earlier.unmount();
+
+    const wrapper = await mountEditRole();
+
+    expect(wrapper.find('[data-test="edit-role-presets-panel"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="edit-role-presets-open"]').exists()).toBe(false);
+  });
+});
+
+describe("EditRole - presets panel stream lists", () => {
+  // Every visit would otherwise fetch the metrics and logs lists just to count the stream presets.
+  it("reads no stream list when the page opens", async () => {
+    await mountEditRole();
+    await flushPromises();
+
+    expect(ctl.streamCalls).toEqual([]);
+  });
+
+  it("reads the metrics and logs lists once the panel asks for them", async () => {
+    const wrapper = await mountEditRole();
+    await flushPromises();
+
+    wrapper.findComponent({ name: "RoleSummary" }).vm.$emit("load-streams");
+    await flushPromises();
+
+    expect([...new Set(ctl.streamCalls)].sort()).toEqual(["logs", "metrics"]);
+    expect(wrapper.vm.previewPreset("dbm").status).toBe("ready");
+  });
+});
+
+describe("EditRole - preset stream rows follow the latest read", () => {
+  // Called directly: RoleSummary, which relays the panel's request, is hidden while a module is open.
+  const loadStreams = async (wrapper) => {
+    await wrapper.vm.loadPresetStreams();
+    await flushPromises();
+  };
+
+  it("rebuilds the metrics rows when Retry succeeds after a failed refresh", async () => {
+    ctl.metricStreams = [{ name: "cpu" }];
+    const wrapper = await mountEditRole();
+    await loadStreams(wrapper);
+    expect(wrapper.vm.previewPreset("dbm").noMatchingStreams).toBe(true);
+
+    ctl.metricStreams = [{ name: "cpu" }, { name: "postgresql_backends" }];
+    ctl.failStreamTypes = ["metrics"];
+    await loadStreams(wrapper);
+    expect(wrapper.vm.previewPreset("dbm").status).toBe("failed");
+
+    ctl.failStreamTypes = [];
+    await loadStreams(wrapper);
+    expect(wrapper.vm.previewPreset("dbm").adds).toContain("metrics:postgresql_backends:AllowGet");
+  });
+
+  it("rebuilds rows the Metrics module loaded earlier on the first preset lookup", async () => {
+    ctl.metricStreams = [{ name: "cpu" }];
+    const wrapper = await mountEditRole();
+    wrapper.vm.activeModule = "stream";
+    await flushPromises();
+    const metrics = wrapper.vm.activeModuleView.entities.find((row) => row.name === "metrics");
+    await wrapper.vm.getResourceEntities(metrics);
+    expect(metrics.entities.map((row) => row.name)).toEqual(["cpu"]);
+
+    ctl.metricStreams = [{ name: "cpu" }, { name: "postgresql_backends" }];
+    await loadStreams(wrapper);
+
+    expect(wrapper.vm.previewPreset("dbm").adds).toContain("metrics:postgresql_backends:AllowGet");
+  });
+});
+
+describe("EditRole - save while a preset is staging", () => {
+  // DBM waits on the metrics list; a save built before it lands would commit its grants unsent.
+  it("sends the preset's grants when Save is clicked mid-apply", async () => {
+    const { updateRole } = await import("@/services/iam");
+    const wrapper = await mountEditRole();
+    vi.mocked(updateRole).mockClear();
+
+    const applying = wrapper.vm.applyPreset("dbm");
+    expect(wrapper.vm.applyingPreset).toBe(true);
+    const saving = wrapper.vm.saveRole();
+    await Promise.all([applying, saving]);
+    await flushPromises();
+
+    expect(vi.mocked(updateRole)).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(updateRole).mock.calls[0][0].payload.add).toEqual(
+      expect.arrayContaining([{ object: "metrics:postgresql_backends", permission: "AllowGet" }]),
+    );
+    expect(wrapper.vm.addedPermissions).toEqual({});
+  });
+
+  // JSON would snapshot the grants before the preset lands, and Save would then stage that stale snapshot over them.
+  it("holds the Table and JSON switch until the preset lands, then saves its grants", async () => {
+    const { updateRole } = await import("@/services/iam");
+    const wrapper = await mountEditRole();
+    const viewSwitch = () => wrapper.findComponent({ name: "PermissionsViewSwitch" });
+    let release;
+    ctl.streamGate = new Promise((resolve) => {
+      release = resolve;
+    });
+    vi.mocked(updateRole).mockClear();
+
+    const applying = wrapper.vm.applyPreset("dbm");
+    await flushPromises();
+    expect(wrapper.vm.applyingPreset).toBe(true);
+    expect(viewSwitch().props("disabled")).toBe(true);
+    viewSwitch().vm.$emit("update:modelValue", "json");
+    await flushPromises();
+    expect(wrapper.vm.permissionsUiType).toBe("table");
+
+    const saving = wrapper.vm.saveRole();
+    release();
+    await Promise.all([applying, saving]);
+    await flushPromises();
+
+    expect(vi.mocked(updateRole)).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(updateRole).mock.calls[0][0].payload.add).toEqual(
+      expect.arrayContaining([{ object: "metrics:postgresql_backends", permission: "AllowGet" }]),
+    );
+    expect(viewSwitch().props("disabled")).toBe(false);
+  });
+
+  it("holds preset Add off while a save is in flight", async () => {
+    const { updateRole } = await import("@/services/iam");
+    const wrapper = await mountEditRole();
+    const summary = () => wrapper.findComponent({ name: "RoleSummary" });
+    let finish;
+    vi.mocked(updateRole).mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        }),
+    );
+    wrapper.vm.updatePermissionMappings("logs:app:AllowGet");
+
+    const saving = wrapper.vm.saveRole();
+    await flushPromises();
+    expect(summary().props("applying")).toBe(true);
+
+    finish({ data: { code: 200 } });
+    await saving;
+    await flushPromises();
+    expect(summary().props("applying")).toBe(false);
+  });
+});
+
+describe("EditRole - nothing stages while a save is in flight", () => {
+  // The payload is built before the PUT, so a key staged after it would be committed as saved unsent.
+  it("ignores Add All, Undo, pane clicks and a view switch until the PUT settles", async () => {
+    const { updateRole } = await import("@/services/iam");
+    const wrapper = await mountEditRole();
+    const drawer = () => wrapper.findComponent({ name: "UnsavedChangesDrawer" });
+    const pane = () => wrapper.findComponent({ name: "ModulePane" });
+    const sent = `afolder:${ALL}:AllowAll`;
+    const streamsList = `stream:${ALL}:AllowList`;
+    let finish;
+    vi.mocked(updateRole).mockClear();
+    vi.mocked(updateRole).mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        }),
+    );
+    wrapper.vm.activeModule = "stream";
+    await flushPromises();
+    const metrics = wrapper.vm.activeModuleView.entities.find((row) => row.name === "metrics");
+    wrapper.vm.updatePermissionMappings(sent);
+
+    const saving = wrapper.vm.saveRole();
+    await flushPromises();
+    expect(drawer().props("saving")).toBe(true);
+    drawer().vm.$emit("add", [streamsList, `destination:${ALL}:AllowList`]);
+    drawer().vm.$emit("undo", [sent]);
+    pane().vm.$emit("change", { row: metrics, permission: "AllowList", newValue: true });
+    wrapper.findComponent({ name: "PermissionsViewSwitch" }).vm.$emit("update:modelValue", "json");
+    await flushPromises();
+
+    finish({ data: { code: 200 } });
+    await saving;
+    await flushPromises();
+
+    expect(vi.mocked(updateRole)).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(updateRole).mock.calls[0][0].payload.add).toEqual([
+      { object: `afolder:${ALL}`, permission: "AllowAll" },
+    ]);
+    expect([...wrapper.vm.selectedPermissionsHash]).toEqual([sent]);
+    expect(wrapper.vm.addedPermissions).toEqual({});
+    expect(wrapper.vm.removedPermissions).toEqual({});
+    expect(wrapper.vm.permissionsUiType).toBe("table");
+
+    drawer().vm.$emit("add", [streamsList]);
+    expect(drawer().props("saving")).toBe(false);
+    expect(Object.keys(wrapper.vm.addedPermissions)).toEqual([streamsList]);
+  });
+});
diff --git a/web/src/components/iam/roles/EditRole.vue b/web/src/components/iam/roles/EditRole.vue
index 117678c7bf..20e82d20ff 100644
--- a/web/src/components/iam/roles/EditRole.vue
+++ b/web/src/components/iam/roles/EditRole.vue
@@ -86,7 +86,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :count="selectedPermissionsHash.size"
                   :loading="isFetchingInitialRoles"
                   :model-value="permissionsUiType"
-                  @update:model-value="updatePermissionsUi"
+                  :disabled="stagingBusy"
+                  @update:model-value="switchPermissionsUi"
                 />
               </div>
 
@@ -112,7 +113,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :icon="isAllModules ? ALL_MODULES_ICON : activeRailModule?.icon"
                   :added="activeRailModule?.added"
                   :removed="activeRailModule?.removed"
-                  @change="(change) => handlePermissionBatchChange([change])"
+                  @change="changeFromPane"
                   @open="openPaneRow"
                   @navigate="navigateTrail"
                 >
@@ -121,24 +122,34 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       :count="selectedPermissionsHash.size"
                       :loading="isFetchingInitialRoles"
                       :model-value="permissionsUiType"
-                      @update:model-value="updatePermissionsUi"
+                      :disabled="stagingBusy"
+                      @update:model-value="switchPermissionsUi"
                     />
                   </template>
                 </ModulePane>
                 <RoleSummary
                   v-else-if="permissionsUiType === 'table'"
+                  v-model:presets-open="presetsOpen"
                   class="h-full"
                   :modules="summaryModules"
                   :loading="isFetchingInitialRoles"
+                  :presets="presets"
+                  :preview-preset="previewPreset"
+                  :applying="stagingBusy"
+                  :module-label="moduleLabel"
+                  :entity-label="entityLabel"
+                  :summary-actions="summaryActions"
                   @open="(moduleKey) => (activeModule = moduleKey)"
-                  @preset="applyPreset"
+                  @preset="(presetId) => applyPreset(presetId, { announce: true })"
+                  @load-streams="loadPresetStreams()"
                 >
                   <template #actions>
                     <PermissionsViewSwitch
                       :count="selectedPermissionsHash.size"
                       :loading="isFetchingInitialRoles"
                       :model-value="permissionsUiType"
-                      @update:model-value="updatePermissionsUi"
+                      :disabled="stagingBusy"
+                      @update:model-value="switchPermissionsUi"
                     />
                   </template>
                 </RoleSummary>
@@ -198,23 +209,45 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             class="bg-card-glass-bg border-border-default flex w-full items-center justify-end gap-2 border-t px-3 py-2"
           >
             <!-- Table view only: JSON edits stage when the view switches back, which would overwrite an undo made here. -->
-            <OButton
-              v-if="pendingChanges.length && permissionsUiType === 'table'"
-              variant="outline"
-              size="sm-action"
-              data-test="edit-role-review-changes-btn"
-              @click="unsavedDrawerOpen = true"
+            <OTooltip
+              v-if="permissionsUiType === 'table'"
+              :content="
+                t(
+                  'iam.editRole.reviewMissingTooltip',
+                  { count: companionGaps.length },
+                  companionGaps.length,
+                )
+              "
+              :disabled="!companionGaps.length"
             >
-              {{ t("iam.editRole.reviewChanges") }}
-              <OBadge
-                variant="warning-soft"
-                size="sm"
-                class="ms-1.5"
-                data-test="edit-role-unsaved-count"
+              <OButton
+                variant="outline"
+                size="sm-action"
+                :disabled="!pendingChanges.length && !companionGaps.length"
+                data-test="edit-role-review-changes-btn"
+                @click="unsavedDrawerOpen = true"
               >
-                {{ raw(String(pendingChanges.length)) }}
-              </OBadge>
-            </OButton>
+                <template #icon-left>
+                  <OIcon
+                    v-if="companionGaps.length"
+                    name="warning"
+                    size="sm"
+                    class="text-badge-warning-soft-text"
+                    data-test="edit-role-review-missing-icon"
+                  />
+                </template>
+                {{ t("iam.editRole.reviewChanges") }}
+                <OBadge
+                  v-if="pendingChanges.length"
+                  variant="default-soft"
+                  size="sm"
+                  class="ms-1.5"
+                  data-test="edit-role-unsaved-count"
+                >
+                  {{ raw(String(pendingChanges.length)) }}
+                </OBadge>
+              </OButton>
+            </OTooltip>
             <OButton
               data-test="edit-role-cancel-btn"
               variant="outline"
@@ -227,6 +260,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               data-test="edit-role-save-btn"
               variant="primary"
               size="sm-action"
+              :loading="isSaving"
               @click="saveRoleAndMark"
             >
               {{ t("alerts.save") }}
@@ -238,8 +272,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   </OPageLayout>
   <UnsavedChangesDrawer
     v-model:open="unsavedDrawerOpen"
-    :changes="pendingChanges"
-    @undo="(keys) => keys.forEach(updatePermissionMappings)"
+    :groups="pendingGroups"
+    :gaps="companionGaps"
+    :org-id="store.state.selectedOrganization.identifier"
+    :module-label="moduleLabel"
+    :summary-actions="summaryActions"
+    :saving="isSaving"
+    @undo="undoKeys"
+    @add="grantKeys"
+    @open-module="openModuleFromDrawer"
+    @save="saveFromDrawer"
   />
   <EditorDraftDialogs :draft="roleDraft" />
   <EditorDraftLeaveDialog
@@ -267,18 +309,20 @@ import {
   onBeforeUnmount,
   reactive,
   ref,
+  watch,
   type Ref,
 } from "vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OBadge from "@/lib/core/Badge/OBadge.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { raw, useI18nTyped } from "@/types/i18n";
 import type { Resource, Entity, Permission } from "@/ts/interfaces";
 import { useStore } from "vuex";
 import usePermissions from "@/composables/iam/usePermissions";
 import useRoleGrants, { buildGrantKey } from "@/composables/iam/useRoleGrants";
 import ModuleRail, { type RailModule } from "@/components/iam/roles/ModuleRail.vue";
-import ModulePane from "@/components/iam/roles/ModulePane.vue";
+import ModulePane, { type PermissionChange } from "@/components/iam/roles/ModulePane.vue";
 import PermissionsViewSwitch from "@/components/iam/roles/PermissionsViewSwitch.vue";
 import UnsavedChangesDrawer from "@/components/iam/roles/UnsavedChangesDrawer.vue";
 import RoleSummary from "@/components/iam/roles/RoleSummary.vue";
@@ -386,6 +430,9 @@ const roleUsers: Ref<string[]> = ref([]);
 
 const permissionsUiType = ref("table");
 
+// Held here, not in RoleSummary, so a closed Presets panel stays closed when a module is opened and left.
+const presetsOpen = ref(true);
+
 const { getStreams } = useStreams(t);
 
 // Per-tab unsaved-changes flags. Each tab tracks only its own pending changes.
@@ -628,7 +675,16 @@ const getOrgId = () => {
   return store.state.selectedOrganization.identifier;
 };
 
-const { summaryModules, pendingChanges, innerGrants, moduleInnerGrants } = useRoleSummary({
+const {
+  summaryModules,
+  pendingChanges,
+  pendingGroups,
+  companionGaps,
+  entityLabel,
+  summaryActions,
+  innerGrants,
+  moduleInnerGrants,
+} = useRoleSummary({
   selectedPermissionsHash,
   addedPermissions,
   removedPermissions,
@@ -703,6 +759,12 @@ const handlePermissionBatchChange = (
 
 const updatePermissionMappings = (permissionHash: string) => grants.toggle(permissionHash);
 
+const openModuleFromDrawer = (moduleKey: string) => {
+  unsavedDrawerOpen.value = false;
+  activeTab.value = "permissions";
+  activeModule.value = moduleKey;
+};
+
 const expandPermission = async (resource: any) => {
   const expand = !resource.expand;
 
@@ -716,18 +778,29 @@ const expandPermission = async (resource: any) => {
   }
 };
 
-const { seedReadonlyPreset, seedDbmViewerPreset, seedK8sViewerPreset, seedRumPreset, applyPreset } =
-  useRolePresets({
-    permissionsState,
-    resourceMapper,
-    heavyResourceEntities,
-    grants,
-    permissionHashFor,
-    handlePermissionChange,
-    handlePermissionBatchChange,
-    expandPermission,
-    t,
-  });
+const {
+  seedReadonlyPreset,
+  seedDbmViewerPreset,
+  seedK8sViewerPreset,
+  seedRumPreset,
+  applyPreset,
+  presets,
+  previewPreset,
+  loadPresetStreams,
+  applyingPreset,
+} = useRolePresets({
+  permissionsState,
+  resourceMapper,
+  heavyResourceEntities,
+  grants,
+  permissionHashFor,
+  handlePermissionBatchChange,
+  expandPermission,
+  // A lambda: the loaders are declared below, and the panel loads streams only after mount.
+  getResourceEntities: (resource) => getResourceEntities(resource),
+  getStreams,
+  t,
+});
 
 const getPermissionHash = (resourceName: string, permission: string, entity?: string) => {
   if (!entity) entity = "_all_" + store.state.selectedOrganization.identifier;
@@ -836,7 +909,18 @@ const { updatePermissionsUi, updateJsonInTable } = useRoleJsonView({
   getOrgId,
 });
 
-const { saveRole } = useRoleSave({
+// Resolves at once when no preset is staging, else when the running one finishes.
+const presetSettled = () =>
+  new Promise<void>((resolve) => {
+    if (!applyingPreset.value) return resolve();
+    const stop = watch(applyingPreset, (busy) => {
+      if (busy) return;
+      stop();
+      resolve();
+    });
+  });
+
+const { saveRole, isSaving } = useRoleSave({
   editingRole,
   permissionsUiType,
   updateJsonInTable,
@@ -847,9 +931,41 @@ const { saveRole } = useRoleSave({
   removedServiceAccounts,
   roleUsers,
   updateRoleOne,
+  pendingCounts: () => ({
+    changes: pendingChanges.value.length,
+    modules: pendingGroups.value.length,
+  }),
+  presetSettled,
   t,
 });
 
+// A change staged after the save built its payload would be committed as saved without being sent, so edits wait for the PUT.
+const changeFromPane = (change: PermissionChange) => {
+  if (!isSaving.value) handlePermissionBatchChange([change]);
+};
+
+const undoKeys = (keys: string[]) => {
+  if (!isSaving.value) keys.forEach(updatePermissionMappings);
+};
+
+// Toggle revokes a held key, so Add from the drawer only ever adds, however often it is clicked.
+const grantKeys = (keys: string[]) => {
+  if (!isSaving.value) keys.filter((key) => !grants.has(key)).forEach(updatePermissionMappings);
+};
+
+const stagingBusy = computed(() => applyingPreset.value || isSaving.value);
+
+// Entering JSON snapshots the grants and leaving it stages that snapshot, so a preset or save still staging would be overwritten.
+const switchPermissionsUi = (value: string) => {
+  if (!stagingBusy.value) updatePermissionsUi(value);
+};
+
+// The drawer would otherwise stay open on the companion list after the save it was opened for.
+const saveFromDrawer = () => {
+  unsavedDrawerOpen.value = false;
+  saveRoleAndMark();
+};
+
 const sortedStrings = (values: Iterable<unknown>) => [...values].map(String).sort();
 
 const roleDraftSnapshot = (): RoleDraftData => ({
diff --git a/web/src/components/iam/roles/ModulePane.spec.ts b/web/src/components/iam/roles/ModulePane.spec.ts
index c324c9a259..905e91ae46 100644
--- a/web/src/components/iam/roles/ModulePane.spec.ts
+++ b/web/src/components/iam/roles/ModulePane.spec.ts
@@ -677,7 +677,7 @@ describe("ModulePane - column select all", () => {
 
     expect(bulkBox(wrapper, "AllowList").attributes("disabled")).toBeDefined();
     expect(wrapper.find('[data-test="edit-role-module-pane-no-match"]').text()).toContain(
-      String(i18n.global.t("iam.editRole.noModuleMatch")),
+      String(i18n.global.t("iam.editRole.noModuleMatchQuery", { query: "nothing" })),
     );
   });
 
@@ -687,7 +687,7 @@ describe("ModulePane - column select all", () => {
     expect(wrapper.text()).toContain(String(i18n.global.t("iam.editRole.moduleColumn")));
     expect(
       wrapper.find('[data-test="edit-role-module-pane-search"] input').attributes("placeholder"),
-    ).toBe(String(i18n.global.t("iam.editRole.filterModules")));
+    ).toBe(String(i18n.global.t("iam.editRole.filterModulesTasks")));
   });
 
   // All Modules can open before the grants load; its rows never change, so the order must follow the load.
@@ -759,3 +759,127 @@ describe("ModulePane - column select all", () => {
     expect(wrapper.emitted("open")?.at(-1)?.[0]).toStrictEqual(searchJobs);
   });
 });
+
+describe("ModulePane - All Modules filter by group and task word", () => {
+  const t = (key: string, named: Record<string, unknown> = {}) => String(i18n.global.t(key, named));
+
+  const moduleRow = (name: string, label: string, granted: string[] = []) => ({
+    ...makeNode(name, granted, name),
+    display_name: label,
+  });
+
+  const mountModules = (entities: any[]) =>
+    mountPane([], entities, [raw("All Modules")], { listsModules: true });
+
+  const modules = () => [
+    moduleRow("stream", "Streams"),
+    moduleRow("destination", "Destinations"),
+    moduleRow("afolder", "Alert Folders"),
+  ];
+
+  const search = (wrapper: any, value: string) =>
+    wrapper.find('[data-test="edit-role-module-pane-search"] input').setValue(value);
+
+  const row = (wrapper: any, name: string) =>
+    wrapper.find(`[data-test="edit-role-module-pane-open-${name}"]`);
+
+  it("keeps module rows matched by group", async () => {
+    const wrapper = await mountModules(modules());
+
+    await search(wrapper, "alerting");
+
+    expect(row(wrapper, "destination").exists()).toBe(true);
+    expect(row(wrapper, "afolder").exists()).toBe(true);
+    expect(row(wrapper, "stream").exists()).toBe(false);
+  });
+
+  it("keeps module rows matched by task word", async () => {
+    const wrapper = await mountModules([
+      ...modules(),
+      moduleRow("rum_analytics", "Product Analytics"),
+    ]);
+
+    await search(wrapper, "slack");
+
+    expect(row(wrapper, "destination").exists()).toBe(true);
+    expect(row(wrapper, "stream").exists()).toBe(false);
+
+    await search(wrapper, "funnel");
+
+    expect(row(wrapper, "rum_analytics").exists()).toBe(true);
+    expect(row(wrapper, "destination").exists()).toBe(false);
+  });
+
+  it("shows a matched module name as plain text", async () => {
+    const wrapper = await mountModules(modules());
+
+    await search(wrapper, "dest");
+
+    expect(row(wrapper, "destination").exists()).toBe(true);
+    expect(wrapper.find("mark").exists()).toBe(false);
+  });
+
+  // An unknown resource would read as group "Other", so "other" would keep it if module matching leaked in.
+  it("matches resource names only inside a module, never groups or task words", async () => {
+    const wrapper = await mountPane(
+      [makeScope("destination", [], ["destination"])],
+      [makeNode("pagerduty-prod", [], "destination")],
+      [raw("Destinations")],
+    );
+
+    await search(wrapper, "other");
+
+    expect(entityBox(wrapper, "pagerduty-prod", "AllowGet").exists()).toBe(false);
+    expect(wrapper.find('[data-test="edit-role-module-pane-no-match"]').text()).toContain(
+      t("iam.editRole.noMatchingResources"),
+    );
+  });
+
+  it("ticks only the modules a task word keeps from the column header", async () => {
+    const wrapper = await mountModules(modules());
+
+    await search(wrapper, "slack");
+    await wrapper
+      .find('[data-test="edit-role-module-pane-bulk-AllowList"] button[role="checkbox"]')
+      .trigger("click");
+
+    expect((wrapper.emitted("change") ?? []).map(([change]: any) => change.row.name)).toEqual([
+      "destination",
+    ]);
+  });
+
+  it("echoes an HTML query as text and adds the search hint", async () => {
+    const query = "<img src=x onerror=alert(1)>";
+    const wrapper = await mountModules(modules());
+
+    await search(wrapper, query);
+
+    const noMatch = wrapper.find('[data-test="edit-role-module-pane-no-match"]');
+    expect(noMatch.find("img").exists()).toBe(false);
+    expect(noMatch.text()).toContain(t("iam.editRole.noModuleMatchQuery", { query }));
+    expect(noMatch.text()).toContain(t("iam.editRole.noModuleMatchHint"));
+  });
+
+  it("says no module is selected yet under Selected with no query", async () => {
+    const wrapper = await mountModules(modules());
+
+    await wrapper.find('[data-test="edit-role-module-pane-filter-granted"]').trigger("click");
+
+    expect(wrapper.find('[data-test="edit-role-module-pane-no-match"]').text()).toContain(
+      t("iam.editRole.noGrantedModule"),
+    );
+  });
+
+  it("combines the query with Selected", async () => {
+    const wrapper = await mountModules([
+      moduleRow("destination", "Destinations", ["AllowList"]),
+      moduleRow("template", "Templates"),
+    ]);
+
+    await wrapper.find('[data-test="edit-role-module-pane-filter-granted"]').trigger("click");
+    await search(wrapper, "alerting");
+
+    expect(row(wrapper, "destination").exists()).toBe(true);
+    expect(row(wrapper, "template").exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/iam/roles/ModulePane.vue b/web/src/components/iam/roles/ModulePane.vue
index da13c9956d..a5ed156cf3 100644
--- a/web/src/components/iam/roles/ModulePane.vue
+++ b/web/src/components/iam/roles/ModulePane.vue
@@ -57,7 +57,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         clearable
         class="w-72 max-md:w-full"
         :placeholder="
-          listsModules ? t('iam.editRole.filterModules') : t('iam.editRole.searchModuleResources')
+          listsModules
+            ? t('iam.editRole.filterModulesTasks')
+            : t('iam.editRole.searchModuleResources')
         "
         data-test="edit-role-module-pane-search"
         @update:model-value="(value) => setFilter(String(value ?? ''), scope)"
@@ -181,8 +183,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       class="border-border-default text-text-secondary flex shrink-0 items-center gap-2 border-t px-3 py-2 text-xs"
       data-test="edit-role-module-pane-no-match"
     >
-      <span>{{
-        listsModules ? t("iam.editRole.noModuleMatch") : t("iam.editRole.noMatchingResources")
+      <template v-if="listsModules && query.trim()">
+        <span>{{ t("iam.editRole.noModuleMatchQuery", { query: raw(query.trim()) }) }}</span>
+        <span>{{ t("iam.editRole.noModuleMatchHint") }}</span>
+      </template>
+      <span v-else>{{
+        listsModules ? t("iam.editRole.noGrantedModule") : t("iam.editRole.noMatchingResources")
       }}</span>
       <OButton
         variant="ghost-primary"
@@ -204,6 +210,7 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
 import ModulePaneBulkHeader from "@/components/iam/roles/ModulePaneBulkHeader.vue";
+import { GROUP_LABEL_KEYS, matchModule, moduleGroup } from "@/components/iam/roles/roleModules";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import OPageHeader from "@/lib/core/PageHeader/OPageHeader.vue";
 import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
@@ -214,6 +221,7 @@ import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { COL } from "@/lib/core/Table/OTable.types";
+import type { Resource } from "@/ts/interfaces";
 
 export type ScopeRow = {
   key: string;
@@ -364,10 +372,21 @@ const setFilter = (nextQuery: string, nextScope: string) => {
   page.value = 1;
 };
 
+// Module rows carry no group, so it is read from the same map the rail uses.
+const groupLabelOf = (row: Resource) => t(GROUP_LABEL_KEYS[moduleGroup(row.name, row.parent)]);
+
+const moduleMatch = (row: Resource) =>
+  matchModule(
+    { key: row.name, label: String(row.display_name ?? row.name), groupLabel: groupLabelOf(row) },
+    query.value,
+  );
+
 const filteredEntities = computed(() => {
   const term = query.value.trim().toLowerCase();
   return orderedEntities.value.filter((row) => {
     if (scope.value === "granted" && !hasEffectiveGrant(row) && !insideOf(row).count) return false;
+    // Inside a module the search stays on resource names; groups and task words describe modules.
+    if (props.listsModules) return !!moduleMatch(row);
     return (
       !term ||
       String(row.display_name ?? row.name)
diff --git a/web/src/components/iam/roles/ModuleRail.spec.ts b/web/src/components/iam/roles/ModuleRail.spec.ts
index 50f9329cd3..12950a1569 100644
--- a/web/src/components/iam/roles/ModuleRail.spec.ts
+++ b/web/src/components/iam/roles/ModuleRail.spec.ts
@@ -157,6 +157,111 @@ describe("ModuleRail - filter", () => {
   });
 });
 
+describe("ModuleRail - filter by group and task word", () => {
+  const t = (key: string, named: Record<string, unknown> = {}) => String(i18n.global.t(key, named));
+
+  const alerting = { groupId: "alerting", groupLabel: raw("Alerting") };
+
+  const modules = () => [
+    makeModule("stream", { label: raw("Streams") }),
+    makeModule("destination", { label: raw("Destinations"), ...alerting }),
+    makeModule("template", { label: raw("Templates"), ...alerting }),
+  ];
+
+  const search = (wrapper: any, value: string) =>
+    wrapper.find('[data-test="edit-role-module-rail-search"] input').setValue(value);
+
+  it("asks for modules, groups or tasks in the search box", async () => {
+    const wrapper = await mountRail(modules());
+
+    expect(
+      wrapper.find('[data-test="edit-role-module-rail-search"] input').attributes("placeholder"),
+    ).toBe(t("iam.editRole.filterModulesTasks"));
+  });
+
+  it("keeps a whole group when the query matches its name", async () => {
+    const wrapper = await mountRail(modules());
+
+    await search(wrapper, "alert");
+
+    expect(item(wrapper, "destination").exists()).toBe(true);
+    expect(item(wrapper, "template").exists()).toBe(true);
+    expect(item(wrapper, "stream").exists()).toBe(false);
+  });
+
+  it("keeps a module matched by a task word", async () => {
+    const wrapper = await mountRail(modules());
+
+    await search(wrapper, "slack");
+
+    expect(item(wrapper, "destination").exists()).toBe(true);
+    expect(item(wrapper, "template").exists()).toBe(false);
+  });
+
+  it("shows a matched name as plain text, with no highlight", async () => {
+    const wrapper = await mountRail([makeModule("dfolder", { label: raw("Dashboard Folders") })]);
+
+    await search(wrapper, "FOLD");
+
+    expect(wrapper.find("mark").exists()).toBe(false);
+    expect(item(wrapper, "dfolder").find(".o-tab__label").text()).toBe("Dashboard Folders");
+  });
+
+  // "k" is inside "slack"; one letter must not keep a module by its task words.
+  it("ignores task words for a 1-character query", async () => {
+    const wrapper = await mountRail(modules());
+
+    await search(wrapper, "k");
+
+    expect(item(wrapper, "destination").exists()).toBe(false);
+    expect(wrapper.find('[data-test="edit-role-module-rail-no-match"]').text()).toContain(
+      t("iam.editRole.noModuleMatchQuery", { query: "k" }),
+    );
+  });
+
+  it("renders a < in a module label as text, not markup", async () => {
+    const wrapper = await mountRail([makeModule("odd", { label: raw("<b>Odd</b>") })]);
+
+    await search(wrapper, "<b>");
+
+    expect(item(wrapper, "odd").find("b").exists()).toBe(false);
+    expect(item(wrapper, "odd").find(".o-tab__label").text()).toBe("<b>Odd</b>");
+  });
+
+  it("echoes an HTML query as text in the no-match message", async () => {
+    const query = "<img src=x onerror=alert(1)>";
+    const wrapper = await mountRail(modules());
+
+    await search(wrapper, `  ${query}  `);
+
+    const empty = wrapper.find('[data-test="edit-role-module-rail-no-match"]');
+    expect(empty.find("img").exists()).toBe(false);
+    expect(empty.text()).toContain(t("iam.editRole.noModuleMatchQuery", { query }));
+    expect(empty.text()).toContain(t("iam.editRole.noModuleMatchHint"));
+  });
+
+  it("shows the no-match text, not 'No Module Is Selected Yet', with Selected on and an unmatched query", async () => {
+    const wrapper = await mountRail([makeModule("stream", { label: raw("Streams"), granted: 2 })]);
+
+    await wrapper.find('[data-test="edit-role-module-rail-scope-granted"]').trigger("click");
+    await search(wrapper, "zzz");
+
+    const empty = wrapper.find('[data-test="edit-role-module-rail-no-match"]');
+    expect(empty.text()).toContain(t("iam.editRole.noModuleMatchQuery", { query: "zzz" }));
+    expect(empty.text()).not.toContain(t("iam.editRole.noGrantedModule"));
+  });
+
+  it("still shows 'No Module Is Selected Yet' with Selected on and no query", async () => {
+    const wrapper = await mountRail(modules());
+
+    await wrapper.find('[data-test="edit-role-module-rail-scope-granted"]').trigger("click");
+
+    const empty = wrapper.find('[data-test="edit-role-module-rail-no-match"]');
+    expect(empty.text()).toContain(t("iam.editRole.noGrantedModule"));
+    expect(empty.text()).not.toContain(t("iam.editRole.noModuleMatchHint"));
+  });
+});
+
 describe("ModuleRail - granted scope", () => {
   const modules = [makeModule("metrics", { granted: 3 }), makeModule("templates")];
 
diff --git a/web/src/components/iam/roles/ModuleRail.vue b/web/src/components/iam/roles/ModuleRail.vue
index 368de81936..eda64c4fa4 100644
--- a/web/src/components/iam/roles/ModuleRail.vue
+++ b/web/src/components/iam/roles/ModuleRail.vue
@@ -32,7 +32,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         v-model="query"
         clearable
         class="w-full"
-        :placeholder="t('iam.editRole.filterModules')"
+        :placeholder="t('iam.editRole.filterModulesTasks')"
         data-test="edit-role-module-rail-search"
       />
       <OToggleGroup v-model="scope" class="w-full">
@@ -78,7 +78,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <template v-for="group in visibleGroups" :key="group.id">
           <!-- Header behaviour mirrors GroupedFieldList (logs/traces IndexList): click to fold, chevron shows state. -->
           <div
-            class="text-text-secondary bg-surface-subtle rounded-default hover:text-text-heading mt-3 flex cursor-pointer items-center justify-between py-1 ps-1.5 pe-0.5 text-xs font-semibold transition-colors select-none"
+            class="text-text-secondary bg-surface-subtle rounded-default hover:text-text-heading mt-3 flex items-center justify-between py-1 ps-1.5 pe-0.5 text-xs font-semibold transition-colors select-none"
+            :class="term ? 'cursor-default' : 'cursor-pointer'"
             :aria-expanded="isExpanded(group.id)"
             :data-test="`edit-role-module-rail-group-${group.id}`"
             @click="toggleGroup(group.id)"
@@ -125,15 +126,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </template>
       </OTabs>
 
-      <div
-        v-if="!visibleGroups.length"
-        class="text-text-secondary px-1.5 py-4 text-center text-xs"
+      <!-- A query that matches nothing says so even under Selected, where "nothing selected" would be false. -->
+      <OEmptyState
+        v-if="!visibleGroups.length && (term || scope === 'granted')"
+        size="inline"
+        variant="no-results"
+        class="px-1.5"
+        :title="
+          term
+            ? t('iam.editRole.noModuleMatchQuery', { query: raw(term) })
+            : t('iam.editRole.noGrantedModule')
+        "
+        :description="term ? t('iam.editRole.noModuleMatchHint') : undefined"
         data-test="edit-role-module-rail-no-match"
-      >
-        {{
-          scope === "granted" ? t("iam.editRole.noGrantedModule") : t("iam.editRole.noModuleMatch")
-        }}
-      </div>
+      />
     </div>
   </nav>
 </template>
@@ -143,6 +149,7 @@ import { computed, ref, watch } from "vue";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import OBadge from "@/lib/core/Badge/OBadge.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
@@ -151,7 +158,7 @@ import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
-import { ALL_MODULES_ICON, ALL_MODULES_KEY } from "@/components/iam/roles/roleModules";
+import { ALL_MODULES_ICON, ALL_MODULES_KEY, matchModule } from "@/components/iam/roles/roleModules";
 
 export type RailModule = {
   key: string;
@@ -174,17 +181,18 @@ const { t, locale } = useI18nTyped();
 
 const query = ref("");
 
+const term = computed(() => query.value.trim());
+
 const scope = ref("all");
 
 const grantedCount = computed(() => props.modules.filter((module) => module.granted > 0).length);
 
 const visibleGroups = computed(() => {
-  const term = query.value.trim().toLowerCase();
   const groups: { id: string; label: I18nText; modules: RailModule[] }[] = [];
 
   props.modules.forEach((module) => {
     if (scope.value === "granted" && !module.granted) return;
-    if (term && !String(module.label).toLowerCase().includes(term)) return;
+    if (!matchModule(module, term.value)) return;
 
     const last = groups[groups.length - 1];
     if (last && last.id === module.groupId) last.modules.push(module);
diff --git a/web/src/components/iam/roles/PermissionsViewSwitch.vue b/web/src/components/iam/roles/PermissionsViewSwitch.vue
index 3d483e5074..cff1aceb31 100644
--- a/web/src/components/iam/roles/PermissionsViewSwitch.vue
+++ b/web/src/components/iam/roles/PermissionsViewSwitch.vue
@@ -23,6 +23,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <OToggleGroup
       data-test="edit-role-permissions-ui-type-toggle"
       :model-value="modelValue"
+      :disabled="disabled"
       @update:model-value="(value) => emit('update:modelValue', value as string)"
     >
       <OToggleGroupItem value="table" size="sm" data-test="edit-role-permissions-show-table-btn">
@@ -40,7 +41,7 @@ import { raw, useI18nTyped } from "@/types/i18n";
 import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 
-defineProps<{ count: number; modelValue: string; loading?: boolean }>();
+defineProps<{ count: number; modelValue: string; loading?: boolean; disabled?: boolean }>();
 
 const emit = defineEmits<{ "update:modelValue": [value: string] }>();
 
diff --git a/web/src/components/iam/roles/RolePresetsPanel.spec.ts b/web/src/components/iam/roles/RolePresetsPanel.spec.ts
new file mode 100644
index 0000000000..74595e5ebc
--- /dev/null
+++ b/web/src/components/iam/roles/RolePresetsPanel.spec.ts
@@ -0,0 +1,527 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { mount, flushPromises, type VueWrapper } from "@vue/test-utils";
+import i18n from "@/locales";
+import { raw } from "@/types/i18n";
+import type { PresetInfo, PresetPreview } from "@/composables/iam/useRolePresets";
+import RolePresetsPanel from "@/components/iam/roles/RolePresetsPanel.vue";
+
+const t = (key: string, named: Record<string, unknown> = {}, plural?: number) =>
+  plural === undefined
+    ? String(i18n.global.t(key, named))
+    : String(i18n.global.t(key, named, plural));
+
+const preset = (id: string, section: PresetInfo["section"], title: string): PresetInfo => ({
+  id,
+  section,
+  titleKey: `iam.editRole.${title}Title`,
+  descriptionKey: `iam.editRole.${title}Description`,
+  icon: "visibility",
+  tone: "alerting",
+});
+
+// Listed job-first on purpose: the panel orders sections, not the caller.
+const PRESETS: PresetInfo[] = [
+  preset("alert_manager", "job", "presetAlertManager"),
+  preset("alert_viewer", "job", "presetAlertViewer"),
+  preset("readonly", "builtin", "presetReadonly"),
+  preset("dbm", "builtin", "presetDbm"),
+];
+
+const ORG_WIDE = "_all_default";
+
+const LABELS: Record<string, string> = {
+  afolder: "Alert Folders",
+  destination: "Destinations",
+  template: "Templates",
+  stream: "Streams",
+};
+
+const ACTION_KEYS: Record<string, string> = {
+  AllowAll: "iam.all",
+  AllowList: "iam.list",
+  AllowGet: "iam.get",
+};
+
+const ready = (overrides: Partial<PresetPreview> = {}): PresetPreview => ({
+  status: "ready",
+  adds: [],
+  restores: [],
+  skipped: 0,
+  stillMissing: [],
+  ...overrides,
+});
+
+const ALERT_MANAGER = ready({
+  adds: [
+    `afolder:${ORG_WIDE}:AllowAll`,
+    `destination:${ORG_WIDE}:AllowAll`,
+    `template:${ORG_WIDE}:AllowAll`,
+    `stream:${ORG_WIDE}:AllowList`,
+    `stream:${ORG_WIDE}:AllowGet`,
+  ],
+  readsEveryStream: true,
+});
+
+let wrapper: VueWrapper | undefined;
+afterEach(() => wrapper?.unmount());
+
+async function mountPanel(
+  previews: Record<string, PresetPreview>,
+  props: Partial<{ loading: boolean; applying: boolean; presets: PresetInfo[] }> = {},
+) {
+  wrapper = mount(RolePresetsPanel, {
+    attachTo: document.body,
+    global: { plugins: [i18n] },
+    props: {
+      presets: PRESETS,
+      previewPreset: (id: string) => previews[id] ?? ready(),
+      loading: false,
+      applying: false,
+      moduleLabel: (key: string) => raw(LABELS[key] ?? key),
+      entityLabel: (_resource: string, entity: string) => raw(entity),
+      summaryActions: (actions: string[]) =>
+        actions.map((action) => ({ action, label: raw(t(ACTION_KEYS[action] ?? action)) })),
+      ...props,
+    },
+  });
+  await flushPromises();
+  return wrapper;
+}
+
+const status = (w: VueWrapper, id: string) => w.find(`[data-test="edit-role-preset-${id}-status"]`);
+
+async function openDetail(w: VueWrapper, id: string) {
+  await w.find(`[data-test="edit-role-preset-${id}"]`).trigger("click");
+  await flushPromises();
+  return w.find('[data-test="edit-role-preset-detail"]');
+}
+
+describe("RolePresetsPanel - list", () => {
+  it("lists Built-In before By Job, each with its own presets", async () => {
+    const w = await mountPanel({});
+
+    const sections = w.findAll('[data-test^="edit-role-preset-section-"]');
+    expect(sections.map((section) => section.attributes("data-test"))).toEqual([
+      "edit-role-preset-section-builtin",
+      "edit-role-preset-section-job",
+    ]);
+    expect(sections[0].text()).toContain(t("iam.editRole.presetsSectionBuiltin"));
+    expect(sections[0].find('[data-test="edit-role-preset-readonly"]').exists()).toBe(true);
+    expect(sections[1].text()).toContain(t("iam.editRole.presetsSectionJob"));
+    expect(sections[1].find('[data-test="edit-role-preset-alert_manager"]').exists()).toBe(true);
+  });
+
+  it("drops a section with no presets", async () => {
+    const w = await mountPanel({}, { presets: PRESETS.filter((p) => p.section === "builtin") });
+
+    expect(w.find('[data-test="edit-role-preset-section-job"]').exists()).toBe(false);
+  });
+
+  it("shows +N with a spoken count when the preset adds grants", async () => {
+    const w = await mountPanel({ alert_manager: ALERT_MANAGER });
+
+    expect(status(w, "alert_manager").text()).toBe("+5");
+    expect(w.find('[data-test="edit-role-preset-alert_manager"]').text()).toContain(
+      t("iam.editRole.presetAddsTooltip", { count: 5 }, 5),
+    );
+  });
+
+  it("shows In Role only when the role already holds every grant", async () => {
+    const w = await mountPanel({
+      readonly: ready({ skipped: 12 }),
+      dbm: ready({ noMatchingStreams: true }),
+    });
+
+    expect(status(w, "readonly").text()).toBe(t("iam.editRole.presetInRole"));
+    // Nothing to add because no stream matched is not "already in the role".
+    expect(status(w, "dbm").exists()).toBe(false);
+  });
+
+  // Every Edit Role visit would otherwise fetch the metrics and logs lists.
+  it("asks for the stream lists only when a stream preset opens", async () => {
+    const w = await mountPanel({ dbm: ready({ status: "loading" }), readonly: ready() });
+
+    expect(status(w, "dbm").exists()).toBe(false);
+    expect(w.emitted("load-streams")).toBeUndefined();
+
+    await openDetail(w, "readonly");
+    await w.find('[data-test="edit-role-preset-back"]').trigger("click");
+    expect(w.emitted("load-streams")).toBeUndefined();
+
+    await openDetail(w, "dbm");
+    expect(w.emitted("load-streams")).toHaveLength(1);
+    expect(w.find('[data-test="edit-role-preset-loading"]').exists()).toBe(true);
+  });
+
+  // A lookup that matched nothing must not stick: streams ingested since then show on the next open.
+  it("asks for the stream lists each time a stream preset opens, even once ready", async () => {
+    const w = await mountPanel({ dbm: ready({ noMatchingStreams: true }), readonly: ready() });
+
+    await openDetail(w, "dbm");
+    await w.find('[data-test="edit-role-preset-back"]').trigger("click");
+    await openDetail(w, "dbm");
+    await w.find('[data-test="edit-role-preset-back"]').trigger("click");
+    await openDetail(w, "readonly");
+
+    expect(w.emitted("load-streams")).toHaveLength(2);
+  });
+
+  it("shows a skeleton once the lists are asked for, and nothing when they fail", async () => {
+    const w = await mountPanel({
+      dbm: ready({ status: "loading" }),
+      readonly: ready({ status: "failed", adds: ["stream:_all_default:AllowList"] }),
+    });
+
+    await openDetail(w, "dbm");
+    await w.find('[data-test="edit-role-preset-back"]').trigger("click");
+
+    expect(status(w, "dbm").attributes("aria-label")).toBe(t("iam.editRole.presetLoadingStreams"));
+    expect(status(w, "dbm").text()).toBe("");
+    expect(status(w, "readonly").exists()).toBe(false);
+  });
+
+  // Counts on the empty pre-load grant store would be wrong, so every badge waits.
+  it("shows no counts and opens nothing while the saved grants load", async () => {
+    const w = await mountPanel({ alert_manager: ALERT_MANAGER }, { loading: true });
+
+    expect(status(w, "alert_manager").text()).toBe("");
+    await w.find('[data-test="edit-role-preset-alert_manager"]').trigger("click");
+    expect(w.find('[data-test="edit-role-preset-detail"]').exists()).toBe(false);
+    expect(w.emitted("load-streams")).toBeUndefined();
+  });
+});
+
+describe("RolePresetsPanel - detail", () => {
+  it("opens the detail in place of the list and moves focus to Back", async () => {
+    const w = await mountPanel({ alert_manager: ALERT_MANAGER });
+
+    const detail = await openDetail(w, "alert_manager");
+
+    expect(detail.exists()).toBe(true);
+    expect(w.find('[data-test="edit-role-preset-section-builtin"]').exists()).toBe(false);
+    expect(document.activeElement?.getAttribute("data-test")).toBe("edit-role-preset-back");
+  });
+
+  it("summarises the grants it adds and where it can write", async () => {
+    const w = await mountPanel({ alert_manager: ALERT_MANAGER });
+
+    const detail = await openDetail(w, "alert_manager");
+
+    expect(detail.find('[data-test="edit-role-preset-summary"]').text()).toBe(
+      `${t("iam.editRole.presetSummaryAdds", {
+        permissions: t("iam.editRole.presetPermissionCount", { count: 5 }, 5),
+        modules: t("iam.editRole.presetModuleCount", { count: 4 }, 4),
+      })} ${t("iam.editRole.presetSummaryWrite", {
+        modules: "Alert Folders, Destinations, and Templates",
+      })}`,
+    );
+    expect(detail.find('[data-test="edit-role-preset-row-afolder:_all_default"]').text()).toContain(
+      "Alert Folders",
+    );
+  });
+
+  it("says view only when no grant writes", async () => {
+    const w = await mountPanel({
+      alert_viewer: ready({
+        adds: [`afolder:${ORG_WIDE}:AllowList`, `afolder:${ORG_WIDE}:AllowGet`],
+      }),
+    });
+
+    const detail = await openDetail(w, "alert_viewer");
+
+    expect(detail.find('[data-test="edit-role-preset-summary"]').text()).toContain(
+      t("iam.editRole.presetSummaryViewOnly"),
+    );
+    expect(detail.text()).toContain(
+      t("iam.editRole.presetSummaryAdds", {
+        permissions: t("iam.editRole.presetPermissionCount", { count: 2 }, 2),
+        modules: t("iam.editRole.presetModuleCount", { count: 1 }, 1),
+      }),
+    );
+  });
+
+  it("says the role has everything and how many grants it skips", async () => {
+    const w = await mountPanel({ readonly: ready({ skipped: 1 }) });
+
+    const detail = await openDetail(w, "readonly");
+
+    expect(detail.find('[data-test="edit-role-preset-summary"]').text()).toBe(
+      t("iam.editRole.presetSummaryHasAll"),
+    );
+    expect(detail.find('[data-test="edit-role-preset-skipped"]').text()).toBe(
+      t("iam.editRole.presetSummarySkipped", { count: 1 }, 1),
+    );
+  });
+
+  it("lists what is still missing after adding", async () => {
+    const w = await mountPanel({
+      alert_viewer: ready({
+        adds: [`destination:${ORG_WIDE}:AllowList`],
+        stillMissing: [
+          {
+            module: "stream",
+            actions: ["AllowGet"],
+            neededBy: [{ module: "afolder", reasonKey: "companionReasonAlertStreams" }],
+          },
+        ],
+      }),
+    });
+
+    const detail = await openDetail(w, "alert_viewer");
+
+    expect(detail.find('[data-test="edit-role-preset-missing"]').text()).toBe(
+      "Still missing after adding: Streams: Get",
+    );
+    expect(detail.find('[data-test="edit-role-preset-ok"]').exists()).toBe(false);
+  });
+
+  it("joins several gaps and their actions as lists", async () => {
+    const w = await mountPanel({
+      alert_viewer: ready({
+        adds: [`afolder:${ORG_WIDE}:AllowAll`],
+        stillMissing: [
+          { module: "stream", actions: ["AllowList", "AllowGet"], neededBy: [] },
+          { module: "destination", actions: ["AllowList"], neededBy: [] },
+        ],
+      }),
+    });
+
+    const detail = await openDetail(w, "alert_viewer");
+
+    expect(detail.find('[data-test="edit-role-preset-missing"]').text()).toBe(
+      "Still missing after adding: Streams: List and Get, Destinations: List",
+    );
+  });
+
+  it.each([
+    ["alert_manager", ALERT_MANAGER, true],
+    ["alert_viewer", ready({ adds: [`afolder:${ORG_WIDE}:AllowList`] }), false],
+  ])("%s: the reads-every-stream line shows is %s", async (id, preview, shown) => {
+    const w = await mountPanel({ [id]: preview });
+
+    const detail = await openDetail(w, id);
+
+    const line = detail.find('[data-test="edit-role-preset-reads-every-stream"]');
+    expect(line.exists()).toBe(shown);
+    if (shown) expect(line.text()).toBe(t("iam.editRole.presetReadsEveryStream"));
+  });
+
+  it("says nothing will be missing when no gap is left", async () => {
+    const w = await mountPanel({ readonly: ready({ adds: [`afolder:${ORG_WIDE}:AllowList`] }) });
+
+    const detail = await openDetail(w, "readonly");
+
+    expect(detail.find('[data-test="edit-role-preset-ok"]').text()).toBe(
+      t("iam.editRole.presetNothingMissing"),
+    );
+    expect(detail.find('[data-test="edit-role-preset-missing"]').exists()).toBe(false);
+  });
+
+  it("ignores the second click of a double click on Add and on the list row", async () => {
+    const w = await mountPanel({
+      alert_viewer: ready({ adds: [`afolder:${ORG_WIDE}:AllowAll`] }),
+    });
+
+    w.find('[data-test="edit-role-preset-alert_viewer"]').element.dispatchEvent(
+      new MouseEvent("click", { detail: 2, bubbles: true }),
+    );
+    expect(w.find('[data-test="edit-role-preset-detail"]').exists()).toBe(false);
+
+    await openDetail(w, "alert_viewer");
+    w.find('[data-test="edit-role-preset-apply"]').element.dispatchEvent(
+      new MouseEvent("click", { detail: 2, bubbles: true }),
+    );
+    expect(w.emitted("apply")).toBeUndefined();
+  });
+
+  // Applying only cancels the staged removal, so nothing is counted as added.
+  it("says Keep, not Add, when every grant is a removal the admin staged", async () => {
+    const w = await mountPanel({
+      alert_viewer: ready({
+        adds: [`afolder:${ORG_WIDE}:AllowAll`],
+        restores: [`afolder:${ORG_WIDE}:AllowAll`],
+      }),
+    });
+
+    const detail = await openDetail(w, "alert_viewer");
+    const button = w.find('[data-test="edit-role-preset-apply"]');
+
+    expect(detail.find('[data-test="edit-role-preset-summary"]').text()).toBe(
+      t("iam.editRole.presetSummaryRestores", { count: 1 }, 1),
+    );
+    expect(button.text()).toBe(t("iam.editRole.presetRestoreButton", { count: 1 }, 1));
+    expect(button.attributes("disabled")).toBeUndefined();
+    await button.trigger("click");
+    expect(w.emitted("apply")).toEqual([["alert_viewer"]]);
+  });
+
+  it("counts only new grants as added when some are staged removals", async () => {
+    const w = await mountPanel({
+      alert_manager: ready({
+        adds: [
+          `afolder:${ORG_WIDE}:AllowAll`,
+          `destination:${ORG_WIDE}:AllowAll`,
+          `stream:${ORG_WIDE}:AllowList`,
+        ],
+        restores: [`afolder:${ORG_WIDE}:AllowAll`],
+      }),
+    });
+
+    expect(status(w, "alert_manager").text()).toBe("+2");
+    const detail = await openDetail(w, "alert_manager");
+
+    expect(detail.find('[data-test="edit-role-preset-summary"]').text()).toBe(
+      [
+        t("iam.editRole.presetSummaryAdds", {
+          permissions: t("iam.editRole.presetPermissionCount", { count: 2 }, 2),
+          modules: t("iam.editRole.presetModuleCount", { count: 2 }, 2),
+        }),
+        t("iam.editRole.presetSummaryWrite", { modules: "Alert Folders and Destinations" }),
+        t("iam.editRole.presetSummaryRestores", { count: 1 }, 1),
+      ].join(" "),
+    );
+    expect(w.find('[data-test="edit-role-preset-apply"]').text()).toBe(
+      t("iam.editRole.presetAddButton", { count: 2 }, 2),
+    );
+  });
+
+  it("names a restored write grant instead of saying view only", async () => {
+    const w = await mountPanel({
+      alert_manager: ready({
+        adds: [
+          `afolder:${ORG_WIDE}:AllowAll`,
+          `stream:${ORG_WIDE}:AllowList`,
+          `stream:${ORG_WIDE}:AllowGet`,
+        ],
+        restores: [`afolder:${ORG_WIDE}:AllowAll`],
+      }),
+    });
+
+    const summary = (await openDetail(w, "alert_manager")).find(
+      '[data-test="edit-role-preset-summary"]',
+    );
+
+    expect(summary.text()).toContain(
+      t("iam.editRole.presetSummaryWrite", { modules: "Alert Folders" }),
+    );
+    expect(summary.text()).not.toContain(t("iam.editRole.presetSummaryViewOnly"));
+    expect(summary.text()).toContain(
+      t("iam.editRole.presetSummaryAdds", {
+        permissions: t("iam.editRole.presetPermissionCount", { count: 2 }, 2),
+        modules: t("iam.editRole.presetModuleCount", { count: 1 }, 1),
+      }),
+    );
+  });
+
+  it("disables Add with Nothing To Add when the role holds everything", async () => {
+    const w = await mountPanel({ readonly: ready({ skipped: 3 }) });
+
+    await openDetail(w, "readonly");
+    const button = w.find('[data-test="edit-role-preset-apply"]');
+
+    expect(button.text()).toBe(t("iam.editRole.presetNothingToAdd"));
+    expect(button.attributes("disabled")).toBeDefined();
+    await button.trigger("click");
+    expect(w.emitted("apply")).toBeUndefined();
+  });
+
+  // A second Add while the first is staging could toggle its grants back off.
+  it("keeps Add disabled while a preset is being applied", async () => {
+    const w = await mountPanel({ alert_manager: ALERT_MANAGER }, { applying: true });
+
+    await openDetail(w, "alert_manager");
+    const button = w.find('[data-test="edit-role-preset-apply"]');
+    await button.trigger("click");
+
+    expect(button.attributes("disabled")).toBeDefined();
+    expect(w.emitted("apply")).toBeUndefined();
+  });
+
+  it("keeps Add disabled while the stream lists load", async () => {
+    const w = await mountPanel({ dbm: ready({ status: "loading" }) });
+
+    await openDetail(w, "dbm");
+    const button = w.find('[data-test="edit-role-preset-apply"]');
+
+    expect(w.find('[data-test="edit-role-preset-loading"]').exists()).toBe(true);
+    expect(button.text()).toBe(t("iam.editRole.presetLoadingStreams"));
+    expect(button.attributes("disabled")).toBeDefined();
+  });
+
+  it("shows a failed stream load with Retry instead of claiming the role has everything", async () => {
+    const w = await mountPanel({ dbm: ready({ status: "failed" }) });
+
+    const detail = await openDetail(w, "dbm");
+
+    expect(detail.find('[data-test="edit-role-preset-failed"]').text()).toContain(
+      t("iam.editRole.presetStreamsFailed"),
+    );
+    expect(detail.text()).not.toContain(t("iam.editRole.presetSummaryHasAll"));
+    expect(detail.text()).not.toContain(t("iam.editRole.presetNothingMissing"));
+    expect(detail.text()).not.toContain(t("iam.editRole.presetNothingToAdd"));
+    expect(w.find('[data-test="edit-role-preset-apply"]').exists()).toBe(false);
+    expect(w.emitted("load-streams")).toHaveLength(1);
+
+    await detail.find('[data-test="edit-role-preset-retry"]').trigger("click");
+
+    expect(w.emitted("load-streams")).toHaveLength(2);
+  });
+
+  it("says no stream matched instead of claiming the role has everything", async () => {
+    const w = await mountPanel({ dbm: ready({ noMatchingStreams: true }) });
+
+    const detail = await openDetail(w, "dbm");
+
+    expect(detail.find('[data-test="edit-role-preset-summary"]').text()).toBe(
+      t("iam.editRole.presetNoMatchingStreams"),
+    );
+  });
+
+  it("emits apply with the preset, then returns to the list on its row", async () => {
+    const w = await mountPanel({ alert_manager: ALERT_MANAGER });
+
+    await openDetail(w, "alert_manager");
+    const button = w.find('[data-test="edit-role-preset-apply"]');
+    expect(button.text()).toBe(t("iam.editRole.presetAddButton", { count: 5 }, 5));
+
+    await button.trigger("click");
+    await flushPromises();
+
+    expect(w.emitted("apply")).toEqual([["alert_manager"]]);
+    expect(w.find('[data-test="edit-role-preset-detail"]').exists()).toBe(false);
+    expect(document.activeElement?.getAttribute("data-test")).toBe(
+      "edit-role-preset-alert_manager",
+    );
+  });
+
+  it("goes back to the list without applying", async () => {
+    const w = await mountPanel({ alert_manager: ALERT_MANAGER });
+
+    await openDetail(w, "alert_manager");
+    await w.find('[data-test="edit-role-preset-back"]').trigger("click");
+    await flushPromises();
+
+    expect(w.find('[data-test="edit-role-preset-detail"]').exists()).toBe(false);
+    expect(w.find('[data-test="edit-role-preset-alert_manager"]').exists()).toBe(true);
+    expect(w.emitted("apply")).toBeUndefined();
+    expect(document.activeElement?.getAttribute("data-test")).toBe(
+      "edit-role-preset-alert_manager",
+    );
+  });
+});
+
+describe("RolePresetsPanel - close", () => {
+  it("offers a named close button on the list and in a preset's detail", async () => {
+    const w = await mountPanel({ alert_manager: ALERT_MANAGER });
+    const close = () => w.find('[data-test="edit-role-presets-close"]');
+
+    expect(close().attributes("aria-label")).toBe(t("iam.editRole.presetsClose"));
+    await close().trigger("click");
+    expect(w.emitted("close")).toHaveLength(1);
+
+    await openDetail(w, "alert_manager");
+    expect(close().exists()).toBe(true);
+    await close().trigger("click");
+    expect(w.emitted("close")).toHaveLength(2);
+  });
+});
diff --git a/web/src/components/iam/roles/RolePresetsPanel.vue b/web/src/components/iam/roles/RolePresetsPanel.vue
new file mode 100644
index 0000000000..cfccff0b88
--- /dev/null
+++ b/web/src/components/iam/roles/RolePresetsPanel.vue
@@ -0,0 +1,513 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <aside
+    ref="root"
+    :aria-label="t('iam.editRole.presetsTitle')"
+    data-test="edit-role-presets-panel"
+    class="bg-surface-panel flex min-h-0 flex-col"
+  >
+    <template v-if="!detail">
+      <div
+        class="border-border-default flex min-h-14 shrink-0 items-center gap-2 border-b px-3 py-2"
+      >
+        <span
+          class="rounded-default bg-tabs-active-bg text-tabs-active-text inline-flex size-8 shrink-0 items-center justify-center"
+        >
+          <OIcon name="library-add" size="sm" />
+        </span>
+        <span class="min-w-0">
+          <span class="text-text-heading block text-sm font-semibold">
+            {{ t("iam.editRole.presetsTitle") }}
+          </span>
+          <span class="text-text-secondary block text-xs">
+            {{ t("iam.editRole.presetsSubtitle") }}
+          </span>
+        </span>
+        <OButton
+          variant="ghost"
+          size="icon-xs"
+          class="ms-auto"
+          :aria-label="t('iam.editRole.presetsClose')"
+          data-test="edit-role-presets-close"
+          @click="emit('close')"
+        >
+          <OIcon name="close" size="sm" />
+        </OButton>
+      </div>
+
+      <div class="min-h-0 flex-1 overflow-y-auto px-2 pt-1 pb-2">
+        <section
+          v-for="section in sections"
+          :key="section.id"
+          :data-test="`edit-role-preset-section-${section.id}`"
+        >
+          <h3 class="text-text-secondary px-2 pt-3 pb-1 text-xs font-semibold">
+            {{ section.label }}
+          </h3>
+          <div class="grid gap-1.5">
+            <EmptyStateActionCard
+              v-for="item in section.items"
+              :key="item.preset.id"
+              size="compact"
+              class="w-full max-w-full"
+              :icon="item.preset.icon"
+              :label="t(item.preset.titleKey)"
+              :sublabel="t(item.preset.descriptionKey)"
+              :unavailable="loading"
+              :data-test="`edit-role-preset-${item.preset.id}`"
+              @click="openPreset($event, item.preset.id)"
+            >
+              <template #label>
+                <span class="flex min-w-0 items-center gap-2">
+                  <OTruncatedText class="flex-1">{{ t(item.preset.titleKey) }}</OTruncatedText>
+                  <OSkeleton
+                    v-if="item.badge === 'loading'"
+                    class="h-5 w-8 shrink-0"
+                    :aria-label="
+                      loading
+                        ? t('components.skeleton.loading')
+                        : t('iam.editRole.presetLoadingStreams')
+                    "
+                    :data-test="`edit-role-preset-${item.preset.id}-status`"
+                  />
+                  <template v-else-if="item.badge === 'adds'">
+                    <!-- Hidden from readers so the badge text stays "+N"; the sentence below names it. -->
+                    <OBadge
+                      variant="primary-soft"
+                      size="sm"
+                      class="shrink-0"
+                      aria-hidden="true"
+                      :data-test="`edit-role-preset-${item.preset.id}-status`"
+                    >
+                      <OTooltip :content="addsHint(item.adds)" />{{ raw(`+${item.adds}`) }}
+                    </OBadge>
+                    <span class="sr-only">{{ addsHint(item.adds) }}</span>
+                  </template>
+                  <OBadge
+                    v-else-if="item.badge === 'in-role'"
+                    variant="success-soft"
+                    size="sm"
+                    class="shrink-0"
+                    :data-test="`edit-role-preset-${item.preset.id}-status`"
+                  >
+                    <OTooltip :content="t('iam.editRole.presetInRoleTooltip')" />{{
+                      t("iam.editRole.presetInRole")
+                    }}
+                  </OBadge>
+                </span>
+              </template>
+            </EmptyStateActionCard>
+          </div>
+        </section>
+      </div>
+    </template>
+
+    <div v-else class="flex min-h-0 flex-1 flex-col" data-test="edit-role-preset-detail">
+      <div
+        class="border-border-default flex min-h-14 shrink-0 items-center gap-2 border-b px-3 py-2"
+      >
+        <OButton
+          variant="ghost"
+          size="icon-xs"
+          :aria-label="t('iam.editRole.presetBack')"
+          data-test="edit-role-preset-back"
+          @click="closePreset"
+        >
+          <OIcon name="chevron-left" size="sm" />
+        </OButton>
+        <span
+          class="rounded-default inline-flex size-8 shrink-0 items-center justify-center"
+          :class="groupTone(detail.tone)"
+        >
+          <OIcon :name="detail.icon" size="sm" />
+        </span>
+        <span class="min-w-0">
+          <span class="text-text-heading block text-sm font-semibold">
+            {{ t(detail.titleKey) }}
+          </span>
+          <span class="text-text-secondary block text-xs">
+            {{ t(detail.descriptionKey) }}
+          </span>
+        </span>
+        <OButton
+          variant="ghost"
+          size="icon-xs"
+          class="ms-auto"
+          :aria-label="t('iam.editRole.presetsClose')"
+          data-test="edit-role-presets-close"
+          @click="emit('close')"
+        >
+          <OIcon name="close" size="sm" />
+        </OButton>
+      </div>
+
+      <div class="min-h-0 flex-1 overflow-y-auto px-2 pt-1 pb-2">
+        <div
+          v-if="detailLoading"
+          class="flex flex-col gap-2 px-1 py-3"
+          data-test="edit-role-preset-loading"
+        >
+          <OSkeleton
+            type="text"
+            class="w-3/4"
+            :aria-label="t('iam.editRole.presetLoadingStreams')"
+          />
+          <OSkeleton type="text" class="w-1/2" aria-hidden="true" />
+        </div>
+
+        <div
+          v-else-if="detailPreview?.status === 'failed'"
+          class="flex flex-col items-start gap-2 px-1 py-3"
+          data-test="edit-role-preset-failed"
+        >
+          <span class="text-badge-warning-soft-text flex items-start gap-1 text-xs">
+            <OIcon name="warning" size="sm" class="shrink-0" />
+            {{ t("iam.editRole.presetStreamsFailed") }}
+          </span>
+          <OButton
+            variant="outline"
+            size="sm"
+            icon-left="refresh"
+            data-test="edit-role-preset-retry"
+            @click="requestStreams"
+          >
+            {{ t("iam.editRole.presetRetry") }}
+          </OButton>
+        </div>
+
+        <template v-else-if="detailPreview">
+          <div class="border-border-subtle border-b px-1 pt-2 pb-2.5">
+            <p class="text-compact text-text-body" data-test="edit-role-preset-summary">
+              {{ summary.join(" ") }}
+            </p>
+            <span
+              v-if="detailPreview.noMatchingStreams && detailPreview.adds.length"
+              class="text-text-secondary mt-0.5 block text-xs"
+            >
+              {{ t("iam.editRole.presetNoMatchingStreams") }}
+            </span>
+            <span
+              v-if="detailPreview.skipped"
+              class="text-text-secondary mt-0.5 block text-xs"
+              data-test="edit-role-preset-skipped"
+            >
+              {{
+                t(
+                  "iam.editRole.presetSummarySkipped",
+                  { count: detailPreview.skipped },
+                  detailPreview.skipped,
+                )
+              }}
+            </span>
+            <div
+              v-if="detailPreview.readsEveryStream"
+              class="text-text-secondary mt-1.5 flex items-start gap-1 text-xs"
+              data-test="edit-role-preset-reads-every-stream"
+            >
+              <OIcon name="info" size="sm" class="shrink-0" />
+              <span>{{ t("iam.editRole.presetReadsEveryStream") }}</span>
+            </div>
+            <div
+              v-if="missingLine"
+              class="text-badge-warning-soft-text mt-1.5 flex items-start gap-1 text-xs"
+              data-test="edit-role-preset-missing"
+            >
+              <OIcon name="warning" size="sm" class="shrink-0" />
+              <span>{{ missingLine }}</span>
+            </div>
+            <div
+              v-else
+              class="text-badge-success-soft-text mt-1.5 flex items-center gap-1 text-xs"
+              data-test="edit-role-preset-ok"
+            >
+              <OIcon name="check-circle" size="sm" class="shrink-0" />
+              {{ t("iam.editRole.presetNothingMissing") }}
+            </div>
+          </div>
+
+          <ul v-if="rows.length" class="py-1">
+            <li
+              v-for="row in rows"
+              :key="row.id"
+              class="flex items-start gap-2 px-1 py-1.5"
+              :data-test="`edit-role-preset-row-${row.id}`"
+            >
+              <OIcon
+                :name="moduleIcon(row.resource)"
+                size="sm"
+                class="text-text-secondary mt-0.5 shrink-0"
+              />
+              <span class="flex min-w-0 flex-1 flex-col">
+                <span class="text-compact text-text-heading">{{ moduleLabel(row.resource) }}</span>
+                <OTruncatedText class="text-text-secondary text-xs">
+                  {{ entityLabel(row.resource, row.entity) }}
+                </OTruncatedText>
+              </span>
+              <span class="flex max-w-30 flex-wrap justify-end gap-1">
+                <OBadge
+                  v-for="action in row.actions"
+                  :key="action.action"
+                  variant="primary-soft"
+                  size="sm"
+                >
+                  {{ action.label }}
+                </OBadge>
+              </span>
+            </li>
+          </ul>
+        </template>
+      </div>
+
+      <div
+        v-if="detailPreview?.status !== 'failed'"
+        class="border-border-default shrink-0 border-t p-3"
+      >
+        <OButton
+          variant="outline"
+          size="sm-action"
+          block
+          :disabled="!addCount || applying"
+          data-test="edit-role-preset-apply"
+          @click="applyPreset"
+        >
+          {{ addLabel }}
+        </OButton>
+        <p class="text-text-secondary mt-1.5 text-center text-xs">
+          {{ t("iam.editRole.presetApplyNote") }}
+        </p>
+      </div>
+    </div>
+  </aside>
+</template>
+
+<script setup lang="ts">
+import { computed, nextTick, ref } from "vue";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import EmptyStateActionCard from "@/lib/core/EmptyState/EmptyStateActionCard.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { splitGrantKey } from "@/composables/iam/useRoleGrants";
+import type { PresetInfo, PresetPreview } from "@/composables/iam/useRolePresets";
+import { moduleIcon } from "@/components/iam/roles/roleModules";
+import { groupTone } from "@/components/iam/roles/roleGroupTone";
+
+const props = defineProps<{
+  presets: PresetInfo[];
+  previewPreset: (id: string) => PresetPreview;
+  /** The saved grants are still loading, so no preset can be counted or opened yet. */
+  loading: boolean;
+  /** A preset is still being staged; a second Add now could flip its grants back off. */
+  applying: boolean;
+  moduleLabel: (key: string) => I18nText;
+  entityLabel: (resource: string, entity: string) => I18nText;
+  summaryActions: (actions: string[]) => { action: string; label: I18nText }[];
+}>();
+
+const emit = defineEmits<{
+  apply: [presetId: string];
+  "load-streams": [];
+  close: [];
+}>();
+
+const { t, locale } = useI18nTyped();
+
+const WRITE_ACTIONS = new Set(["AllowAll", "AllowPost", "AllowPut", "AllowDelete"]);
+
+const SECTIONS = [
+  { id: "builtin", labelKey: "iam.editRole.presetsSectionBuiltin" },
+  { id: "job", labelKey: "iam.editRole.presetsSectionJob" },
+] as const;
+
+const root = ref<HTMLElement | null>(null);
+const selected = ref<string | null>(null);
+
+// Computed, never cached from mount: the role can change in another module while the panel stays open.
+const previews = computed(
+  () => new Map(props.presets.map((preset) => [preset.id, props.previewPreset(preset.id)])),
+);
+
+// Stream lists load only once a preset that needs them is opened, so a plain visit fetches nothing.
+const streamsRequested = ref(false);
+
+const requestStreams = () => {
+  streamsRequested.value = true;
+  emit("load-streams");
+};
+
+type Badge = "loading" | "adds" | "in-role" | null;
+
+// "In Role" only when the role holds every grant; an unloaded, failed or empty stream lookup shows nothing rather than a false claim.
+const badgeOf = (preview: PresetPreview | undefined): Badge => {
+  if (props.loading) return "loading";
+  if (!preview || preview.status === "failed") return null;
+  if (preview.status === "loading") return streamsRequested.value ? "loading" : null;
+  if (preview.adds.length > preview.restores.length) return "adds";
+  if (preview.adds.length) return null;
+  return preview.noMatchingStreams ? null : "in-role";
+};
+
+const sections = computed(() =>
+  SECTIONS.map((section) => ({
+    id: section.id,
+    label: t(section.labelKey),
+    items: props.presets
+      .filter((preset) => preset.section === section.id)
+      .map((preset) => {
+        const preview = previews.value.get(preset.id);
+        return {
+          preset,
+          badge: badgeOf(preview),
+          adds: preview ? preview.adds.length - preview.restores.length : 0,
+        };
+      }),
+  })).filter((section) => section.items.length),
+);
+
+const addsHint = (count: number) => t("iam.editRole.presetAddsTooltip", { count }, count);
+
+const detail = computed(() => props.presets.find((preset) => preset.id === selected.value));
+const detailPreview = computed(() => detail.value && previews.value.get(detail.value.id));
+const detailLoading = computed(() => detailPreview.value?.status === "loading");
+const addCount = computed(() =>
+  detailPreview.value?.status === "ready" ? detailPreview.value.adds.length : 0,
+);
+const restoreCount = computed(() =>
+  detailPreview.value?.status === "ready" ? detailPreview.value.restores.length : 0,
+);
+
+// A restore only cancels a removal the admin staged, so it is never counted as added.
+const newGrants = computed(() => {
+  const preview = detailPreview.value;
+  if (preview?.status !== "ready") return [];
+  const restores = new Set(preview.restores);
+  return preview.adds.filter((key) => !restores.has(key)).map(splitGrantKey);
+});
+
+const addLabel = computed(() => {
+  if (detailLoading.value) return t("iam.editRole.presetLoadingStreams");
+  const added = newGrants.value.length;
+  if (added) return t("iam.editRole.presetAddButton", { count: added }, added);
+  const kept = restoreCount.value;
+  return kept
+    ? t("iam.editRole.presetRestoreButton", { count: kept }, kept)
+    : t("iam.editRole.presetNothingToAdd");
+});
+
+const listOf = (items: string[], type: Intl.ListFormatType = "conjunction") =>
+  raw(new Intl.ListFormat(locale.value, { type }).format(items));
+
+// One row per resource and entity, as the grant table lists them: `afolder:_all_default:AllowAll` -> Alert Folders, All Alert Folders, All.
+const rows = computed(() => {
+  const byObject = new Map<string, { resource: string; entity: string; actions: string[] }>();
+  (detailPreview.value?.adds ?? []).forEach((key) => {
+    const { resource, entity, permission, object } = splitGrantKey(key);
+    const row = byObject.get(object) ?? { resource, entity, actions: [] };
+    row.actions.push(permission);
+    byObject.set(object, row);
+  });
+  return [...byObject.entries()].map(([id, row]) => ({
+    ...row,
+    id,
+    actions: props.summaryActions(row.actions),
+  }));
+});
+
+const summary = computed(() => {
+  const preview = detailPreview.value;
+  if (!preview?.adds.length) {
+    return [
+      preview?.noMatchingStreams
+        ? t("iam.editRole.presetNoMatchingStreams")
+        : t("iam.editRole.presetSummaryHasAll"),
+    ];
+  }
+  const lines: I18nText[] = [];
+  const count = newGrants.value.length;
+  if (count) {
+    const modules = new Set(newGrants.value.map((grant) => grant.resource)).size;
+    // A restored write is staged like a new one, so it still makes the preset more than view only.
+    const written = [
+      ...new Set(
+        preview.adds
+          .map(splitGrantKey)
+          .filter((grant) => WRITE_ACTIONS.has(grant.permission))
+          .map((grant) => String(props.moduleLabel(grant.resource))),
+      ),
+    ];
+    lines.push(
+      t("iam.editRole.presetSummaryAdds", {
+        permissions: t("iam.editRole.presetPermissionCount", { count }, count),
+        modules: t("iam.editRole.presetModuleCount", { count: modules }, modules),
+      }),
+      written.length
+        ? t("iam.editRole.presetSummaryWrite", { modules: listOf(written) })
+        : t("iam.editRole.presetSummaryViewOnly"),
+    );
+  }
+  if (restoreCount.value) {
+    lines.push(
+      t("iam.editRole.presetSummaryRestores", { count: restoreCount.value }, restoreCount.value),
+    );
+  }
+  return lines;
+});
+
+// "Still missing after adding: Streams: Get, Destinations: List".
+const missingLine = computed(() => {
+  const gaps = detailPreview.value?.stillMissing ?? [];
+  if (!gaps.length) return null;
+  const items = gaps.map((gap) =>
+    t("iam.editRole.presetMissingItem", {
+      module: props.moduleLabel(gap.module),
+      actions: listOf(props.summaryActions(gap.actions).map((action) => action.label)),
+    }),
+  );
+  return t("iam.editRole.presetStillMissing", { list: listOf(items, "unit") });
+});
+
+const focusTest = (dataTest: string) =>
+  nextTick(() => root.value?.querySelector<HTMLElement>(`[data-test="${dataTest}"]`)?.focus());
+
+// A double click on Add closes the detail, so its second click would open the preset now under the pointer.
+const openPreset = (event: MouseEvent, id: string) => {
+  if (event.detail > 1) return;
+  selected.value = id;
+  const preview = previews.value.get(id);
+  // A stream preset asks on every open, so streams ingested since its lookup can show; a fresh matched list is reused.
+  if (preview?.status !== "ready" || preview.noMatchingStreams !== undefined) requestStreams();
+  focusTest("edit-role-preset-back");
+};
+
+// Back on the list, focus returns to the row that was open instead of falling to the page.
+const closePreset = () => {
+  const id = selected.value;
+  selected.value = null;
+  if (id) focusTest(`edit-role-preset-${id}`);
+};
+
+const applyPreset = (event: MouseEvent) => {
+  if (event.detail > 1) return;
+  if (!selected.value || !addCount.value || props.applying) return;
+  emit("apply", selected.value);
+  closePreset();
+};
+</script>
diff --git a/web/src/components/iam/roles/RoleSummary.spec.ts b/web/src/components/iam/roles/RoleSummary.spec.ts
index 2120511f40..eaf3c7f8c6 100644
--- a/web/src/components/iam/roles/RoleSummary.spec.ts
+++ b/web/src/components/iam/roles/RoleSummary.spec.ts
@@ -1,9 +1,10 @@
-import { describe, it, expect, vi } from "vitest";
-import { mount, flushPromises } from "@vue/test-utils";
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { mount, flushPromises, type VueWrapper } from "@vue/test-utils";
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
 import router from "@/test/unit/helpers/router";
 import { raw } from "@/types/i18n";
+import type { PresetInfo, PresetPreview } from "@/composables/iam/useRolePresets";
 
 vi.mock("@/aws-exports", () => ({
   default: { isCloud: "false", isEnterprise: "true" },
@@ -22,41 +23,99 @@ const makeModule = (moduleKey: string, overrides: Partial<SummaryModule> = {}):
   ...overrides,
 });
 
-async function mountSummary(props: Partial<{ modules: SummaryModule[]; loading: boolean }> = {}) {
+const PRESETS: PresetInfo[] = [
+  {
+    id: "readonly",
+    section: "builtin",
+    titleKey: "iam.editRole.presetReadonlyTitle",
+    descriptionKey: "iam.editRole.presetReadonlyDescription",
+    icon: "visibility",
+    tone: "other",
+  },
+];
+
+const preview = (): PresetPreview => ({
+  status: "ready",
+  adds: ["stream:_all_default:AllowList", "stream:_all_default:AllowGet"],
+  restores: [],
+  skipped: 0,
+  stillMissing: [],
+});
+
+async function mountSummary(
+  props: Partial<{
+    modules: SummaryModule[];
+    loading: boolean;
+    previewPreset: (id: string) => PresetPreview;
+  }> = {},
+  attachTo?: HTMLElement,
+) {
   const wrapper = mount(RoleSummary, {
+    attachTo,
     global: { plugins: [i18n, store, router] },
-    props: { modules: [], loading: false, ...props },
+    props: {
+      modules: [],
+      loading: false,
+      applying: false,
+      presets: PRESETS,
+      previewPreset: preview,
+      moduleLabel: (key: string) => raw(key),
+      entityLabel: (_resource: string, entity: string) => raw(entity),
+      summaryActions: (actions: string[]) =>
+        actions.map((action) => ({ action, label: raw(action) })),
+      ...props,
+    },
   });
   await flushPromises();
   return wrapper;
 }
 
+const panel = '[data-test="edit-role-presets-panel"]';
+
 describe("RoleSummary - empty role", () => {
-  it("offers the presets when the role grants nothing", async () => {
+  // The presets moved to the panel, so the empty state no longer repeats them as tiles.
+  it("shows the empty state without preset tiles, next to the presets panel", async () => {
     const wrapper = await mountSummary();
 
     expect(wrapper.find('[data-test="edit-role-summary-empty"]').exists()).toBe(true);
+    expect(wrapper.findAll('[data-test="edit-role-summary-empty"] button')).toHaveLength(0);
+    expect(wrapper.find(panel).exists()).toBe(true);
   });
 
-  it("emits the preset the user picks", async () => {
+  it("passes the preset the user adds from the panel up as `preset`", async () => {
     const wrapper = await mountSummary();
-    const readonly = wrapper
-      .findAll('[data-test="edit-role-summary-empty"] button')
-      .find((button) =>
-        button.text().includes(String(i18n.global.t("iam.editRole.presetReadonlyTitle"))),
-      );
 
-    await readonly!.trigger("click");
+    await wrapper.find('[data-test="edit-role-preset-readonly"]').trigger("click");
+    await wrapper.find('[data-test="edit-role-preset-apply"]').trigger("click");
 
-    expect(wrapper.emitted("preset")?.at(-1)).toEqual(["readonly"]);
+    expect(wrapper.emitted("preset")).toEqual([["readonly"]]);
   });
 
-  // Presets must not flash while the saved grants are still loading.
-  it("shows a spinner instead of the presets while loading", async () => {
+  // Presets must not show counts while the saved grants are still loading.
+  it("shows a spinner and no preset counts while loading", async () => {
     const wrapper = await mountSummary({ loading: true });
 
     expect(wrapper.find('[data-test="edit-role-summary-loading"]').exists()).toBe(true);
     expect(wrapper.find('[data-test="edit-role-summary-empty"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="edit-role-preset-readonly-status"]').text()).toBe("");
+    expect(wrapper.emitted("load-streams")).toBeUndefined();
+  });
+
+  it("passes the panel's stream list request up only when a stream preset opens", async () => {
+    const wrapper = await mountSummary({
+      previewPreset: () => ({
+        status: "loading",
+        adds: [],
+        restores: [],
+        skipped: 0,
+        stillMissing: [],
+      }),
+    });
+    expect(wrapper.emitted("load-streams")).toBeUndefined();
+
+    await wrapper.find('[data-test="edit-role-preset-readonly"]').trigger("click");
+
+    expect(wrapper.emitted("load-streams")).toHaveLength(1);
   });
 });
 
@@ -81,9 +140,81 @@ describe("RoleSummary - module cards", () => {
     expect(wrapper.emitted("open")?.at(-1)).toEqual(["stream"]);
   });
 
-  it("does not offer the presets once the role holds a grant", async () => {
+  it("keeps the presets panel once the role holds a grant", async () => {
     const wrapper = await mountSummary({ modules: [makeModule("stream")] });
 
     expect(wrapper.find('[data-test="edit-role-summary-empty"]').exists()).toBe(false);
+    expect(wrapper.find(panel).exists()).toBe(true);
+  });
+
+  it("marks only a card with unsaved changes, with text for screen readers", async () => {
+    const wrapper = await mountSummary({
+      modules: [makeModule("stream", { added: 2, removed: 0 }), makeModule("dfolder")],
+    });
+
+    const dot = wrapper.find('[data-test="edit-role-summary-unsaved-stream"]');
+    expect(dot.exists()).toBe(true);
+    expect(dot.text()).toBe(String(i18n.global.t("iam.editRole.summaryPendingTitle")));
+    expect(wrapper.find('[data-test="edit-role-summary-unsaved-dfolder"]').exists()).toBe(false);
+  });
+});
+
+describe("RoleSummary - presets panel toggle", () => {
+  const openButton = '[data-test="edit-role-presets-open"]';
+  const closeButton = '[data-test="edit-role-presets-close"]';
+  let wrapper: VueWrapper | undefined;
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = undefined;
+  });
+
+  it("shows the panel by default, with no reopen button", async () => {
+    wrapper = await mountSummary({ modules: [makeModule("stream")] });
+
+    expect(wrapper.find(panel).exists()).toBe(true);
+    expect(wrapper.find(openButton).exists()).toBe(false);
+  });
+
+  it("closes from the X, shows the reopen button with focus and tells the page", async () => {
+    wrapper = await mountSummary({ modules: [makeModule("stream")] }, document.body);
+
+    await wrapper.find(closeButton).trigger("click");
+    await flushPromises();
+
+    expect(wrapper.find(panel).exists()).toBe(false);
+    const reopen = wrapper.find(openButton);
+    expect(reopen.attributes("aria-label")).toBe(String(i18n.global.t("iam.editRole.presetsShow")));
+    expect(document.activeElement).toBe(reopen.element);
+    expect(wrapper.emitted("update:presetsOpen")).toEqual([[false]]);
+  });
+
+  it("reopens from the button and moves focus to the X", async () => {
+    wrapper = await mountSummary({ modules: [makeModule("stream")] }, document.body);
+    await wrapper.find(closeButton).trigger("click");
+    await flushPromises();
+
+    await wrapper.find(openButton).trigger("click");
+    await flushPromises();
+
+    expect(wrapper.find(panel).exists()).toBe(true);
+    expect(wrapper.find(openButton).exists()).toBe(false);
+    expect(document.activeElement).toBe(wrapper.find(closeButton).element);
+    expect(wrapper.emitted("update:presetsOpen")).toEqual([[false], [true]]);
+  });
+
+  // A stored choice would keep the panel closed on later visits, which must always start open.
+  it("neither reads nor writes localStorage", async () => {
+    const getItem = vi.spyOn(Storage.prototype, "getItem");
+    const setItem = vi.spyOn(Storage.prototype, "setItem");
+    wrapper = await mountSummary({ modules: [makeModule("stream")] });
+
+    await wrapper.find(closeButton).trigger("click");
+    await wrapper.find(openButton).trigger("click");
+
+    expect(getItem).not.toHaveBeenCalled();
+    expect(setItem).not.toHaveBeenCalled();
+    getItem.mockRestore();
+    setItem.mockRestore();
   });
 });
diff --git a/web/src/components/iam/roles/RoleSummary.vue b/web/src/components/iam/roles/RoleSummary.vue
index 2d603e2192..6697148d6e 100644
--- a/web/src/components/iam/roles/RoleSummary.vue
+++ b/web/src/components/iam/roles/RoleSummary.vue
@@ -15,7 +15,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 -->
 
 <template>
-  <div data-test="edit-role-summary" class="flex min-h-0 min-w-0 flex-1 flex-col">
+  <div
+    ref="root"
+    data-test="edit-role-summary"
+    class="@container/role-overview flex min-h-0 min-w-0 flex-1 flex-col"
+  >
     <OPageHeader
       :title="t('iam.editRole.moduleOverviewTitle')"
       title-data-test="edit-role-summary-title"
@@ -26,103 +30,150 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </template>
     </OPageHeader>
 
-    <div v-if="loading" class="flex flex-1 items-center justify-center p-6">
-      <OSpinner size="md" data-test="edit-role-summary-loading" />
-    </div>
-
-    <div v-else-if="!modules.length" class="flex flex-1 items-center justify-center p-6">
-      <OEmptyState
-        size="hero"
-        preset="no-data"
-        :title="t('iam.editRole.summaryEmptyTitle')"
-        :description="t('iam.editRole.summaryEmptyDescription')"
-        :actions="presetActions"
-        data-test="edit-role-summary-empty"
-        @action="(id: unknown) => emit('preset', String(id))"
-      />
-    </div>
-
-    <div v-else class="min-h-0 flex-1 overflow-y-auto">
-      <OContent class="flex flex-col gap-3 py-4">
-        <div class="grid auto-rows-fr grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3">
-          <button
-            v-for="module in modules"
-            :key="module.moduleKey"
-            type="button"
-            class="group rounded-surface border-border-default bg-surface-panel hover:border-accent focus-visible:ring-accent flex h-full flex-col border p-4 text-left shadow-xs transition outline-none hover:shadow-md focus-visible:ring-2"
-            :data-test="`edit-role-summary-module-${module.moduleKey}`"
-            @click="emit('open', module.moduleKey)"
-          >
-            <span class="flex w-full items-start gap-3">
-              <span
-                class="rounded-default inline-flex size-10 shrink-0 items-center justify-center"
-                :class="GROUP_TONE[module.group] ?? NEUTRAL_TONE"
-                :data-test="`edit-role-summary-icon-${module.moduleKey}`"
-              >
-                <OIcon :name="module.icon" size="md" />
-              </span>
-              <span class="flex min-w-0 flex-1 flex-col">
-                <OTruncatedText
-                  class="text-text-heading group-hover:text-accent text-sm font-semibold transition-colors"
-                >
-                  {{ module.label }}
-                </OTruncatedText>
-                <OTruncatedText :lines="2" class="text-text-secondary mt-0.5 text-xs leading-snug">
-                  {{ module.description }}
-                </OTruncatedText>
-              </span>
-              <OIcon
-                name="chevron-right"
-                size="sm"
-                class="text-text-secondary group-hover:text-accent mt-1 shrink-0 transition group-hover:translate-x-0.5"
-              />
-            </span>
-
-            <span class="mt-auto w-full pt-4">
-              <span
-                class="border-border-default flex items-end justify-between gap-2 border-t pt-3"
-              >
-                <span class="flex flex-col">
-                  <span
-                    class="text-text-heading text-2xl leading-none font-semibold tabular-nums"
-                    :data-test="`edit-role-summary-granted-${module.moduleKey}`"
-                  >
-                    {{ grouped(module.granted) }}
-                  </span>
-                  <span class="text-text-secondary mt-1 text-xs">
-                    {{ t("iam.editRole.summaryGrantsLabel", {}, module.granted) }}
-                  </span>
-                </span>
-                <span class="flex flex-wrap justify-end gap-1">
-                  <OBadge
-                    v-for="action in module.actions"
-                    :key="action.action"
-                    variant="primary-soft"
-                    size="sm"
-                  >
-                    {{ action.label }}
-                  </OBadge>
-                </span>
-              </span>
-            </span>
-          </button>
+    <!-- Stacks when the rails squeeze the overview, which a viewport breakpoint cannot see. -->
+    <div class="relative flex min-h-0 flex-1 @max-[38rem]/role-overview:flex-col">
+      <div class="flex min-h-0 min-w-0 flex-1 flex-col overflow-y-auto">
+        <div v-if="loading" class="flex flex-1 items-center justify-center p-6">
+          <OSpinner size="md" data-test="edit-role-summary-loading" />
         </div>
-      </OContent>
+
+        <div v-else-if="!modules.length" class="flex flex-1 items-center justify-center p-6">
+          <OEmptyState
+            size="hero"
+            preset="no-data"
+            :title="t('iam.editRole.summaryEmptyTitle')"
+            :description="t('iam.editRole.summaryEmptyDescription')"
+            data-test="edit-role-summary-empty"
+          />
+        </div>
+
+        <OContent v-else class="flex flex-col gap-3 py-4">
+          <!-- Fixed-width columns keep cards still when the Presets panel opens or closes; the end gutter keeps the top card clear of the floating Show Presets button. -->
+          <div
+            class="grid auto-rows-fr grid-cols-[repeat(auto-fill,minmax(min(100%,17rem),17rem))] gap-3"
+            :class="{ 'pe-10': !presetsOpen }"
+          >
+            <button
+              v-for="module in modules"
+              :key="module.moduleKey"
+              type="button"
+              class="group rounded-surface border-border-default bg-surface-panel hover:border-accent focus-visible:ring-accent flex h-full flex-col border p-3 text-left shadow-xs transition outline-none hover:shadow-md focus-visible:ring-2"
+              :data-test="`edit-role-summary-module-${module.moduleKey}`"
+              @click="emit('open', module.moduleKey)"
+            >
+              <span class="flex w-full items-start gap-2.5">
+                <span
+                  class="rounded-default inline-flex size-8 shrink-0 items-center justify-center"
+                  :class="groupTone(module.group)"
+                  :data-test="`edit-role-summary-icon-${module.moduleKey}`"
+                >
+                  <OIcon :name="module.icon" size="sm" />
+                </span>
+                <span class="flex min-w-0 flex-1 flex-col">
+                  <span class="flex min-w-0 items-center gap-1.5">
+                    <OTruncatedText
+                      class="text-text-heading group-hover:text-accent text-sm font-semibold transition-colors"
+                    >
+                      {{ module.label }}
+                    </OTruncatedText>
+                    <span
+                      v-if="module.added || module.removed"
+                      class="bg-accent size-1.5 shrink-0 rounded-full"
+                      :data-test="`edit-role-summary-unsaved-${module.moduleKey}`"
+                    >
+                      <span class="sr-only">{{ t("iam.editRole.summaryPendingTitle") }}</span>
+                    </span>
+                  </span>
+                  <OTruncatedText class="text-text-secondary mt-0.5 text-xs leading-snug">
+                    {{ module.description }}
+                  </OTruncatedText>
+                </span>
+                <OIcon
+                  name="chevron-right"
+                  size="sm"
+                  class="text-text-secondary group-hover:text-accent mt-1 shrink-0 transition group-hover:translate-x-0.5"
+                />
+              </span>
+
+              <span class="mt-auto w-full pt-3">
+                <span
+                  class="border-border-default flex items-center justify-between gap-2 border-t pt-2"
+                >
+                  <span class="flex items-baseline gap-1">
+                    <span
+                      class="text-text-heading text-sm font-semibold tabular-nums"
+                      :data-test="`edit-role-summary-granted-${module.moduleKey}`"
+                    >
+                      {{ grouped(module.granted) }}
+                    </span>
+                    <span class="text-text-secondary text-xs">
+                      {{ t("iam.editRole.summaryGrantsLabel", {}, module.granted) }}
+                    </span>
+                  </span>
+                  <span class="flex flex-wrap justify-end gap-1">
+                    <OBadge
+                      v-for="action in module.actions"
+                      :key="action.action"
+                      variant="primary-soft"
+                      size="sm"
+                    >
+                      {{ action.label }}
+                    </OBadge>
+                  </span>
+                </span>
+              </span>
+            </button>
+          </div>
+        </OContent>
+      </div>
+
+      <OButton
+        v-if="!presetsOpen"
+        variant="outline"
+        size="icon-sm"
+        class="absolute end-3 top-3 z-10"
+        :aria-label="t('iam.editRole.presetsShow')"
+        data-test="edit-role-presets-open"
+        @click="setPresetsOpen(true)"
+      >
+        <OIcon name="library-add" size="sm" />
+        <OTooltip :content="t('iam.editRole.presetsShow')" side="left" />
+      </OButton>
+
+      <RolePresetsPanel
+        v-else
+        class="border-border-default w-85 shrink-0 border-s @max-[38rem]/role-overview:max-h-[55%] @max-[38rem]/role-overview:w-auto @max-[38rem]/role-overview:border-s-0 @max-[38rem]/role-overview:border-t"
+        :presets="presets"
+        :preview-preset="previewPreset"
+        :loading="loading"
+        :applying="applying"
+        :module-label="moduleLabel"
+        :entity-label="entityLabel"
+        :summary-actions="summaryActions"
+        @apply="(presetId) => emit('preset', presetId)"
+        @load-streams="emit('load-streams')"
+        @close="setPresetsOpen(false)"
+      />
     </div>
   </div>
 </template>
 
 <script setup lang="ts">
+import { nextTick, ref } from "vue";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
 import OContent from "@/lib/core/Content/OContent.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OPageHeader from "@/lib/core/PageHeader/OPageHeader.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
-import type { EmptyStateAction } from "@/lib/core/EmptyState/presets";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
+import RolePresetsPanel from "@/components/iam/roles/RolePresetsPanel.vue";
+import { groupTone } from "@/components/iam/roles/roleGroupTone";
+import type { PresetInfo, PresetPreview } from "@/composables/iam/useRolePresets";
 
 export type SummaryAction = { action: string; label: I18nText };
 
@@ -137,65 +188,40 @@ export type SummaryModule = {
   description: I18nText;
   /** Every action granted anywhere in the module. */
   actions: SummaryAction[];
+  /** Staged changes, as the rail counts them; either one shows the unsaved dot. */
+  added?: number;
+  removed?: number;
 };
 
 defineProps<{
   modules: SummaryModule[];
   loading: boolean;
+  presets: PresetInfo[];
+  previewPreset: (id: string) => PresetPreview;
+  applying: boolean;
+  moduleLabel: (key: string) => I18nText;
+  entityLabel: (resource: string, entity: string) => I18nText;
+  summaryActions: (actions: string[]) => SummaryAction[];
 }>();
 
 const emit = defineEmits<{
   open: [moduleKey: string];
   preset: [presetId: string];
+  "load-streams": [];
 }>();
 
-// Tile colour tells the module's category apart at a glance; every class is a registered token.
-const GROUP_TONE: Record<string, string> = {
-  data: "bg-badge-blue-soft-bg text-badge-blue-soft-text",
-  dashboards: "bg-badge-purple-soft-bg text-badge-purple-soft-text",
-  alerting: "bg-icon-chip-orange-bg text-icon-chip-orange-text",
-  pipelines: "bg-badge-teal-soft-bg text-badge-teal-soft-text",
-  monitoring: "bg-icon-chip-info-bg text-icon-chip-info-text",
-  ai: "bg-icon-chip-primary-bg text-icon-chip-primary-text",
-  access: "bg-icon-chip-success-bg text-icon-chip-success-text",
-};
-
-const NEUTRAL_TONE = "bg-surface-subtle text-text-secondary";
-
 const { t } = useI18nTyped();
 
 const grouped = (count: number) => raw(count.toLocaleString());
 
-const presetActions: EmptyStateAction[] = [
-  {
-    id: "readonly",
-    icon: "visibility",
-    titleKey: "iam.editRole.presetReadonlyTitle",
-    descriptionKey: "iam.editRole.presetReadonlyDescription",
-  },
-  {
-    id: "dbm",
-    icon: "database",
-    titleKey: "iam.editRole.presetDbmTitle",
-    descriptionKey: "iam.editRole.presetDbmDescription",
-  },
-  {
-    id: "k8s",
-    icon: "cloud",
-    titleKey: "iam.editRole.presetK8sTitle",
-    descriptionKey: "iam.editRole.presetK8sDescription",
-  },
-  {
-    id: "rum_viewer",
-    icon: "devices",
-    titleKey: "iam.editRole.presetRumViewerTitle",
-    descriptionKey: "iam.editRole.presetRumViewerDescription",
-  },
-  {
-    id: "rum_editor",
-    icon: "insights",
-    titleKey: "iam.editRole.presetRumEditorTitle",
-    descriptionKey: "iam.editRole.presetRumEditorDescription",
-  },
-];
+const root = ref<HTMLElement | null>(null);
+// The page holds this so a closed panel survives this component remounting, but not the next visit.
+const presetsOpen = defineModel<boolean>("presetsOpen", { default: true });
+
+// Focus follows the toggle so a keyboard user is not dropped to the page when the clicked button unmounts.
+const setPresetsOpen = (open: boolean) => {
+  presetsOpen.value = open;
+  const target = open ? "edit-role-presets-close" : "edit-role-presets-open";
+  nextTick(() => root.value?.querySelector<HTMLElement>(`[data-test="${target}"]`)?.focus());
+};
 </script>
diff --git a/web/src/components/iam/roles/UnsavedChangesDrawer.spec.ts b/web/src/components/iam/roles/UnsavedChangesDrawer.spec.ts
new file mode 100644
index 0000000000..58886e6d60
--- /dev/null
+++ b/web/src/components/iam/roles/UnsavedChangesDrawer.spec.ts
@@ -0,0 +1,400 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { describe, it, expect } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import { raw } from "@/types/i18n";
+import UnsavedChangesDrawer, {
+  type PendingChange,
+  type PendingGroup,
+} from "@/components/iam/roles/UnsavedChangesDrawer.vue";
+import type { CompanionGap } from "@/components/iam/roles/roleCompanions";
+
+const ORG = "default";
+const ALL = `_all_${ORG}`;
+
+const LABELS: Record<string, string> = {
+  stream: "Streams",
+  destination: "Destinations",
+  template: "Templates",
+  afolder: "Alert Folders",
+  dfolder: "Dash Folders",
+};
+
+const ACTION_LABELS: Record<string, string> = { AllowList: "List", AllowGet: "Get" };
+
+// The real drawer portals its lazy body; the stub renders it in place with the footer buttons it is given.
+const ODrawerStub = {
+  props: [
+    "open",
+    "secondaryButtonLabel",
+    "secondaryButtonDisabled",
+    "primaryButtonLabel",
+    "primaryButtonDataTest",
+  ],
+  emits: ["update:open", "click:primary", "click:secondary"],
+  template: `<div>
+    <slot />
+    <button data-test="o-drawer-secondary-btn" :disabled="secondaryButtonDisabled" @click="$emit('click:secondary')">{{ secondaryButtonLabel }}</button>
+    <button :data-test="primaryButtonDataTest" @click="$emit('click:primary')">{{ primaryButtonLabel }}</button>
+  </div>`,
+};
+
+const change = (id: string, overrides: Partial<PendingChange> = {}): PendingChange => ({
+  id,
+  state: "added",
+  label: raw(id),
+  moduleLabel: raw("Streams"),
+  moduleKey: "stream",
+  actions: [{ action: "AllowGet", label: raw("Get") }],
+  keys: [`${id}:AllowGet`],
+  effect: raw(`effect of ${id}`),
+  neededBy: [],
+  notes: [],
+  ...overrides,
+});
+
+const group = (key: string, changes: PendingChange[]): PendingGroup => ({
+  key,
+  label: raw(LABELS[key] ?? key),
+  icon: "window",
+  changes,
+});
+
+const gap = (module: string, actions: CompanionGap["actions"], by = "afolder"): CompanionGap => ({
+  module,
+  actions,
+  neededBy: [{ module: by, reasonKey: "iam.editRole.companionReasonAlertDestinations" }],
+});
+
+const mountDrawer = (
+  props: { groups?: PendingGroup[]; gaps?: CompanionGap[]; saving?: boolean } = {},
+) =>
+  mount(UnsavedChangesDrawer, {
+    props: {
+      open: true,
+      groups: [],
+      gaps: [],
+      orgId: ORG,
+      moduleLabel: (key: string) => raw(LABELS[key] ?? key),
+      summaryActions: (actions: string[]) =>
+        actions.map((action) => ({ action, label: raw(ACTION_LABELS[action] ?? action) })),
+      ...props,
+    },
+    global: { plugins: [i18n], stubs: { ODrawer: ODrawerStub } },
+  });
+
+// Truncated labels carry tooltips of their own, so pick the one with a content prop.
+const tooltipOf = (wrapper: ReturnType<typeof mountDrawer>, prop: "content") =>
+  wrapper
+    .findAllComponents(OTooltip)
+    .map((tip) => tip.props(prop))
+    .find(Boolean);
+
+const find = (wrapper: ReturnType<typeof mountDrawer>, dataTest: string) =>
+  wrapper.find(`[data-test="${dataTest}"]`);
+
+const expand = (wrapper: ReturnType<typeof mountDrawer>) =>
+  find(wrapper, "edit-role-companions-toggle").trigger("click");
+
+describe("UnsavedChangesDrawer - Not added yet", () => {
+  it("shows nothing missing when every module is in place", () => {
+    const wrapper = mountDrawer({ groups: [group("stream", [change("logs-app-added")])] });
+
+    expect(find(wrapper, "edit-role-companions").exists()).toBe(false);
+  });
+
+  it("starts closed, naming the missing modules on one line", () => {
+    const wrapper = mountDrawer({
+      gaps: [gap("destination", ["AllowList"]), gap("template", ["AllowList"])],
+    });
+
+    expect(find(wrapper, "edit-role-companions").text()).toContain("Not added yet · 2 modules");
+    expect(find(wrapper, "edit-role-companion-destination").exists()).toBe(false);
+    expect(find(wrapper, "edit-role-companions-toggle").attributes("aria-expanded")).toBe("false");
+    expect(find(wrapper, "edit-role-companions-names").text()).toBe(
+      "Destinations: List, Templates: List",
+    );
+  });
+
+  it("opens the list when the admin expands it", async () => {
+    const wrapper = mountDrawer({
+      gaps: [
+        gap("stream", ["AllowList", "AllowGet"]),
+        gap("destination", ["AllowList"]),
+        gap("template", ["AllowList"]),
+      ],
+    });
+
+    expect(find(wrapper, "edit-role-companion-stream").exists()).toBe(false);
+    expect(find(wrapper, "edit-role-companions-names").text()).toBe(
+      "Streams: List and Get, Destinations: List, Templates: List",
+    );
+
+    await find(wrapper, "edit-role-companions-toggle").trigger("click");
+
+    expect(find(wrapper, "edit-role-companion-stream").exists()).toBe(true);
+  });
+
+  it("returns to the default each time the drawer opens", async () => {
+    const wrapper = mountDrawer({ gaps: [gap("destination", ["AllowList"])] });
+    await expand(wrapper);
+    expect(find(wrapper, "edit-role-companion-destination").exists()).toBe(true);
+
+    await wrapper.setProps({ open: false });
+    await wrapper.setProps({ open: true });
+
+    expect(find(wrapper, "edit-role-companion-destination").exists()).toBe(false);
+  });
+
+  it("says which module needs a missing one, and why", async () => {
+    const wrapper = mountDrawer({ gaps: [gap("destination", ["AllowList"])] });
+    await expand(wrapper);
+
+    expect(find(wrapper, "edit-role-companion-needs-destination").text()).toBe(
+      "Needed by Alert Folders",
+    );
+    expect(tooltipOf(wrapper, "content")).toBe(
+      "Alert Folders needs it to choose where alerts send.",
+    );
+  });
+
+  it("adds the module-wide grant for one row", async () => {
+    const wrapper = mountDrawer({ gaps: [gap("destination", ["AllowList"])] });
+    await expand(wrapper);
+
+    await find(wrapper, "edit-role-companion-add-destination").trigger("click");
+
+    expect(wrapper.emitted("add")).toEqual([[[`destination:${ALL}:AllowList`]]]);
+  });
+
+  // Streams Get is picked per stream (D1), so Open Streams covers it and Add never grants a module-wide read.
+  it("offers Open Streams for Get and Add for List when both Streams grants are missing", async () => {
+    const wrapper = mountDrawer({ gaps: [gap("stream", ["AllowList", "AllowGet"], "dfolder")] });
+    await expand(wrapper);
+
+    await find(wrapper, "edit-role-companion-open-stream").trigger("click");
+    await find(wrapper, "edit-role-companion-add-stream").trigger("click");
+
+    expect(wrapper.emitted("open-module")).toEqual([["stream"]]);
+    expect(wrapper.emitted("add")).toEqual([[[`stream:${ALL}:AllowList`]]]);
+  });
+
+  it("ignores the second click of a double click on Add and Add All", async () => {
+    const wrapper = mountDrawer({
+      gaps: [gap("destination", ["AllowList"]), gap("template", ["AllowList"])],
+    });
+    await expand(wrapper);
+
+    find(wrapper, "edit-role-companion-add-destination").element.dispatchEvent(
+      new MouseEvent("click", { detail: 2, bubbles: true }),
+    );
+    find(wrapper, "edit-role-companions-add-all").element.dispatchEvent(
+      new MouseEvent("click", { detail: 2, bubbles: true }),
+    );
+
+    expect(wrapper.emitted("add")).toBeUndefined();
+  });
+
+  it("offers Add when Streams lacks only List", async () => {
+    const wrapper = mountDrawer({ gaps: [gap("stream", ["AllowList"], "dfolder")] });
+    await expand(wrapper);
+
+    expect(find(wrapper, "edit-role-companion-add-stream").exists()).toBe(true);
+    expect(find(wrapper, "edit-role-companion-open-stream").exists()).toBe(false);
+  });
+
+  it("adds every gap at once but leaves Streams Get to be picked", async () => {
+    const wrapper = mountDrawer({
+      gaps: [
+        gap("stream", ["AllowList", "AllowGet"], "dfolder"),
+        gap("destination", ["AllowList"]),
+      ],
+    });
+
+    await find(wrapper, "edit-role-companions-add-all").trigger("click");
+
+    expect(wrapper.emitted("add")).toEqual([
+      [[`stream:${ALL}:AllowList`, `destination:${ALL}:AllowList`]],
+    ]);
+  });
+
+  it("offers Add All only for two or more gaps", () => {
+    const wrapper = mountDrawer({ gaps: [gap("destination", ["AllowList"])] });
+
+    expect(find(wrapper, "edit-role-companions-add-all").exists()).toBe(false);
+  });
+});
+
+describe("UnsavedChangesDrawer - Your Changes", () => {
+  it("counts the changes and the modules they touch", () => {
+    const wrapper = mountDrawer({
+      groups: [
+        group("stream", [change("logs-app-added"), change("metrics-cpu-added")]),
+        group("other", [change("mystery-x1-added", { moduleKey: "other" })]),
+      ],
+    });
+
+    expect(find(wrapper, "edit-role-unsaved-summary").text()).toBe("· 3 changes in 2 modules");
+  });
+
+  it("reads none yet with only missing modules to show", () => {
+    const wrapper = mountDrawer({ gaps: [gap("destination", ["AllowList"])] });
+
+    expect(find(wrapper, "edit-role-unsaved-summary").text()).toBe("· none yet");
+  });
+
+  it("lists each change under its module group, the Other group included", () => {
+    const wrapper = mountDrawer({
+      groups: [
+        group("stream", [change("logs-app-added")]),
+        group("other", [change("mystery-x1-added", { moduleKey: "other" })]),
+      ],
+    });
+
+    expect(
+      find(wrapper, "edit-role-unsaved-group-stream")
+        .find('[data-test="edit-role-unsaved-logs-app-added"]')
+        .exists(),
+    ).toBe(true);
+    expect(
+      find(wrapper, "edit-role-unsaved-group-other")
+        .find('[data-test="edit-role-unsaved-mystery-x1-added"]')
+        .exists(),
+    ).toBe(true);
+  });
+
+  it("shows no effect sentence on an added row", () => {
+    const wrapper = mountDrawer({ groups: [group("stream", [change("logs-app-added")])] });
+
+    expect(find(wrapper, "edit-role-unsaved-logs-app-added").text()).not.toContain("effect of");
+  });
+
+  it("keeps the effect sentence on a removed row", () => {
+    const wrapper = mountDrawer({
+      groups: [group("stream", [change("logs-app-removed", { state: "removed" })])],
+    });
+
+    expect(find(wrapper, "edit-role-unsaved-logs-app-removed").text()).toContain(
+      "effect of logs-app-removed",
+    );
+  });
+
+  it("says who needs an added row and holds the full reason in the tooltip", () => {
+    const wrapper = mountDrawer({
+      groups: [
+        group("stream", [
+          change("stream-all-added", {
+            neededBy: [raw("Alert Folders")],
+            notes: [raw("Alert Folders needs this to load panel data.")],
+          }),
+        ]),
+      ],
+    });
+
+    expect(find(wrapper, "edit-role-unsaved-needed-stream-all-added").text()).toBe(
+      "Needed by Alert Folders",
+    );
+    expect(tooltipOf(wrapper, "content")).toBe("Alert Folders needs this to load panel data.");
+  });
+
+  it("says a removed row is still needed", () => {
+    const wrapper = mountDrawer({
+      groups: [
+        group("stream", [
+          change("stream-all-removed", { state: "removed", neededBy: [raw("Alert Folders")] }),
+        ]),
+      ],
+    });
+
+    expect(find(wrapper, "edit-role-unsaved-needed-stream-all-removed").text()).toBe(
+      "Still needed by Alert Folders",
+    );
+  });
+
+  it("shows only the info icon for a note with no needer", () => {
+    const wrapper = mountDrawer({
+      groups: [group("stream", [change("a-added", { notes: [raw("Shows only some.")] })])],
+    });
+
+    expect(find(wrapper, "edit-role-unsaved-needed-a-added").text()).toBe("");
+    expect(find(wrapper, "edit-role-unsaved-needed-info-a-added").exists()).toBe(true);
+  });
+
+  it("undoes one change with its own keys", async () => {
+    const wrapper = mountDrawer({
+      groups: [group("stream", [change("logs-app-added", { keys: ["logs:app:AllowGet"] })])],
+    });
+
+    await find(wrapper, "edit-role-unsaved-undo-logs-app-added").trigger("click");
+
+    expect(wrapper.emitted("undo")).toEqual([[["logs:app:AllowGet"]]]);
+  });
+
+  it("undoes every change from the footer", async () => {
+    const wrapper = mountDrawer({
+      groups: [
+        group("stream", [change("logs-app-added", { keys: ["logs:app:AllowGet"] })]),
+        group("dfolder", [change("dfolder-f1-removed", { keys: ["dfolder:f1:AllowGet"] })]),
+      ],
+    });
+
+    await find(wrapper, "o-drawer-secondary-btn").trigger("click");
+
+    expect(wrapper.emitted("undo")).toEqual([[["logs:app:AllowGet", "dfolder:f1:AllowGet"]]]);
+  });
+
+  it("disables Undo All with nothing to undo", () => {
+    const wrapper = mountDrawer({ gaps: [gap("destination", ["AllowList"])] });
+
+    expect(find(wrapper, "o-drawer-secondary-btn").attributes("disabled")).toBeDefined();
+  });
+
+  it("saves from the footer, even with no change", async () => {
+    const wrapper = mountDrawer({ gaps: [gap("destination", ["AllowList"])] });
+
+    await find(wrapper, "edit-role-unsaved-save").trigger("click");
+
+    expect(wrapper.emitted("save")).toHaveLength(1);
+  });
+});
+
+describe("UnsavedChangesDrawer - while a save is in flight", () => {
+  // A key staged before the PUT settles would be committed as saved without being sent.
+  it("disables every button that stages or opens a module", async () => {
+    const wrapper = mountDrawer({
+      saving: true,
+      groups: [group("stream", [change("logs-app-added")])],
+      gaps: [
+        gap("destination", ["AllowList"]),
+        gap("template", ["AllowList"]),
+        gap("stream", ["AllowList", "AllowGet"], "dfolder"),
+      ],
+    });
+    await find(wrapper, "edit-role-companions-toggle").trigger("click");
+
+    [
+      "edit-role-companions-add-all",
+      "edit-role-companion-add-destination",
+      "edit-role-companion-open-stream",
+      "edit-role-unsaved-undo-logs-app-added",
+      "o-drawer-secondary-btn",
+    ].forEach((dataTest) =>
+      expect(find(wrapper, dataTest).attributes("disabled"), dataTest).toBeDefined(),
+    );
+  });
+});
diff --git a/web/src/components/iam/roles/UnsavedChangesDrawer.vue b/web/src/components/iam/roles/UnsavedChangesDrawer.vue
index e12e519e9c..9c7cfe7f4a 100644
--- a/web/src/components/iam/roles/UnsavedChangesDrawer.vue
+++ b/web/src/components/iam/roles/UnsavedChangesDrawer.vue
@@ -17,85 +17,370 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 <template>
   <ODrawer
     data-test="edit-role-unsaved-drawer"
-    size="md"
+    size="lg"
     bleed
     :open="open"
     :title="t('iam.editRole.summaryPendingTitle')"
     :sub-title="t('iam.editRole.summaryPendingHint')"
     :secondary-button-label="t('iam.editRole.undoAllChanges')"
+    :secondary-button-disabled="!changeCount || saving"
+    :primary-button-label="t('alerts.save')"
+    primary-button-data-test="edit-role-unsaved-save"
     @update:open="emit('update:open', $event)"
     @click:secondary="emit('undo', allKeys)"
+    @click:primary="emit('save')"
   >
-    <ul class="divide-border-default flex flex-col divide-y">
-      <li
-        v-for="change in changes"
-        :key="change.id"
-        class="flex min-h-14 items-center gap-3 px-4 py-2"
-        :data-test="`edit-role-unsaved-${change.id}`"
+    <div class="flex min-h-full flex-col">
+      <div
+        class="text-text-secondary flex items-baseline gap-1.5 px-4 pt-4 pb-0.5 text-xs font-semibold"
       >
-        <OBadge
-          :variant="change.state === 'added' ? 'success-soft' : 'error-soft'"
-          size="sm"
-          class="shrink-0"
+        {{ t("iam.editRole.yourChanges") }}
+        <span class="font-normal" data-test="edit-role-unsaved-summary">
+          <span aria-hidden="true">{{ raw("·") }}</span>
+          {{ changesLine }}
+        </span>
+      </div>
+      <section
+        v-for="group in groups"
+        :key="group.key"
+        :data-test="`edit-role-unsaved-group-${group.key}`"
+      >
+        <div
+          class="text-text-heading text-compact flex items-center gap-1.5 px-4 pt-2.5 font-semibold"
         >
-          {{
-            change.state === "added"
-              ? t("iam.editRole.summaryChangeAdded")
-              : t("iam.editRole.summaryChangeRemoved")
-          }}
-        </OBadge>
-        <div class="flex min-w-0 flex-1 flex-col gap-1">
-          <OTruncatedText class="text-text-body text-sm">
-            {{ change.label }}
-          </OTruncatedText>
-          <div class="flex min-w-0 flex-wrap items-center gap-1">
-            <span class="text-text-secondary me-1 truncate text-xs">{{ change.moduleLabel }}</span>
-            <OBadge
-              v-for="action in change.actions"
-              :key="action.action"
-              variant="primary-soft"
-              size="sm"
-            >
-              {{ action.label }}
-            </OBadge>
-          </div>
+          <OIcon :name="group.icon" size="sm" class="text-text-secondary" />
+          {{ group.label }}
         </div>
-        <OButton
-          variant="ghost"
-          size="sm"
-          icon-left="undo"
-          :data-test="`edit-role-unsaved-undo-${change.id}`"
-          @click="emit('undo', change.keys)"
+        <div
+          v-for="change in group.changes"
+          :key="change.id"
+          class="flex items-start gap-2.5 px-4 pt-1.5 pb-2"
+          :data-test="`edit-role-unsaved-${change.id}`"
         >
-          {{ t("iam.editRole.summaryUndoRemove") }}
-        </OButton>
-      </li>
-    </ul>
+          <OIcon
+            :name="change.state === 'added' ? 'add-circle' : 'do-not-disturb-on'"
+            size="sm"
+            class="mt-0.5"
+            :class="
+              change.state === 'added'
+                ? 'text-badge-success-soft-text'
+                : 'text-badge-error-soft-text'
+            "
+            :label="
+              change.state === 'added'
+                ? t('iam.editRole.summaryChangeAdded')
+                : t('iam.editRole.summaryChangeRemoved')
+            "
+          />
+          <div class="flex min-w-0 flex-1 flex-col gap-0.5">
+            <div class="flex min-w-0 flex-wrap items-center gap-1.5">
+              <OTruncatedText
+                class="text-sm"
+                :class="
+                  change.state === 'added' ? 'text-text-body' : 'text-text-secondary line-through'
+                "
+              >
+                {{ change.label }}
+              </OTruncatedText>
+              <OBadge
+                v-for="action in change.actions"
+                :key="action.action"
+                :variant="change.state === 'added' ? 'primary-soft' : 'default-soft'"
+                size="sm"
+              >
+                {{ action.label }}
+              </OBadge>
+            </div>
+            <p v-if="change.state === 'removed'" class="text-compact text-text-secondary">
+              {{ change.effect }}
+            </p>
+            <div
+              v-if="change.neededBy.length || change.notes.length"
+              class="text-text-secondary flex items-center gap-1 text-xs"
+              :data-test="`edit-role-unsaved-needed-${change.id}`"
+            >
+              <span v-if="change.neededBy.length">
+                {{
+                  t(
+                    change.state === "added"
+                      ? "iam.editRole.neededBy"
+                      : "iam.editRole.stillNeededBy",
+                    { modules: listOf(change.neededBy) },
+                  )
+                }}
+              </span>
+              <OTooltip v-if="change.notes.length" :content="raw(change.notes.join(' '))">
+                <span class="inline-flex" :data-test="`edit-role-unsaved-needed-info-${change.id}`">
+                  <OIcon name="info" size="sm" />
+                </span>
+              </OTooltip>
+            </div>
+          </div>
+          <OButton
+            variant="ghost"
+            size="sm"
+            icon-left="undo"
+            :disabled="saving"
+            :data-test="`edit-role-unsaved-undo-${change.id}`"
+            @click="emit('undo', change.keys)"
+          >
+            {{ t("iam.editRole.summaryUndoRemove") }}
+          </OButton>
+        </div>
+      </section>
+      <!-- Pinned above the footer so the missing grants stay in view next to Save on a long list. -->
+      <div v-if="gapRows.length" class="bg-dialog-bg sticky bottom-0 z-10 mt-auto px-4 py-3">
+        <section
+          :aria-label="calloutTitle"
+          data-test="edit-role-companions"
+          class="rounded-default border-badge-warning-soft-text/55 bg-badge-warning-soft-bg border border-dashed"
+        >
+          <div class="flex items-start gap-2 pe-3">
+            <div
+              class="flex min-w-0 flex-1 cursor-pointer items-start gap-2 ps-3 pt-2.5 pb-2"
+              @click="toggleCallout"
+            >
+              <OIcon
+                name="warning"
+                size="sm"
+                class="text-badge-warning-soft-text mt-0.5 shrink-0"
+              />
+              <span class="min-w-0 flex-1">
+                <span class="text-text-heading text-compact block font-semibold">
+                  {{ calloutTitle }}
+                </span>
+                <span
+                  v-if="!calloutOpen"
+                  class="text-text-heading mt-1 block text-xs font-medium"
+                  data-test="edit-role-companions-names"
+                >
+                  {{ namesLine }}
+                </span>
+              </span>
+              <OButton
+                variant="ghost"
+                size="icon-xs"
+                :aria-expanded="calloutOpen"
+                aria-controls="edit-role-companions-list"
+                :aria-label="calloutTitle"
+                data-test="edit-role-companions-toggle"
+                @click.stop="toggleCallout"
+              >
+                <OIcon :name="calloutOpen ? 'expand-less' : 'expand-more'" size="sm" />
+              </OButton>
+            </div>
+            <OButton
+              v-if="gapRows.length > 1"
+              variant="ghost"
+              size="sm"
+              icon-left="add"
+              class="mt-2 shrink-0"
+              :disabled="saving"
+              data-test="edit-role-companions-add-all"
+              @click="
+                addKeys(
+                  $event,
+                  gapRows.flatMap((gap) => gap.keys),
+                )
+              "
+            >
+              {{ t("iam.editRole.companionAddAll") }}
+            </OButton>
+          </div>
+          <ul
+            v-if="calloutOpen"
+            id="edit-role-companions-list"
+            class="border-badge-warning-soft-text/20 divide-badge-warning-soft-text/20 max-h-54 divide-y overflow-y-auto border-t ps-9.5 pe-3 pb-0.5"
+          >
+            <li
+              v-for="gap in gapRows"
+              :key="gap.module"
+              class="flex items-center gap-3 py-2"
+              :data-test="`edit-role-companion-${gap.module}`"
+            >
+              <div class="flex min-w-0 flex-1 flex-col gap-1">
+                <OTruncatedText class="text-text-body text-sm">{{ gap.label }}</OTruncatedText>
+                <span
+                  class="text-text-secondary flex items-center gap-1 text-xs"
+                  :data-test="`edit-role-companion-needs-${gap.module}`"
+                >
+                  {{ gap.needsLine }}
+                  <OTooltip :content="raw(gap.why.join(' '))">
+                    <span class="inline-flex"><OIcon name="info" size="sm" /></span>
+                  </OTooltip>
+                </span>
+              </div>
+              <OTooltip
+                v-if="gap.opensModule"
+                :content="t('iam.editRole.companionOpenStreamsTooltip')"
+              >
+                <OButton
+                  variant="outline"
+                  size="sm"
+                  :disabled="saving"
+                  :data-test="`edit-role-companion-open-${gap.module}`"
+                  @click="emit('open-module', gap.module)"
+                >
+                  {{ t("iam.editRole.companionOpenStreams") }}
+                </OButton>
+              </OTooltip>
+              <OButton
+                v-if="gap.keys.length"
+                variant="outline"
+                size="sm"
+                icon-left="add"
+                :aria-label="t('iam.editRole.companionAddItem', { item: gap.label })"
+                :disabled="saving"
+                :data-test="`edit-role-companion-add-${gap.module}`"
+                @click="addKeys($event, gap.keys)"
+              >
+                {{ t("iam.editRole.companionAdd") }}
+              </OButton>
+            </li>
+          </ul>
+        </section>
+      </div>
+    </div>
   </ODrawer>
 </template>
 
 <script setup lang="ts">
-import { computed } from "vue";
-import { useI18nTyped, type I18nText } from "@/types/i18n";
+import { computed, ref, watch } from "vue";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import OBadge from "@/lib/core/Badge/OBadge.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import type { IconName } from "@/lib/core/Icon/OIcon.icons";
+import { companionAddKeys, type CompanionGap } from "@/components/iam/roles/roleCompanions";
 
 export type PendingChange = {
   id: string;
   state: "added" | "removed";
   label: I18nText;
   moduleLabel: I18nText;
+  /** Rail module the change is listed under; resources in no module share one "Other" group. */
+  moduleKey: string;
   actions: { action: string; label: I18nText }[];
   keys: string[];
+  /** What the change lets the role do, or no longer do, in one sentence. */
+  effect: I18nText;
+  /** Module labels of the rules that need this change, for the short "Needed by" line. */
+  neededBy: I18nText[];
+  notes: I18nText[];
 };
 
-const props = defineProps<{ open: boolean; changes: PendingChange[] }>();
+export type PendingGroup = {
+  key: string;
+  label: I18nText;
+  icon: IconName;
+  changes: PendingChange[];
+};
 
-const emit = defineEmits<{ "update:open": [value: boolean]; undo: [keys: string[]] }>();
+const props = defineProps<{
+  open: boolean;
+  groups: PendingGroup[];
+  /** Modules the role needs to work but lacks; listed first, and never staged until Add. */
+  gaps: CompanionGap[];
+  orgId: string;
+  moduleLabel: (key: string) => I18nText;
+  summaryActions: (actions: string[]) => { action: string; label: I18nText }[];
+  /** A change staged before the PUT settles would be marked saved unsent, so every staging button waits. */
+  saving?: boolean;
+}>();
 
-const { t } = useI18nTyped();
+const emit = defineEmits<{
+  "update:open": [value: boolean];
+  undo: [keys: string[]];
+  add: [keys: string[]];
+  "open-module": [moduleKey: string];
+  save: [];
+}>();
 
-const allKeys = computed(() => props.changes.flatMap((change) => change.keys));
+const { t, locale } = useI18nTyped();
+
+// A double click's second click lands on the row that slid up under the pointer, so only the first click adds.
+const addKeys = (event: MouseEvent, keys: string[]) => {
+  if (event.detail > 1) return;
+  emit("add", keys);
+};
+
+const listOf = (items: string[], type: Intl.ListFormatType = "conjunction") =>
+  raw(new Intl.ListFormat(locale.value, { type }).format(items));
+
+const changeCount = computed(() =>
+  props.groups.reduce((count, group) => count + group.changes.length, 0),
+);
+
+const allKeys = computed(() =>
+  props.groups.flatMap((group) => group.changes.flatMap((change) => change.keys)),
+);
+
+const changesLine = computed(() => {
+  const count = changeCount.value;
+  const modules = props.groups.length;
+  return count
+    ? t("iam.editRole.yourChangesCount", {
+        changes: t("iam.editRole.changeCount", { count }, count),
+        modules: t("iam.editRole.presetModuleCount", { count: modules }, modules),
+      })
+    : t("iam.editRole.yourChangesNone");
+});
+
+const gapRows = computed(() =>
+  props.gaps.map((gap) => {
+    const keys = companionAddKeys(gap, props.orgId);
+    return {
+      module: gap.module,
+      label: t("iam.editRole.presetMissingItem", {
+        module: props.moduleLabel(gap.module),
+        actions: listOf(props.summaryActions(gap.actions).map((action) => action.label)),
+      }),
+      needsLine: t("iam.editRole.neededBy", {
+        modules: listOf(gap.neededBy.map((need) => props.moduleLabel(need.module))),
+      }),
+      why: gap.neededBy.map((need) =>
+        t("iam.editRole.companionNeeds", {
+          module: props.moduleLabel(need.module),
+          reason: t(need.reasonKey),
+        }),
+      ),
+      keys,
+      // Streams Get is picked stream by stream, so that row opens the module rather than adding.
+      opensModule: keys.length < gap.actions.length,
+    };
+  }),
+);
+
+const calloutTitle = computed(() => {
+  const count = gapRows.value.length;
+  return t("iam.editRole.notAddedYetTitle", {
+    modules: t("iam.editRole.presetModuleCount", { count }, count),
+  });
+});
+
+const namesLine = computed(() =>
+  listOf(
+    gapRows.value.map((gap) => gap.label),
+    "unit",
+  ),
+);
+
+// null follows the default: closed, with the missing modules named on one line until the admin expands it.
+const calloutChoice = ref<boolean | null>(null);
+
+const calloutOpen = computed(() => calloutChoice.value ?? false);
+
+const toggleCallout = () => {
+  calloutChoice.value = !calloutOpen.value;
+};
+
+watch(
+  () => props.open,
+  (open) => {
+    if (open) calloutChoice.value = null;
+  },
+);
 </script>
diff --git a/web/src/components/iam/roles/jobPresets.ts b/web/src/components/iam/roles/jobPresets.ts
new file mode 100644
index 0000000000..908e79358a
--- /dev/null
+++ b/web/src/components/iam/roles/jobPresets.ts
@@ -0,0 +1,77 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { IconName } from "@/lib/core/Icon/OIcon.icons";
+import type { I18nKey } from "@/types/i18n";
+import type { PermissionType } from "@/ts/interfaces";
+import type { ModuleGroupId } from "@/components/iam/roles/roleModules";
+
+export type JobPreset = {
+  id: string;
+  titleKey: I18nKey;
+  descriptionKey: I18nKey;
+  icon: IconName;
+  /** Rail group whose tile colour the preset borrows. */
+  tone: ModuleGroupId;
+  /** Module-wide grants, by resource key, on `_all_<org>`. */
+  grants: Record<string, readonly PermissionType[]>;
+};
+
+const ALL: readonly PermissionType[] = ["AllowAll"];
+const READ: readonly PermissionType[] = ["AllowList", "AllowGet"];
+
+/** Role starting points named after a job, with the companion grants each needs; stream reads are org-wide (the stream wildcard, like Read-Only) and the preset detail says so before Add. */
+export const JOB_PRESETS: JobPreset[] = [
+  {
+    id: "alert_manager",
+    titleKey: "iam.editRole.presetAlertManagerTitle",
+    descriptionKey: "iam.editRole.presetAlertManagerDescription",
+    icon: "notifications-active",
+    tone: "alerting",
+    grants: { afolder: ALL, destination: ALL, template: ALL, stream: READ },
+  },
+  {
+    id: "alert_viewer",
+    titleKey: "iam.editRole.presetAlertViewerTitle",
+    descriptionKey: "iam.editRole.presetAlertViewerDescription",
+    icon: "notifications",
+    tone: "alerting",
+    grants: { afolder: READ, destination: READ, template: READ },
+  },
+  {
+    id: "dashboard_editor",
+    titleKey: "iam.editRole.presetDashboardEditorTitle",
+    descriptionKey: "iam.editRole.presetDashboardEditorDescription",
+    icon: "dashboard-customize",
+    tone: "dashboards",
+    grants: { dfolder: ALL, stream: READ },
+  },
+  {
+    id: "dashboard_viewer",
+    titleKey: "iam.editRole.presetDashboardViewerTitle",
+    descriptionKey: "iam.editRole.presetDashboardViewerDescription",
+    icon: "dashboard",
+    tone: "dashboards",
+    grants: { dfolder: READ, stream: READ },
+  },
+  {
+    id: "pipeline_editor",
+    titleKey: "iam.editRole.presetPipelineEditorTitle",
+    descriptionKey: "iam.editRole.presetPipelineEditorDescription",
+    icon: "lan",
+    tone: "pipelines",
+    grants: { pipeline: ALL, function: ALL, stream: READ, enrichment_table: READ },
+  },
+];
diff --git a/web/src/components/iam/roles/roleCompanions.spec.ts b/web/src/components/iam/roles/roleCompanions.spec.ts
new file mode 100644
index 0000000000..bef8a573ef
--- /dev/null
+++ b/web/src/components/iam/roles/roleCompanions.spec.ts
@@ -0,0 +1,264 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect } from "vitest";
+import i18n from "@/locales";
+import {
+  companionAddKeys,
+  findCompanionGaps,
+  type CompanionGap,
+} from "@/components/iam/roles/roleCompanions";
+
+const ORG = "default";
+const ALL = `_all_${ORG}`;
+const MODULES = new Set(["afolder", "dfolder", "destination", "template", "stream"]);
+
+const gapsFor = (keys: string[], modules: Set<string> = MODULES) =>
+  findCompanionGaps(new Set(keys), modules, ORG);
+
+const summary = (gaps: CompanionGap[]) =>
+  gaps.map((gap) => `${gap.module}: ${gap.actions.join(", ")}`);
+
+describe("roleCompanions - rules", () => {
+  it.each(["AllowAll", "AllowPost", "AllowPut"])(
+    "flags Streams and Destinations List and Get when Alert Folders has %s",
+    (action) => {
+      expect(summary(gapsFor([`afolder:${ALL}:${action}`]))).toEqual([
+        "stream: AllowList, AllowGet",
+        "destination: AllowList, AllowGet",
+      ]);
+    },
+  );
+
+  it.each(["AllowList", "AllowGet", "AllowDelete"])(
+    "does not flag for Alert Folders %s",
+    (action) => {
+      expect(gapsFor([`afolder:${ALL}:${action}`])).toEqual([]);
+    },
+  );
+
+  it.each(["AllowAll", "AllowPost", "AllowPut"])(
+    "flags Templates List and Get when Destinations has %s",
+    (action) => {
+      expect(summary(gapsFor([`destination:${ALL}:${action}`]))).toEqual([
+        "template: AllowList, AllowGet",
+      ]);
+    },
+  );
+
+  it.each(["AllowAll", "AllowGet", "AllowPost", "AllowPut"])(
+    "flags Streams List and Get for %s on Dashboard Folders",
+    (action) => {
+      expect(summary(gapsFor([`dfolder:${ALL}:${action}`]))).toEqual([
+        "stream: AllowList, AllowGet",
+      ]);
+    },
+  );
+
+  it.each([
+    `dfolder:${ALL}:AllowList`,
+    `dfolder:${ALL}:AllowDelete`,
+    "dashboard:default/old:AllowDelete",
+  ])("does not flag Streams for %s, which reads no panel data", (key) => {
+    expect(gapsFor([key])).toEqual([]);
+  });
+
+  it("merges two rules that need Streams into one entry and names each module that needs it", () => {
+    const gaps = gapsFor([`afolder:${ALL}:AllowPut`, `dfolder:${ALL}:AllowGet`]);
+    const streams = gaps.find((gap) => gap.module === "stream");
+    expect(gaps.filter((gap) => gap.module === "stream")).toHaveLength(1);
+    expect(streams?.actions).toEqual(["AllowList", "AllowGet"]);
+    expect(streams?.neededBy).toEqual([
+      { module: "afolder", reasonKey: "iam.editRole.companionReasonAlertStreams" },
+      { module: "dfolder", reasonKey: "iam.editRole.companionReasonDashboardStreams" },
+    ]);
+  });
+
+  it("gives reason keys that resolve in en-US", () => {
+    const gaps = gapsFor([
+      `afolder:${ALL}:AllowAll`,
+      `destination:${ALL}:AllowAll`,
+      `dfolder:${ALL}:AllowAll`,
+    ]);
+    gaps
+      .flatMap((gap) => gap.neededBy)
+      .forEach(({ reasonKey }) => expect(i18n.global.te(reasonKey, "en-us")).toBe(true));
+  });
+});
+
+describe("roleCompanions - triggers", () => {
+  it("fires on Create on one alert folder", () => {
+    expect(summary(gapsFor(["afolder:f1:AllowPost"]))).toEqual([
+      "stream: AllowList, AllowGet",
+      "destination: AllowList, AllowGet",
+    ]);
+  });
+
+  it("fires on a saved alert whose folder list never loaded", () => {
+    expect(gapsFor(["alert:f1/a9:AllowPut"]).map((gap) => gap.module)).toEqual([
+      "stream",
+      "destination",
+    ]);
+  });
+
+  it("fires on a single dashboard grant", () => {
+    expect(gapsFor(["dashboard:f1/d1:AllowGet"]).map((gap) => gap.module)).toEqual(["stream"]);
+  });
+
+  it("does not fire when the trigger module is not in this org", () => {
+    expect(gapsFor([`dfolder:${ALL}:AllowAll`], new Set(["stream"]))).toEqual([]);
+  });
+
+  it("returns nothing for an empty role", () => {
+    expect(gapsFor([])).toEqual([]);
+  });
+});
+
+describe("roleCompanions - met", () => {
+  it("is met by the module-wide grant", () => {
+    expect(
+      gapsFor([`dfolder:${ALL}:AllowAll`, `stream:${ALL}:AllowList`, `stream:${ALL}:AllowGet`]),
+    ).toEqual([]);
+  });
+
+  it("is met by All on the needed module", () => {
+    expect(gapsFor([`dfolder:${ALL}:AllowAll`, `stream:${ALL}:AllowAll`])).toEqual([]);
+  });
+
+  it("is met by a stream type node and one stream's Get", () => {
+    expect(
+      gapsFor([`dfolder:${ALL}:AllowAll`, `metrics:${ALL}:AllowList`, "metrics:cpu:AllowGet"]),
+    ).toEqual([]);
+  });
+
+  it("is met for Get by a single stream, leaving only List", () => {
+    expect(summary(gapsFor([`dfolder:${ALL}:AllowAll`, "logs:app:AllowGet"]))).toEqual([
+      "stream: AllowList",
+    ]);
+  });
+
+  it("lists only through the module-wide grant, never through one item", () => {
+    expect(summary(gapsFor([`destination:${ALL}:AllowPut`, "template:slack:AllowAll"]))).toEqual([
+      "template: AllowList",
+    ]);
+    expect(
+      gapsFor([
+        `destination:${ALL}:AllowPut`,
+        `template:${ALL}:AllowList`,
+        "template:slack:AllowGet",
+      ]),
+    ).toEqual([]);
+  });
+
+  it("still flags Destinations Get when only Destinations List is added, as the list keeps only items they can Get", () => {
+    const keys = [
+      `afolder:${ALL}:AllowAll`,
+      `stream:${ALL}:AllowList`,
+      `stream:${ALL}:AllowGet`,
+      `destination:${ALL}:AllowList`,
+    ];
+    expect(summary(gapsFor(keys))).toEqual(["destination: AllowGet"]);
+    expect(gapsFor([...keys, `destination:${ALL}:AllowGet`])).toEqual([]);
+  });
+
+  it("lets one stream's All meet Streams Get but not Streams List", () => {
+    expect(summary(gapsFor(["dfolder:f1:AllowGet", "logs:app:AllowAll"]))).toEqual([
+      "stream: AllowList",
+    ]);
+  });
+
+  it("needs List on each stream type the role reads, not on any one type", () => {
+    const keys = [
+      `afolder:${ALL}:AllowPost`,
+      `destination:${ALL}:AllowAll`,
+      `template:${ALL}:AllowAll`,
+      `metrics:${ALL}:AllowList`,
+      "logs:app:AllowGet",
+    ];
+    expect(summary(gapsFor(keys))).toEqual(["stream: AllowList"]);
+    expect(gapsFor([...keys, `logs:${ALL}:AllowList`])).toEqual([]);
+  });
+
+  it("is met for List by the stream wildcard whatever types the role reads", () => {
+    expect(
+      gapsFor([
+        `dfolder:${ALL}:AllowGet`,
+        `stream:${ALL}:AllowList`,
+        "logs:app:AllowGet",
+        "metrics:cpu:AllowGet",
+      ]),
+    ).toEqual([]);
+  });
+
+  it("needs List on every stream type once the stream wildcard grants Get", () => {
+    const keys = [`dfolder:${ALL}:AllowGet`, `stream:${ALL}:AllowGet`, `metrics:${ALL}:AllowList`];
+    expect(summary(gapsFor(keys))).toEqual(["stream: AllowList"]);
+    expect(gapsFor([...keys, `stream:${ALL}:AllowList`])).toEqual([]);
+    expect(
+      gapsFor([...keys, ...["logs", "traces", "index"].map((type) => `${type}:${ALL}:AllowList`)]),
+    ).toEqual([]);
+  });
+
+  it("does not read a stream named like the wildcard as the wildcard", () => {
+    expect(summary(gapsFor([`dfolder:${ALL}:AllowGet`, "logs:_all_x:AllowAll"]))).toEqual([
+      "stream: AllowList",
+    ]);
+  });
+
+  it("flags only the action still missing", () => {
+    expect(summary(gapsFor([`dfolder:${ALL}:AllowGet`, `stream:${ALL}:AllowList`]))).toEqual([
+      "stream: AllowGet",
+    ]);
+  });
+
+  it("flags again once the grant that met it leaves the set", () => {
+    const keys = [`dfolder:${ALL}:AllowAll`, `stream:${ALL}:AllowAll`];
+    expect(gapsFor(keys)).toEqual([]);
+    expect(summary(gapsFor(keys.slice(0, 1)))).toEqual(["stream: AllowList, AllowGet"]);
+  });
+
+  it("does not flag a module this org lacks", () => {
+    const noTemplates = new Set(["afolder", "destination", "stream"]);
+    expect(gapsFor([`destination:${ALL}:AllowAll`], noTemplates)).toEqual([]);
+    expect(
+      summary(gapsFor([`afolder:${ALL}:AllowAll`], new Set(["afolder", "destination"]))),
+    ).toEqual(["destination: AllowList, AllowGet"]);
+  });
+});
+
+describe("roleCompanions - companionAddKeys", () => {
+  it("stages the module-wide grant for each missing action", () => {
+    const gap: CompanionGap = {
+      module: "destination",
+      actions: ["AllowList", "AllowGet"],
+      neededBy: [{ module: "afolder", reasonKey: "iam.editRole.companionReasonAlertDestinations" }],
+    };
+    expect(companionAddKeys(gap, ORG)).toEqual([
+      `destination:${ALL}:AllowList`,
+      `destination:${ALL}:AllowGet`,
+    ]);
+  });
+
+  it("adds Streams List but never Streams Get", () => {
+    const [streams] = gapsFor([`dfolder:${ALL}:AllowAll`]);
+    expect(companionAddKeys(streams, ORG)).toEqual([`stream:${ALL}:AllowList`]);
+  });
+
+  it("returns nothing for a Streams gap that is Get only", () => {
+    const [streams] = gapsFor([`dfolder:${ALL}:AllowAll`, `stream:${ALL}:AllowList`]);
+    expect(streams.actions).toEqual(["AllowGet"]);
+    expect(companionAddKeys(streams, ORG)).toEqual([]);
+  });
+});
diff --git a/web/src/components/iam/roles/roleCompanions.ts b/web/src/components/iam/roles/roleCompanions.ts
new file mode 100644
index 0000000000..d7c802c39b
--- /dev/null
+++ b/web/src/components/iam/roles/roleCompanions.ts
@@ -0,0 +1,170 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { buildGrantKey, splitGrantKey } from "@/composables/iam/useRoleGrants";
+import type { PermissionType } from "@/ts/interfaces";
+
+export type CompanionAction = "AllowList" | "AllowGet";
+
+export type CompanionGap = {
+  module: string;
+  actions: CompanionAction[];
+  neededBy: { module: string; reasonKey: string }[];
+};
+
+type CompanionRule = {
+  trigger: string;
+  on: readonly PermissionType[];
+  needs: { module: string; actions: CompanionAction[]; reasonKey: string }[];
+};
+
+const WRITES: readonly PermissionType[] = ["AllowAll", "AllowPost", "AllowPut"];
+
+const ACTION_ORDER: CompanionAction[] = ["AllowList", "AllowGet"];
+
+// Alert save checks stream access (background_access/mod.rs), the alert form lists destinations, every destination needs a template, and opening or building a dashboard queries its panels' streams; destination and template lists keep only items the user can Get.
+const COMPANION_RULES: CompanionRule[] = [
+  {
+    trigger: "afolder",
+    on: WRITES,
+    needs: [
+      {
+        module: "stream",
+        actions: ["AllowList", "AllowGet"],
+        reasonKey: "iam.editRole.companionReasonAlertStreams",
+      },
+      {
+        module: "destination",
+        actions: ["AllowList", "AllowGet"],
+        reasonKey: "iam.editRole.companionReasonAlertDestinations",
+      },
+    ],
+  },
+  {
+    trigger: "destination",
+    on: WRITES,
+    needs: [
+      {
+        module: "template",
+        actions: ["AllowList", "AllowGet"],
+        reasonKey: "iam.editRole.companionReasonDestinationTemplates",
+      },
+    ],
+  },
+  {
+    trigger: "dfolder",
+    on: ["AllowAll", "AllowGet", "AllowPost", "AllowPut"],
+    needs: [
+      {
+        module: "stream",
+        actions: ["AllowList", "AllowGet"],
+        reasonKey: "iam.editRole.companionReasonDashboardStreams",
+      },
+    ],
+  },
+];
+
+const STREAM_TYPES = ["logs", "metrics", "traces", "index"];
+
+// Item grants live on child resources, so a saved `alert:f1/a9` or `metrics:cpu` counts even before its list loads.
+const RESOURCES_OF: Record<string, string[]> = {
+  afolder: ["afolder", "alert"],
+  dfolder: ["dfolder", "dashboard"],
+  stream: ["stream", ...STREAM_TYPES],
+};
+
+// The drawer patches a hand-built role whose streams were picked one by one, so its Add never widens to every stream; a job preset does only after its detail says so.
+const PICK_ITEMS_INSTEAD: Record<string, CompanionAction[]> = { stream: ["AllowGet"] };
+
+type ActionIndex = Map<string, Set<string>>;
+
+const indexAction = (index: ActionIndex, resource: string, action: string) => {
+  const actions = index.get(resource) ?? new Set<string>();
+  actions.add(action);
+  index.set(resource, actions);
+};
+
+const holds = (index: ActionIndex, resource: string, actions: readonly string[]) =>
+  actions.some((action) => index.get(resource)?.has(action));
+
+const holdsAny = (index: ActionIndex, module: string, actions: readonly string[]) =>
+  (RESOURCES_OF[module] ?? [module]).some((resource) => holds(index, resource, actions));
+
+// FGA checks List per stream type, so List on metrics lists none of the logs streams the role can read.
+const listsReadStreams = (anyItem: ActionIndex, moduleWide: ActionIndex) => {
+  const list = ["AllowList", "AllowAll"];
+  const read = ["AllowGet", "AllowAll"];
+  if (holds(moduleWide, "stream", list)) return true;
+  // The stream wildcard's Get reads every type, so each type must list.
+  const readTypes = holds(moduleWide, "stream", read)
+    ? STREAM_TYPES
+    : STREAM_TYPES.filter((type) => holds(anyItem, type, read));
+  return readTypes.length
+    ? readTypes.every((type) => holds(moduleWide, type, list))
+    : STREAM_TYPES.some((type) => holds(moduleWide, type, list));
+};
+
+/** Modules a role's grants need to work but lacks: List needs an org-wide grant (per read stream type for Streams), Get any item's, All counting for both. */
+export function findCompanionGaps(
+  keys: ReadonlySet<string>,
+  availableModules: ReadonlySet<string>,
+  orgId: string,
+): CompanionGap[] {
+  // Exact match: a stream may be named `_all_x`, so a prefix test would read it as the wildcard.
+  const wildcard = `_all_${orgId}`;
+  // One pass over the grants, so a role with thousands of them is scanned once, not once per rule.
+  const anyItem: ActionIndex = new Map();
+  const moduleWide: ActionIndex = new Map();
+  keys.forEach((key) => {
+    const { resource, entity, permission } = splitGrantKey(key);
+    indexAction(anyItem, resource, permission);
+    if (entity === wildcard) indexAction(moduleWide, resource, permission);
+  });
+
+  const gaps = new Map<string, CompanionGap>();
+  COMPANION_RULES.filter(
+    (rule) => availableModules.has(rule.trigger) && holdsAny(anyItem, rule.trigger, rule.on),
+  ).forEach((rule) =>
+    rule.needs
+      // A module this org lacks can be neither granted nor added, so flagging it is noise.
+      .filter((need) => availableModules.has(need.module))
+      .forEach((need) => {
+        // FGA checks List on the org wildcard, so one item's grant opens that item but lists nothing.
+        const missing = need.actions.filter((action) =>
+          action === "AllowList" && need.module === "stream"
+            ? !listsReadStreams(anyItem, moduleWide)
+            : !holdsAny(action === "AllowList" ? moduleWide : anyItem, need.module, [
+                action,
+                "AllowAll",
+              ]),
+        );
+        if (!missing.length) return;
+        const gap = gaps.get(need.module) ?? { module: need.module, actions: [], neededBy: [] };
+        gap.actions = ACTION_ORDER.filter(
+          (action) => gap.actions.includes(action) || missing.includes(action),
+        );
+        gap.neededBy.push({ module: rule.trigger, reasonKey: need.reasonKey });
+        gaps.set(need.module, gap);
+      }),
+  );
+  return [...gaps.values()];
+}
+
+/** The module-wide keys an Add stages for a gap; Streams Get is left for the admin to pick per stream. */
+export function companionAddKeys(gap: CompanionGap, orgId: string): string[] {
+  return gap.actions
+    .filter((action) => !PICK_ITEMS_INSTEAD[gap.module]?.includes(action))
+    .map((action) => buildGrantKey(gap.module, action, `_all_${orgId}`));
+}
diff --git a/web/src/components/iam/roles/roleGroupTone.ts b/web/src/components/iam/roles/roleGroupTone.ts
new file mode 100644
index 0000000000..04ad7bfce5
--- /dev/null
+++ b/web/src/components/iam/roles/roleGroupTone.ts
@@ -0,0 +1,30 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Tile colour tells the module's category apart at a glance; every class is a registered token.
+const GROUP_TONE: Record<string, string> = {
+  data: "bg-badge-blue-soft-bg text-badge-blue-soft-text",
+  dashboards: "bg-badge-purple-soft-bg text-badge-purple-soft-text",
+  alerting: "bg-icon-chip-orange-bg text-icon-chip-orange-text",
+  pipelines: "bg-badge-teal-soft-bg text-badge-teal-soft-text",
+  monitoring: "bg-icon-chip-info-bg text-icon-chip-info-text",
+  ai: "bg-icon-chip-primary-bg text-icon-chip-primary-text",
+  access: "bg-icon-chip-success-bg text-icon-chip-success-text",
+};
+
+const NEUTRAL_TONE = "bg-surface-subtle text-text-secondary";
+
+/** Icon tile classes for a module group or preset tone; unknown tones stay neutral. */
+export const groupTone = (tone: string) => GROUP_TONE[tone] ?? NEUTRAL_TONE;
diff --git a/web/src/components/iam/roles/roleModules.spec.ts b/web/src/components/iam/roles/roleModules.spec.ts
index a6e881ca4e..fa31096300 100644
--- a/web/src/components/iam/roles/roleModules.spec.ts
+++ b/web/src/components/iam/roles/roleModules.spec.ts
@@ -2,6 +2,9 @@ import { describe, it, expect } from "vitest";
 import {
   buildRoleModules,
   GROUP_ORDER,
+  matchModule,
+  moduleGroup,
+  TASK_WORDS,
   type CatalogResource,
 } from "@/components/iam/roles/roleModules";
 
@@ -143,3 +146,99 @@ describe("buildRoleModules - grouping", () => {
     expect(groupIndexes).toEqual([...groupIndexes].sort((a, b) => a - b));
   });
 });
+
+const destinations = { key: "destination", label: "Destinations", groupLabel: "Alerting" };
+
+const dashboards = {
+  key: "dfolder",
+  label: "Dashboard Folders",
+  groupLabel: "Dashboards And Reports",
+};
+
+describe("matchModule - order", () => {
+  it("matches the module name, ignoring case", () => {
+    expect(matchModule(destinations, "DEST")).toEqual({ via: "label" });
+  });
+
+  it("falls back to the group name", () => {
+    expect(matchModule(destinations, "alerting")).toEqual({ via: "group" });
+  });
+
+  it("falls back to a task word and returns the word", () => {
+    expect(matchModule(destinations, "slack")).toEqual({ via: "word" });
+    expect(matchModule(dashboards, "pan")).toEqual({ via: "word" });
+  });
+
+  // "dash" is in the name and in the task word "dashboard"; the name wins, so no pill shows.
+  it("prefers the name over a group or task word", () => {
+    expect(matchModule(dashboards, "dash")).toEqual({ via: "label" });
+    expect(matchModule(dashboards, "reports")).toEqual({ via: "group" });
+  });
+
+  it("returns no match when nothing fits", () => {
+    expect(matchModule(destinations, "zzz")).toBeNull();
+  });
+
+  it("keeps every module for an empty or blank query", () => {
+    expect(matchModule(destinations, "")).toEqual({ via: "label" });
+    expect(matchModule(destinations, "   ")).toEqual({ via: "label" });
+  });
+
+  it("matches a module with no task words by name and group only", () => {
+    const fresh = { key: "brand_new_thing", label: "Brand New", groupLabel: "Other" };
+
+    expect(matchModule(fresh, "brand")).toEqual({ via: "label" });
+    expect(matchModule(fresh, "oth")).toEqual({ via: "group" });
+    expect(matchModule(fresh, "slack")).toBeNull();
+  });
+});
+
+describe("matchModule - short query", () => {
+  // "k" is in "slack", but one letter would keep nearly every module.
+  it("skips task words for a 1-character query, but still matches names and groups", () => {
+    expect(matchModule(destinations, "k")).toBeNull();
+    expect(matchModule(destinations, "d")).toEqual({ via: "label" });
+    expect(matchModule(destinations, "g")).toEqual({ via: "group" });
+  });
+
+  it("trims the query before matching", () => {
+    expect(matchModule(destinations, "  slack  ")).toEqual({ via: "word" });
+  });
+
+  it("treats ( . * + ? [ \\ as literal characters", () => {
+    expect(() => matchModule(destinations, "[\\")).not.toThrow();
+    expect(matchModule(destinations, "(")).toBeNull();
+  });
+});
+
+describe("task words", () => {
+  // A typo in a key would silently drop that module's words, so only the known Other modules may miss the group map.
+  it("keys every task-word list by a resource with a known group", () => {
+    const keys = Object.keys(TASK_WORDS);
+
+    keys.forEach((key) => expect(GROUP_ORDER).toContain(moduleGroup(key)));
+    expect(keys.filter((key) => moduleGroup(key) === "other").sort()).toEqual([
+      "alert_calibration",
+      "query_history",
+      "rum_analytics",
+    ]);
+  });
+
+  it("finds RUM Product Analytics by the task word funnel", () => {
+    const productAnalytics = {
+      key: "rum_analytics",
+      label: "RUM Product Analytics",
+      groupLabel: "Other",
+    };
+
+    expect(matchModule(productAnalytics, "funnel")).toEqual({ via: "word" });
+  });
+
+  it("finds the hint examples: slack, panel and token each match a module", () => {
+    expect(matchModule(destinations, "slack")?.via).toBe("word");
+    expect(matchModule(dashboards, "panel")?.via).toBe("word");
+    expect(
+      matchModule({ key: "passcode", label: "Passcode", groupLabel: "Access" }, "token")?.via,
+    ).toBe("word");
+  });
+});
diff --git a/web/src/components/iam/roles/roleModules.ts b/web/src/components/iam/roles/roleModules.ts
index 55c9c0cdce..3468bb0989 100644
--- a/web/src/components/iam/roles/roleModules.ts
+++ b/web/src/components/iam/roles/roleModules.ts
@@ -162,6 +162,97 @@ const GROUP_OF: Record<string, ModuleGroupId> = {
   remote_task: "platform",
 };
 
+/** A child listed without its parent still belongs where that parent would have been; the API sends `parent: ""` at top level. */
+export const moduleGroup = (key: string, parent?: string): ModuleGroupId =>
+  GROUP_OF[key] || GROUP_OF[parent ?? ""] || "other";
+
+// English on purpose: code compares them with what the user types; a child's words sit on its parent, the rail row.
+export const TASK_WORDS: Record<string, string[]> = {
+  stream: ["logs", "metrics", "traces", "indices", "index", "query", "search"],
+  enrichment_table: ["lookup", "csv", "enrich"],
+  savedviews: ["saved search", "view"],
+  metadata: ["fields", "schema"],
+  search_jobs: ["background search", "async query"],
+  cipher_keys: ["encryption", "decrypt", "secret"],
+  re_patterns: ["regex", "redact", "mask", "pii"],
+  service_streams: ["service", "correlation"],
+  search_inspector: ["query profile", "slow query"],
+  dfolder: ["dashboard", "panel", "chart", "graph", "visualization"],
+  rfolder: ["report", "pdf", "scheduled report"],
+  template: ["message", "format", "notification template"],
+  destination: [
+    "slack",
+    "email",
+    "webhook",
+    "pagerduty",
+    "teams",
+    "opsgenie",
+    "notification",
+    "channel",
+  ],
+  afolder: ["alert", "alert rule", "trigger", "monitor"],
+  incidents: ["incident", "outage"],
+  oncall: ["rotation", "schedule", "pager"],
+  oncall_response: ["acknowledge", "escalation"],
+  downtime_folder: ["downtime", "mute", "silence", "maintenance"],
+  function: ["vrl", "transform", "parse"],
+  pipeline: ["pipeline", "ingest", "route", "transform"],
+  workflow_folder: ["workflow", "automation"],
+  rumtoken: ["rum", "browser", "frontend", "token"],
+  sourcemaps: ["sourcemap", "javascript", "stack trace"],
+  synthetic_folder: ["synthetics", "uptime", "probe", "http test"],
+  db_monitoring: ["database", "dbm", "sql", "postgres", "mysql"],
+  status_page: ["status page", "uptime"],
+  synthetic_environment: ["environment", "location"],
+  ai: ["assistant", "chat", "llm"],
+  ai_toolsets: ["tools", "toolset"],
+  mcp: ["model context protocol"],
+  model_pricing: ["cost", "price", "token cost"],
+  provider: ["openai", "anthropic", "provider", "model"],
+  score_config: ["score", "eval", "evaluation"],
+  scorer: ["score", "eval", "judge"],
+  eval_job: ["eval", "evaluation"],
+  annotation_queue: ["annotation", "review"],
+  dataset: ["dataset", "eval data"],
+  experiment: ["experiment", "ab test", "compare"],
+  playground: ["prompt", "test prompt"],
+  prompt_label: ["prompt", "protected label"],
+  pfolder: ["prompt", "prompt template"],
+  ai_chat_share: ["share chat"],
+  user: ["user", "member", "people", "invite"],
+  role: ["role", "permission", "rbac"],
+  group: ["group", "team"],
+  passcode: ["token", "api key", "ingest", "passcode"],
+  service_accounts: ["service account", "bot", "machine"],
+  settings: ["configuration", "org settings"],
+  kv: ["key value", "kv"],
+  summary: ["usage"],
+  ratelimit: ["rate limit", "quota", "throttle"],
+  license: ["license", "plan"],
+  billing_group: ["billing", "invoice", "cost"],
+  remote_task: ["remote", "task"],
+  rum_analytics: ["product analytics", "funnel", "rum"],
+  query_history: ["past queries"],
+  alert_calibration: ["alert", "calibration", "threshold"],
+};
+
+/** Which part of the module fit the filter. */
+export type ModuleMatch = { via: "label" | "group" | "word" };
+
+/** Tries the module's label, then its group, then its task words; an empty query keeps every module. */
+export const matchModule = (
+  module: { key: string; label: string; groupLabel: string },
+  query: string,
+): ModuleMatch | null => {
+  const term = query.trim().toLowerCase();
+  if (!term || module.label.toLowerCase().includes(term)) return { via: "label" };
+  if (module.groupLabel.toLowerCase().includes(term)) return { via: "group" };
+  // One letter is inside nearly every task word, so it would keep almost every module.
+  const byWord =
+    term.length > 1 && !!TASK_WORDS[module.key]?.some((candidate) => candidate.includes(term));
+  return byWord ? { via: "word" } : null;
+};
+
 // Mirrors the main navigation's glyphs where a module has a counterpart there.
 const ICON_OF: Record<string, IconName> = {
   stream: "window",
@@ -251,8 +342,7 @@ export const buildRoleModules = (resources: CatalogResource[]): RoleModule[] =>
     .filter((resource) => !(resource.parent && keys.has(resource.parent)))
     .map((resource) => ({
       key: resource.key,
-      // A child listed without its parent still belongs where that parent would have been; the API sends `parent: ""` at top level.
-      group: GROUP_OF[resource.key] || GROUP_OF[resource.parent ?? ""] || "other",
+      group: moduleGroup(resource.key, resource.parent),
       icon: ICON_OF[resource.key] || ICON_OF[resource.parent ?? ""] || FALLBACK_ICON,
       hasEntities: resource.has_entities !== false,
       scopeKeys: [resource.key],
diff --git a/web/src/components/iam/users/User.spec.ts b/web/src/components/iam/users/User.spec.ts
index 9139da8f62..0955b707ab 100644
--- a/web/src/components/iam/users/User.spec.ts
+++ b/web/src/components/iam/users/User.spec.ts
@@ -1318,6 +1318,46 @@ describe("User Component", () => {
       expect(mockUsersService.bulkDelete).toHaveBeenCalled();
     });
 
+    it("deletes regular users and blocks domain-mapped users in separate calls", async () => {
+      wrapper.vm.selectedUsers = [
+        { email: "a@example.com", enableDelete: true },
+        { email: "b@acme.com", enableDelete: true, isDomainMapped: true },
+      ];
+      mockOrganizationsService.get_organization_settings.mockResolvedValue({
+        data: { data: { domain_management_config: { domains: [], blocked_emails: [] } } },
+      } as any);
+      mockOrganizationsService.post_organization_settings.mockResolvedValue({ data: {} } as any);
+      mockUsersService.bulkDelete.mockImplementation(
+        async (_org: string, { ids }: { ids: string[] }) =>
+          ({ data: { successful: ids, unsuccessful: [] } }) as any,
+      );
+
+      await wrapper.vm.bulkDeleteUsers();
+
+      const org = store.state.selectedOrganization.identifier;
+      expect(mockUsersService.bulkDelete).toHaveBeenCalledWith(org, { ids: ["a@example.com"] });
+      expect(mockUsersService.bulkDelete).toHaveBeenCalledWith(org, { ids: ["b@acme.com"] });
+      expect(mockOrganizationsService.post_organization_settings).toHaveBeenCalledWith(
+        org,
+        expect.objectContaining({
+          domain_management_config: expect.objectContaining({ blocked_emails: ["b@acme.com"] }),
+        }),
+      );
+    });
+
+    it("does not remove domain-mapped users when the block write fails", async () => {
+      wrapper.vm.selectedUsers = [
+        { email: "b@acme.com", enableDelete: true, isDomainMapped: true },
+      ];
+      mockOrganizationsService.get_organization_settings.mockRejectedValue(
+        new Error("settings down"),
+      );
+
+      await wrapper.vm.bulkDeleteUsers();
+
+      expect(mockUsersService.bulkDelete).not.toHaveBeenCalled();
+    });
+
     it("should suppress 403 errors", async () => {
       wrapper.vm.selectedUsers = [{ email: "a@example.com", enableDelete: true }];
       mockUsersService.bulkDelete.mockRejectedValue({
diff --git a/web/src/components/iam/users/User.vue b/web/src/components/iam/users/User.vue
index 606ab1a696..b3d20606c1 100644
--- a/web/src/components/iam/users/User.vue
+++ b/web/src/components/iam/users/User.vue
@@ -173,7 +173,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
           <template #cell-actions="{ row, index }">
             <OButton
-              v-if="row.enableDelete && row.status != 'pending'"
+              v-if="row.enableDelete && row.status != 'pending' && !row.isDomainMapped"
               :title="t('user.delete')"
               variant="ghost"
               size="icon-sm"
@@ -184,6 +184,18 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             >
               <OIcon name="delete" size="sm" />
             </OButton>
+            <OButton
+              v-if="row.enableDelete && row.status != 'pending' && row.isDomainMapped"
+              :title="t('user.block')"
+              variant="ghost"
+              size="icon-sm"
+              class="max-md:hidden"
+              :data-test="`block-basic-user-${row.email}`"
+              data-row-action="delete"
+              @click="confirmBlockAction(row)"
+            >
+              <OIcon name="block" size="sm" />
+            </OButton>
             <OButton
               v-if="row.status == 'pending' && row.token"
               :title="t('user.revoke_invite')"
@@ -229,7 +241,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 />
               </template>
               <ODropdownItem
-                v-if="row.enableDelete && row.status != 'pending'"
+                v-if="row.enableDelete && row.status != 'pending' && !row.isDomainMapped"
                 icon-left="delete"
                 variant="destructive"
                 class="md:hidden"
@@ -238,6 +250,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               >
                 <span>{{ t("user.delete") }}</span>
               </ODropdownItem>
+              <ODropdownItem
+                v-if="row.enableDelete && row.status != 'pending' && row.isDomainMapped"
+                icon-left="block"
+                variant="destructive"
+                class="md:hidden"
+                :data-test="`block-basic-user-${row.email}-menu`"
+                @select="confirmBlockAction(row)"
+              >
+                <span>{{ t("user.block") }}</span>
+              </ODropdownItem>
               <ODropdownItem
                 v-if="row.status == 'pending' && row.token"
                 icon-left="cancel"
@@ -321,6 +343,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </i18n-t>
     </ODialog>
 
+    <ODialog
+      data-test="user-block-dialog"
+      v-model:open="confirmBlock"
+      size="sm"
+      :title="t('user.confirmBlockHead')"
+      :secondary-button-label="t('user.cancel')"
+      :primary-button-label="t('user.block')"
+      @click:secondary="confirmBlock = false"
+      @click:primary="blockUser"
+    >
+      <p>{{ t("user.confirmBlockMsg", { email: blockUserEmail }) }}</p>
+    </ODialog>
+
     <ODialog
       data-test="user-revoke-dialog"
       v-model:open="confirmRevoke"
@@ -353,6 +388,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       @click:primary="bulkDeleteUsers"
     >
       <p>{{ t("user.deleteUsersMsg", { count: bulkDeleteCount }) }}</p>
+      <p v-if="bulkBlockCount > 0" class="mt-2">
+        {{ t("user.deleteUsersBlockNote", { count: bulkBlockCount }) }}
+      </p>
     </ODialog>
   </OPageLayout>
 </template>
@@ -361,7 +399,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import { orgUsersQuery, assignableRolesQuery, allUserRolesQuery } from "@/services/users.queries";
 import { rolesQuery } from "@/services/iam.queries";
 import { userKeys } from "@/services/users.querykeys";
+import {
+  orgDomainsQuery,
+  orgSettingsQuery,
+  updateOrgSettingsMutation,
+} from "@/services/organizations.queries";
+import { blockEmailsInConfig } from "@/components/settings/orgDomainRestrictions";
 import { queryClient } from "@/composables/query/queryClient";
+import { useMutation } from "@tanstack/vue-query";
 import { defineComponent, ref, onActivated, onBeforeMount, watch, computed } from "vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
@@ -428,6 +473,12 @@ export default defineComponent({
     const showAddUserDialog: any = ref(false);
     const confirmDelete = ref<boolean>(false);
     const confirmRevoke = ref<boolean>(false);
+    const confirmBlock = ref<boolean>(false);
+    const blockUserEmail = ref("");
+    const verifiedDomains = ref<Set<string>>(new Set());
+    const updateSettings = useMutation(() =>
+      updateOrgSettingsMutation(store.state.selectedOrganization.identifier),
+    );
     const selectedUser: any = ref({});
     const orgData: any = ref(store.state.selectedOrganization);
     const isUpdated: any = ref(false);
@@ -461,7 +512,7 @@ export default defineComponent({
 
     onBeforeMount(async () => {
       isEnterprise.value = config.isEnterprise == "true";
-      await getOrgMembers();
+      await Promise.all([getOrgMembers(), getVerifiedDomains()]);
       updateUserActions();
       await getRoles();
       await getCustomRoles();
@@ -1039,6 +1090,7 @@ export default defineComponent({
         member.enableEdit = shouldAllowEdit(member);
         member.enableChangeRole = shouldAllowChangeRole(member);
         member.enableDelete = shouldAllowDelete(member);
+        member.isDomainMapped = isDomainMapped(member);
       });
     };
 
@@ -1355,6 +1407,70 @@ export default defineComponent({
         });
     };
 
+    // Only verified domains auto-add users on SSO login, so only those users would come back after a plain delete.
+    const getVerifiedDomains = async () => {
+      if (config.isCloud !== "true") return;
+      try {
+        const domains = await queryClient.fetchQuery(
+          orgDomainsQuery(store.state.selectedOrganization.identifier),
+        );
+        verifiedDomains.value = new Set(
+          domains.filter((d) => d.verification_state === 1).map((d) => d.domain.toLowerCase()),
+        );
+      } catch {
+        verifiedDomains.value = new Set();
+      }
+    };
+
+    const isDomainMapped = (user: any) => {
+      if (config.isCloud !== "true") return false;
+      const domain = String(user.email ?? "")
+        .toLowerCase()
+        .split("@")[1];
+      return !!domain && verifiedDomains.value.has(domain);
+    };
+
+    const confirmBlockAction = (row: any) => {
+      confirmBlock.value = true;
+      blockUserEmail.value = row.email;
+    };
+
+    const writeBlocks = async (org: string, emails: string[]) => {
+      try {
+        // Fetch fresh so the write is not based on a stale cached config.
+        const settings = await queryClient.fetchQuery({ ...orgSettingsQuery(org), staleTime: 0 });
+        await updateSettings.mutateAsync({
+          domain_management_config: blockEmailsInConfig(
+            settings?.data?.domain_management_config,
+            emails,
+          ),
+        });
+        return true;
+      } catch (err: any) {
+        toast({
+          variant: "error",
+          message:
+            raw(err?.response?.data?.message || err?.message) || t("iam.user.errorBlockingUser"),
+        });
+        return false;
+      }
+    };
+
+    // The user is removed from this org only; the next SSO login evaluates the block and removes them from mapped child orgs.
+    const blockUser = async () => {
+      confirmBlock.value = false;
+      const org = store.state.selectedOrganization.identifier;
+      if (!(await writeBlocks(org, [blockUserEmail.value]))) return;
+      try {
+        await usersService.delete(org, blockUserEmail.value);
+        toast({ variant: "success", message: t("iam.user.userBlockedSuccess") });
+      } catch {
+        toast({ variant: "error", message: t("iam.user.blockedButNotRemoved") });
+      }
+      await getOrgMembers(true);
+      updateUserActions();
+    };
+
     const confirmRevokeAction = (row: any) => {
       confirmRevoke.value = true;
       revokeInviteToken = row.token;
@@ -1435,53 +1551,83 @@ export default defineComponent({
       confirmBulkDelete.value = true;
     };
 
-    const bulkDeleteUsers = async () => {
-      bulkDeleteLoading.value = true;
-      const userEmails = selectedUsers.value.map((user: any) => user.email);
-
+    const bulkRemove = async (org: string, emails: string[], blocked: boolean) => {
       try {
-        const res = await usersService.bulkDelete(store.state.selectedOrganization.identifier, {
-          ids: userEmails,
-        });
+        const res = await usersService.bulkDelete(org, { ids: emails });
         const { successful, unsuccessful } = res.data;
 
         if (successful.length > 0 && unsuccessful.length === 0) {
           toast({
-            message: t("iam.user.deletedUsersSuccess", { count: successful.length }),
+            message: blocked
+              ? t("iam.user.blockedUsersSuccess", { count: successful.length })
+              : t("iam.user.deletedUsersSuccess", { count: successful.length }),
             variant: "success",
           });
         } else if (successful.length > 0 && unsuccessful.length > 0) {
+          const counts = { count: successful.length, failed: unsuccessful.length };
           toast({
-            message: t("iam.user.deletedUsersPartial", {
-              count: successful.length,
-              failed: unsuccessful.length,
-            }),
+            message: blocked
+              ? t("iam.user.blockedUsersPartial", counts)
+              : t("iam.user.deletedUsersPartial", counts),
             variant: "warning",
           });
         } else if (unsuccessful.length > 0) {
           toast({
-            message: t("iam.user.failedToDeleteUsers", { count: unsuccessful.length }),
+            message: blocked
+              ? t("iam.user.blockedUsersNotRemoved", { count: unsuccessful.length })
+              : t("iam.user.failedToDeleteUsers", { count: unsuccessful.length }),
             variant: "error",
           });
         }
+      } catch (err: any) {
+        if (err.response?.status != 403 || err?.status != 403) {
+          toast({
+            message: blocked
+              ? t("iam.user.blockedUsersNotRemoved", { count: emails.length })
+              : err.response?.data?.message || err?.message || t("iam.user.errorDeletingUsers"),
+            variant: "error",
+          });
+        }
+      }
+    };
 
+    const bulkBlock = async (org: string, emails: string[]) => {
+      if (await writeBlocks(org, emails)) await bulkRemove(org, emails, true);
+    };
+
+    const bulkDeleteUsers = async () => {
+      bulkDeleteLoading.value = true;
+      const org = store.state.selectedOrganization.identifier;
+      const blockable = selectedUsers.value.filter((u: any) => u.isDomainMapped);
+      const deletable = selectedUsers.value.filter((u: any) => !u.isDomainMapped);
+
+      try {
+        await Promise.all([
+          deletable.length > 0 &&
+            bulkRemove(
+              org,
+              deletable.map((u: any) => u.email),
+              false,
+            ),
+          blockable.length > 0 &&
+            bulkBlock(
+              org,
+              blockable.map((u: any) => u.email),
+            ),
+        ]);
         selectedUsers.value = [];
         confirmBulkDelete.value = false;
         await getOrgMembers(true);
         updateUserActions();
-      } catch (err: any) {
-        if (err.response?.status != 403 || err?.status != 403) {
-          toast({
-            message:
-              err.response?.data?.message || err?.message || t("iam.user.errorDeletingUsers"),
-            variant: "error",
-          });
-        }
       } finally {
         bulkDeleteLoading.value = false;
       }
     };
 
+    const bulkBlockCount = computed(
+      () => selectedUsers.value.filter((u: any) => u.isDomainMapped).length,
+    );
+
     const updateUserRole = (row: any) => {
       const dismiss = toast({
         variant: "loading",
@@ -1585,6 +1731,10 @@ export default defineComponent({
       deleteUserEmail,
       deleteUser,
       confirmDeleteAction,
+      confirmBlock,
+      blockUser,
+      blockUserEmail,
+      confirmBlockAction,
       confirmRevoke,
       revokeInvite,
       revokeInviteEmail,
@@ -1640,6 +1790,7 @@ export default defineComponent({
       bulkDeleteLoading,
       openBulkDeleteDialog,
       bulkDeleteUsers,
+      bulkBlockCount,
       rows,
       displayedRows,
       roleFilter,
diff --git a/web/src/components/ingestion/recommended/KubernetesConfig.spec.ts b/web/src/components/ingestion/recommended/KubernetesConfig.spec.ts
index 3a828dfe47..2fac5084ae 100644
--- a/web/src/components/ingestion/recommended/KubernetesConfig.spec.ts
+++ b/web/src/components/ingestion/recommended/KubernetesConfig.spec.ts
@@ -84,7 +84,7 @@ describe("kubernetesCard builder", () => {
     const card = await buildCard();
     expect(card.provider.name).toBe("Kubernetes");
     expect(card.provider.metaBadges).toEqual(["Logs", "Metrics", "Events", "Traces"]);
-    expect(card.steps.map((s) => s.id)).toEqual(["install", "instrument", "verify"]);
+    expect(card.steps.map((s) => s.id)).toEqual(["install", "instrument", "network", "verify"]);
     expect(card.detect).toMatchObject({
       streamType: "logs",
       streamName: "default",
@@ -220,6 +220,21 @@ describe("kubernetesCard builder", () => {
     expect(ebpf.inputs?.every((i) => i.default === "")).toBe(true);
   });
 
+  it("offers eBPF network flows as an optional upgrade that keeps trace selectors", async () => {
+    const step = (await buildCard()).steps.find((s) => s.id === "network")!;
+    expect(step.required).toBeUndefined();
+    expect(step.code?.raw).toBe(
+      [
+        "helm repo update openobserve",
+        "helm --namespace openobserve-collector upgrade o2c openobserve/openobserve-collector \\",
+        "  --version '>=0.8.0' --reset-then-reuse-values \\",
+        "  --set ebpf.enabled=true \\",
+        "  --set ebpf.network.enabled=true",
+      ].join("\n"),
+    );
+    expect(step.note).toContain("`127.0.0.1:8888`");
+  });
+
   it("drops the deprecated Go operator sidecar", async () => {
     const step = (await buildCard()).steps.find((s) => s.id === "instrument")!;
     const json = JSON.stringify(step);
@@ -247,6 +262,9 @@ describe("kubernetesCard builder", () => {
     expect(urls).toContain(
       "https://github.com/openobserve/openobserve-helm-chart/blob/main/charts/openobserve-collector/docs/traces.md#ebpf-tracing",
     );
+    expect(urls).toContain(
+      "https://github.com/openobserve/openobserve-helm-chart/blob/main/charts/openobserve-collector/docs/metrics.md#13-ebpf-network-flows",
+    );
   });
 
   it("carries troubleshooting guidance without markdown link syntax", async () => {
diff --git a/web/src/components/ingestion/recommended/LinuxConfig.spec.ts b/web/src/components/ingestion/recommended/LinuxConfig.spec.ts
index e79d9d51a1..8c8f067197 100644
--- a/web/src/components/ingestion/recommended/LinuxConfig.spec.ts
+++ b/web/src/components/ingestion/recommended/LinuxConfig.spec.ts
@@ -67,7 +67,7 @@ describe("linuxCard builder", () => {
     const card = linuxCard(SUBS, gt);
     expect(card.provider.name).toBe("Linux");
     expect(card.provider.metaBadges).toEqual(["Logs", "Metrics", "Traces"]);
-    expect(card.steps.map((s) => s.id)).toEqual(["install", "verify", "dashboard"]);
+    expect(card.steps.map((s) => s.id)).toEqual(["install", "network", "verify", "dashboard"]);
     // Host metrics fan out per metric, so detection is existence-based.
     expect(card.detect).toMatchObject({
       streamType: "metrics",
@@ -123,12 +123,32 @@ describe("linuxCard builder", () => {
     const card = linuxCard(SUBS, gt);
     expect(card.docLinks?.map((l) => l.url)).toEqual([
       "https://github.com/openobserve/agents/blob/main/obi.md",
+      "https://github.com/openobserve/agents/blob/main/obi.md#network-flows",
     ]);
-    expect(card.steps[1].note).toContain("traced app handles a request");
+    expect(card.steps.find((s) => s.id === "verify")!.note).toContain(
+      "traced app handles a request",
+    );
     // Detection stays on host metrics, tracing or not.
     expect(card.detect?.streamName).toBe("system_");
   });
 
+  it("offers network flows as an optional re-run that needs at least one CIDR", () => {
+    const step = linuxCard(SUBS, gt).steps.find((s) => s.id === "network")!;
+    expect(step.required).toBeUndefined();
+    expect(step.variantToggle).toBe(false);
+    expect(step.variants).toHaveLength(1);
+    const [flows] = step.variants!;
+    if ("variants" in flows) throw new Error("network flows must not be nested");
+    expect(flows.code.raw).toBe(`${BASE_INSTALL}{flags}`);
+    expect(flows.code.masked).not.toContain(SUBS.token);
+    expect(flows.inputs?.map((i) => [i.id, i.flag, i.default])).toEqual([
+      ["networkFlows", "--network-flows", ""],
+    ]);
+    expect(flows.requireOneOf?.ids).toEqual(["networkFlows"]);
+    // Re-running the installer replaces the config, so the note says how to keep tracing.
+    expect(flows.note).toContain("`--trace-*`");
+  });
+
   it("offers the uninstall command", () => {
     const uninstall = linuxCard(SUBS, gt).extras?.uninstall;
     expect(uninstall?.code.raw).toContain("/linux/uninstall.sh");
diff --git a/web/src/components/ingestion/setupCard/SetupCardRenderer.spec.ts b/web/src/components/ingestion/setupCard/SetupCardRenderer.spec.ts
index 3bbd417dfe..98d82b5464 100644
--- a/web/src/components/ingestion/setupCard/SetupCardRenderer.spec.ts
+++ b/web/src/components/ingestion/setupCard/SetupCardRenderer.spec.ts
@@ -747,6 +747,25 @@ describe("SetupCardRenderer — Linux install step tracing toggle", () => {
     expect(step().props("done")).toBe(true);
   });
 
+  it("shows the network flows command only once a CIDR is given, with no toggle", async () => {
+    wrapper = mountLinux();
+    const step = () => wrapper.find('[data-test="ai-step-network"]');
+    expect(step().find('[data-test="ai-variant-tabs"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="ai-variant-require-network"]').exists()).toBe(true);
+    expect(step().findComponent(OCodeBlock).exists()).toBe(false);
+
+    await type("networkFlows", "10.0.1.5/32=web1,0.0.0.0/0=other");
+    expect(wrapper.find('[data-test="ai-variant-require-network"]').exists()).toBe(false);
+    expect(
+      step()
+        .findComponent(OCodeBlock)
+        .props("code")
+        .endsWith(`${BASE_TAIL} --network-flows '10.0.1.5/32=web1,0.0.0.0/0=other'`),
+    ).toBe(true);
+    // The install step is untouched by the network field.
+    expect(installBlock().props("code").endsWith(BASE_TAIL)).toBe(true);
+  });
+
   it("leaves step-level inputs where they were (Kubernetes cluster name)", async () => {
     wrapper = mount(SetupCardRenderer, {
       props: { content: kubernetesCard(LINUX_SUBS, gt), subs: LINUX_SUBS },
@@ -775,7 +794,12 @@ describe("SetupCardRenderer — Kubernetes instrument step (nested toggle)", ()
 helm --namespace openobserve-collector upgrade o2c openobserve/openobserve-collector \\
   --version '>=0.6.0' --reset-then-reuse-values \\
   --set ebpf.enabled=true`;
-  const codes = () => wrapper.findAllComponents(OCodeBlock).map((b) => b.props("code") as string);
+  // Scoped to the instrument step: the network flows step below also runs `upgrade o2c`.
+  const codes = () =>
+    wrapper
+      .find('[data-test="ai-step-instrument"]')
+      .findAllComponents(OCodeBlock)
+      .map((b) => b.props("code") as string);
   const instrumentCode = () =>
     codes().find((c) => c.includes("kubectl annotate") || c.includes("upgrade o2c"));
   const field = (id: string) => wrapper.find(`[data-test="ai-input-${id}"]`);
diff --git a/web/src/components/ingestion/setupCard/content/kubernetes.ts b/web/src/components/ingestion/setupCard/content/kubernetes.ts
index 996a31c1a7..e2293554f7 100644
--- a/web/src/components/ingestion/setupCard/content/kubernetes.ts
+++ b/web/src/components/ingestion/setupCard/content/kubernetes.ts
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-// Kubernetes setup card: install → optionally instrument for traces (language libraries or eBPF) → verify.
+// Kubernetes setup card: install → optional traces (libraries or eBPF) → optional eBPF network flows → verify.
 //
 // Step 1 deliberately offers ONLY the two endpoint choices — external (reach
 // OpenObserve over the network) and internal (OpenObserve runs in this same
@@ -131,6 +131,16 @@ helm --namespace openobserve-collector upgrade o2c openobserve/openobserve-colle
   --version '>=0.6.0' --reset-then-reuse-values \\
   --set ebpf.enabled=true{flags}`;
 
+const EBPF_NETWORK_DOC_URL =
+  "https://github.com/openobserve/openobserve-helm-chart/blob/main/charts/openobserve-collector/docs/metrics.md#13-ebpf-network-flows";
+
+// Network flows arrive in chart 0.8.0. Reusing values keeps any trace selectors set above.
+const EBPF_NETWORK_UPGRADE = `helm repo update openobserve
+helm --namespace openobserve-collector upgrade o2c openobserve/openobserve-collector \\
+  --version '>=0.8.0' --reset-then-reuse-values \\
+  --set ebpf.enabled=true \\
+  --set ebpf.network.enabled=true`;
+
 const instrumentVariants = (t: TranslateFn): RichCardStepVariant[] =>
   LANGUAGES.map((l) => ({
     id: l.id,
@@ -268,6 +278,15 @@ export default function kubernetesCard(subs: CardSubstitutions, t: TranslateFn):
         completeOn: "copy",
         variants: instrumentChoices(t),
       },
+      {
+        id: "network",
+        titleKey: "ingestion.setupCard.k8sNetworkFlowsTitle",
+        descriptionKey: "ingestion.setupCard.k8sNetworkFlowsDesc",
+        chip: { kind: "editor", labelKey: "ingestion.setupCard.optionalLabel" },
+        completeOn: "copy",
+        code: { lang: "bash", raw: EBPF_NETWORK_UPGRADE },
+        note: t("ingestion.setupCard.k8sNetworkFlowsNote"),
+      },
       {
         id: "verify",
         titleKey: "ingestion.setupCard.verifyDataTitle",
@@ -348,6 +367,7 @@ kubectl get pods -n openobserve-collector`,
         url: "https://github.com/open-telemetry/opentelemetry-operator",
       },
       { label: t("ingestion.setupCard.ebpfTracingGuideLink"), url: EBPF_DOC_URL },
+      { label: t("ingestion.setupCard.ebpfNetworkFlowsGuideLink"), url: EBPF_NETWORK_DOC_URL },
     ],
   };
 }
diff --git a/web/src/components/ingestion/setupCard/content/linux.ts b/web/src/components/ingestion/setupCard/content/linux.ts
index 468260439d..8910af9fc4 100644
--- a/web/src/components/ingestion/setupCard/content/linux.ts
+++ b/web/src/components/ingestion/setupCard/content/linux.ts
@@ -34,6 +34,8 @@ const install = `curl -O ${AGENTS_REPO}/linux/install.sh \\
   && sudo ./install.sh {url}/api/{org}/ {token}`;
 
 const TRACING_DOC_URL = "https://github.com/openobserve/agents/blob/main/obi.md";
+const NETWORK_FLOWS_DOC_URL =
+  "https://github.com/openobserve/agents/blob/main/obi.md#network-flows";
 
 export default function linuxCard(subs: CardSubstitutions, t: TranslateFn): RichCardContent {
   return {
@@ -108,6 +110,37 @@ export default function linuxCard(subs: CardSubstitutions, t: TranslateFn): Rich
         ],
         note: t("ingestion.setupCard.anyLinuxHostNote"),
       },
+      {
+        id: "network",
+        titleKey: "ingestion.setupCard.linuxNetworkFlowsTitle",
+        descriptionKey: "ingestion.setupCard.linuxNetworkFlowsDesc",
+        chip: { kind: "editor", labelKey: "ingestion.setupCard.optionalLabel" },
+        completeOn: "copy",
+        // One untoggled variant: only variants get {flags} and requireOneOf.
+        variantToggle: false,
+        variants: [
+          {
+            id: "network-flows",
+            code: agentCode(`${install}{flags}`, subs, "bash"),
+            inputs: [
+              {
+                id: "networkFlows",
+                flag: "--network-flows",
+                labelKey: "ingestion.setupCard.networkFlowsLabel",
+                default: "",
+                placeholder: raw("10.0.1.5/32=web1,10.0.2.0/24=db,0.0.0.0/0=other"),
+                helpKey: "ingestion.setupCard.networkFlowsHelp",
+              },
+            ],
+            // The installer requires a value: the CIDRs are what give flows an identity.
+            requireOneOf: {
+              ids: ["networkFlows"],
+              messageKey: "ingestion.setupCard.networkFlowsRequired",
+            },
+            note: t("ingestion.setupCard.linuxNetworkFlowsNote"),
+          },
+        ],
+      },
       {
         id: "verify",
         titleKey: "ingestion.setupCard.verifyDataTitle",
@@ -139,7 +172,10 @@ sudo journalctl -u openobserve-agent -n 50 --no-pager`,
       uninstall: agentUninstall("linux"),
     },
     docUrl: "https://github.com/openobserve/agents",
-    // Step notes can't link externally, so the tracing guide is a footer link.
-    docLinks: [{ label: t("ingestion.setupCard.ebpfTracingGuideLink"), url: TRACING_DOC_URL }],
+    // Step notes can't link externally, so the eBPF guides are footer links.
+    docLinks: [
+      { label: t("ingestion.setupCard.ebpfTracingGuideLink"), url: TRACING_DOC_URL },
+      { label: t("ingestion.setupCard.ebpfNetworkFlowsGuideLink"), url: NETWORK_FLOWS_DOC_URL },
+    ],
   };
 }
diff --git a/web/src/components/ingestion/setupCard/content/osAgent.spec.ts b/web/src/components/ingestion/setupCard/content/osAgent.spec.ts
index bd6bfd93f1..62e8e398ec 100644
--- a/web/src/components/ingestion/setupCard/content/osAgent.spec.ts
+++ b/web/src/components/ingestion/setupCard/content/osAgent.spec.ts
@@ -60,13 +60,14 @@ describe("dashboardReadyStep", () => {
 
 describe("host agent cards include the dashboard step", () => {
   it.each([
-    ["linux", linuxCard],
-    ["windows", windowsCard],
-    ["macos", macosCard],
-  ])("%s card ends install → verify → dashboard", (_name, builder: any) => {
+    // Linux has an optional network flows step between install and verify.
+    ["linux", linuxCard, ["install", "network", "verify", "dashboard"]],
+    ["windows", windowsCard, ["install", "verify", "dashboard"]],
+    ["macos", macosCard, ["install", "verify", "dashboard"]],
+  ])("%s card ends verify → dashboard", (_name, builder: any, ids: string[]) => {
     const card = builder(SUBS, gt);
-    expect(card.steps.map((s: any) => s.id)).toEqual(["install", "verify", "dashboard"]);
-    expect(card.steps[2].completeOn).toBe("detect");
+    expect(card.steps.map((s: any) => s.id)).toEqual(ids);
+    expect(card.steps.at(-1).completeOn).toBe("detect");
   });
 });
 
diff --git a/web/src/components/queryHistory/RecentSearchesButton.spec.ts b/web/src/components/queryHistory/RecentSearchesButton.spec.ts
new file mode 100644
index 0000000000..1d3d21a732
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesButton.spec.ts
@@ -0,0 +1,37 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import { mount } from "@vue/test-utils";
+import store from "@/test/unit/helpers/store";
+
+vi.mock("@/services/query_history", () => ({
+  default: { list: vi.fn().mockResolvedValue({ data: [] }) },
+}));
+
+import RecentSearchesButton from "./RecentSearchesButton.vue";
+
+describe("RecentSearchesButton", () => {
+  it("puts a caller's class on the clock button, since the popover renders no element", () => {
+    const wrapper = mount(RecentSearchesButton, {
+      props: { source: "logs", dataTest: "clock" },
+      attrs: { class: "me-1" },
+      global: { plugins: [store], stubs: { RecentSearchesPopover: true, OTooltip: true } },
+    });
+    const button = wrapper.find('[data-test="clock"]');
+    expect(button.exists()).toBe(true);
+    expect(button.classes()).toContain("me-1");
+  });
+});
diff --git a/web/src/components/queryHistory/RecentSearchesButton.vue b/web/src/components/queryHistory/RecentSearchesButton.vue
new file mode 100644
index 0000000000..22e8f778ff
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesButton.vue
@@ -0,0 +1,112 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <OPopover
+    v-if="enabled"
+    v-model:open="open"
+    side="bottom"
+    align="end"
+    :aria-label="t('recentSearches.title')"
+    @open-auto-focus="focusList"
+    @pointer-down-outside="keepForDetails"
+    @focus-outside="keepForDetails"
+  >
+    <template #trigger>
+      <OButton
+        variant="outline"
+        size="icon-toolbar"
+        icon-left="history"
+        v-bind="$attrs"
+        :aria-label="t('recentSearches.title')"
+        :data-test="dataTest"
+        @keydown="onTriggerKeydown"
+      >
+        <OTooltip :content="t('recentSearches.title')" />
+      </OButton>
+    </template>
+    <RecentSearchesPopover
+      ref="popoverRef"
+      :source="source"
+      :active="open"
+      :examples="examples"
+      @run="(entry, when) => close(() => emit('run', entry, when))"
+      @load="(entry, when) => close(() => emit('load', entry, when))"
+      @view-all="(status) => close(() => emit('view-all', status))"
+      @example="(query) => close(() => emit('example', query))"
+      @close="open = false"
+    />
+  </OPopover>
+</template>
+
+<script setup lang="ts">
+import { ref } from "vue";
+import { useI18nTyped } from "@/types/i18n";
+import { useRecentSearches } from "@/composables/queryHistory/useRecentSearches";
+import type { HistorySource, HistoryStatus, QueryHistoryEntry } from "@/services/query_history";
+import type { RestoreTime } from "@/utils/queryHistory/recentSearches";
+import RecentSearchesPopover from "./RecentSearchesPopover.vue";
+import OPopover from "@/lib/overlay/Popover/OPopover.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+
+// OPopover renders no element of its own, so a caller's class and attributes go on the trigger.
+defineOptions({ inheritAttrs: false });
+
+withDefaults(
+  defineProps<{
+    source: HistorySource;
+    examples?: string[];
+    dataTest?: string;
+  }>(),
+  { examples: () => [], dataTest: "recent-searches-btn" },
+);
+
+const emit = defineEmits<{
+  run: [entry: QueryHistoryEntry, when: RestoreTime];
+  load: [entry: QueryHistoryEntry, when: RestoreTime];
+  "view-all": [status: HistoryStatus | null];
+  example: [query: string];
+}>();
+
+const { t } = useI18nTyped();
+const { enabled } = useRecentSearches();
+const open = ref(false);
+const popoverRef = ref<InstanceType<typeof RecentSearchesPopover> | null>(null);
+
+// Focus can stay on the clock button after opening, and the list's keys must still reach the rows.
+const onTriggerKeydown = (event: KeyboardEvent) => {
+  if (open.value && popoverRef.value?.handleOutsideKey(event)) event.preventDefault();
+};
+
+// The details pane is teleported outside the popover's content, so reka counts a click in it as outside.
+const keepForDetails = (event: Event) => {
+  const original = (event as CustomEvent<{ originalEvent?: Event }>).detail?.originalEvent;
+  const target = (original?.target ?? event.target) as Node | null;
+  if (popoverRef.value?.ownsNode(target)) event.preventDefault();
+};
+
+// OPopover would focus the info button, where Enter opens nothing and the hovered row never runs.
+const focusList = (event: Event) => {
+  event.preventDefault();
+  popoverRef.value?.focusRoot();
+};
+
+const close = (then: () => void) => {
+  open.value = false;
+  then();
+};
+</script>
diff --git a/web/src/components/queryHistory/RecentSearchesDayPicker.spec.ts b/web/src/components/queryHistory/RecentSearchesDayPicker.spec.ts
new file mode 100644
index 0000000000..721ae41c4f
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesDayPicker.spec.ts
@@ -0,0 +1,129 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { enableAutoUnmount, flushPromises, mount } from "@vue/test-utils";
+import { DateTime } from "luxon";
+import i18n from "@/locales";
+import RecentSearchesDayPicker from "./RecentSearchesDayPicker.vue";
+
+enableAutoUnmount(afterEach);
+
+const mountPicker = (modelValue?: string, zone?: string) =>
+  mount(RecentSearchesDayPicker, {
+    props: {
+      modelValue,
+      zone,
+      placeholder: "dd/mm/yyyy",
+      fieldLabel: "Filter by date run",
+      dataTest: "ran-on",
+    },
+    attachTo: document.body,
+    global: { plugins: [i18n] },
+  });
+
+const cell = (iso: string) =>
+  document.querySelector<HTMLElement>(`[data-test="daterangecalendar-cell-${iso}"]`);
+
+const openCalendar = async (wrapper: ReturnType<typeof mountPicker>) => {
+  await wrapper.find('[data-test="ran-on-trigger"]').trigger("click");
+  await flushPromises();
+};
+
+describe("RecentSearchesDayPicker", () => {
+  it("reads as a date field: the dd/mm/yyyy placeholder, then the chosen day in that format", () => {
+    const empty = mountPicker();
+    const emptyValue = empty.find('[data-test="ran-on-value"]');
+    expect(emptyValue.text()).toBe("dd/mm/yyyy");
+    expect(emptyValue.classes()).toContain("text-input-placeholder");
+    expect(empty.find('[data-test="ran-on-trigger"]').attributes("aria-label")).toBe(
+      "Filter by date run",
+    );
+    const picked = mountPicker("2026-10-29").find('[data-test="ran-on-value"]');
+    expect(picked.text()).toBe("29/10/2026");
+    expect(picked.classes()).toContain("text-input-text");
+  });
+
+  it("opens the shared range calendar and picks one day with a single click", async () => {
+    const wrapper = mountPicker();
+    await openCalendar(wrapper);
+    expect(document.querySelector('[data-test="daterangecalendar-root"]')).not.toBeNull();
+    const today = DateTime.local().toISODate()!;
+    cell(today)!.click();
+    await flushPromises();
+    expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([today]);
+    expect(document.querySelector('[data-test="ran-on-calendar"]')).toBeNull();
+  });
+
+  it("marks the chosen day selected and keeps days after today unavailable", async () => {
+    const today = DateTime.local();
+    const wrapper = mountPicker(today.toISODate()!);
+    await openCalendar(wrapper);
+    expect(cell(today.toISODate()!)?.hasAttribute("data-selected")).toBe(true);
+    const later = [
+      ...document.querySelectorAll<HTMLElement>('[data-test^="daterangecalendar-cell-"]'),
+    ].filter((el) => el.dataset.test!.replace("daterangecalendar-cell-", "") > today.toISODate()!);
+    later.forEach((el) => expect(el.hasAttribute("data-disabled")).toBe(true));
+  });
+
+  it("offers the new day after midnight without a remount", async () => {
+    vi.useFakeTimers({ toFake: ["Date"] });
+    try {
+      vi.setSystemTime(new Date(2026, 9, 28, 23, 59));
+      const wrapper = mountPicker();
+      await openCalendar(wrapper);
+      expect(cell("2026-10-29")?.hasAttribute("data-disabled")).toBe(true);
+      await wrapper.find('[data-test="ran-on-trigger"]').trigger("click");
+      await flushPromises();
+      vi.setSystemTime(new Date(2026, 9, 29, 0, 1));
+      await openCalendar(wrapper);
+      expect(cell("2026-10-29")?.hasAttribute("data-disabled")).toBe(false);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("ends the pickable days at today in the given timezone", async () => {
+    vi.useFakeTimers({ toFake: ["Date"] });
+    try {
+      vi.setSystemTime(new Date(Date.UTC(2026, 9, 28, 20, 0)));
+      await openCalendar(mountPicker(undefined, "Asia/Kolkata"));
+      expect(cell("2026-10-29")?.hasAttribute("data-disabled")).toBe(false);
+      expect(cell("2026-10-30")?.hasAttribute("data-disabled")).toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("joins the field and its clear button in a button group, without overriding the buttons' box", () => {
+    const wrapper = mountPicker("2026-10-27");
+    const group = wrapper.find('[data-test="ran-on"]');
+    expect(group.attributes("role")).toBe("group");
+    const buttons = group.findAll(":scope > button");
+    expect(buttons.map((b) => b.attributes("data-test"))).toEqual([
+      "ran-on-trigger",
+      "ran-on-clear",
+    ]);
+    const forced = /^(h|rounded|border)(-\S*)?!$/;
+    buttons.forEach((b) => expect(b.classes().filter((c) => forced.test(c))).toEqual([]));
+  });
+
+  it("clears the day with its own button, shown only while a day is set", async () => {
+    expect(mountPicker().find('[data-test="ran-on-clear"]').exists()).toBe(false);
+    const wrapper = mountPicker("2026-10-27");
+    await wrapper.find('[data-test="ran-on-clear"]').trigger("click");
+    expect(wrapper.emitted("update:modelValue")?.at(-1)).toEqual([undefined]);
+  });
+});
diff --git a/web/src/components/queryHistory/RecentSearchesDayPicker.vue b/web/src/components/queryHistory/RecentSearchesDayPicker.vue
new file mode 100644
index 0000000000..aa65d115d0
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesDayPicker.vue
@@ -0,0 +1,136 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <OButtonGroup
+    class="border-input-border bg-input-bg hover:border-input-border-hover border"
+    :data-test="dataTest"
+  >
+    <OPopover
+      v-model:open="open"
+      side="bottom"
+      align="start"
+      :aria-label="fieldLabel"
+      content-class="p-1 shadow-lg!"
+      @open-auto-focus="focusDay"
+    >
+      <template #trigger>
+        <OButton
+          variant="ghost"
+          size="xs"
+          class="min-w-36"
+          :aria-label="fieldLabel"
+          :data-test="`${dataTest}-trigger`"
+        >
+          <span
+            :class="modelValue ? 'text-input-text' : 'text-input-placeholder'"
+            class="ms-0.5 flex-1 text-left text-sm font-normal tabular-nums"
+            :data-test="`${dataTest}-value`"
+            >{{ label }}</span
+          >
+          <template #icon-right>
+            <OIcon name="calendar-month" size="sm" class="text-input-hint ms-auto me-0.5" />
+          </template>
+        </OButton>
+      </template>
+      <div
+        ref="calendarRef"
+        class="flex justify-center px-3 py-2"
+        :data-test="`${dataTest}-calendar`"
+      >
+        <ODateRangeCalendar
+          :start-date="selectedDay"
+          :end-date="selectedDay"
+          :min-date="MIN_DAY"
+          :max-date="today"
+          @update:pending-date="pick"
+        />
+      </div>
+    </OPopover>
+    <OButton
+      v-if="modelValue"
+      variant="ghost"
+      size="icon-xs-sq"
+      icon-left="close"
+      :aria-label="t('common.clearFilter')"
+      :data-test="`${dataTest}-clear`"
+      @click="emit('update:modelValue', undefined)"
+    />
+  </OButtonGroup>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { DateTime } from "luxon";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OPopover from "@/lib/overlay/Popover/OPopover.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OButtonGroup from "@/lib/core/Button/OButtonGroup.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import ODateRangeCalendar from "@/lib/forms/DateTimeRange/ODateRangeCalendar.vue";
+
+const MIN_DAY = "1999/01/01";
+
+const props = defineProps<{
+  /** The chosen day as YYYY-MM-DD, or undefined for any day. */
+  modelValue?: string;
+  /** Shown when no day is chosen, in the format the field displays. */
+  placeholder: I18nText;
+  fieldLabel: I18nText;
+  dataTest: string;
+  /** Timezone whose today is the last pickable day; the browser's when unset. */
+  zone?: string;
+}>();
+
+const emit = defineEmits<{
+  "update:modelValue": [day: string | undefined];
+}>();
+
+const { t } = useI18nTyped();
+const open = ref(false);
+const calendarRef = ref<HTMLElement | null>(null);
+
+const todayText = () =>
+  (props.zone ? DateTime.now().setZone(props.zone) : DateTime.local()).toFormat("yyyy/MM/dd");
+const today = ref(todayText());
+// Read on every open, so a drawer left open past midnight still offers the new day.
+watch(open, (isOpen) => {
+  if (isOpen) today.value = todayText();
+});
+// The calendar speaks the app's YYYY/MM/DD; the filter keeps YYYY-MM-DD.
+const selectedDay = computed(() => props.modelValue?.replace(/-/g, "/"));
+const label = computed(() => {
+  if (!props.modelValue) return props.placeholder;
+  return raw(DateTime.fromISO(props.modelValue).toFormat("dd/MM/yyyy"));
+});
+
+// Arrow keys and Enter work only from a day cell, so open on the chosen day, else today.
+const focusDay = (event: Event) => {
+  const day =
+    calendarRef.value?.querySelector<HTMLElement>("[data-selected]") ??
+    calendarRef.value?.querySelector<HTMLElement>("[data-today]");
+  if (!day) return;
+  event.preventDefault();
+  day.focus();
+};
+
+// A first click on the range calendar is one complete day for this filter.
+const pick = (day: string | null) => {
+  if (!day) return;
+  emit("update:modelValue", day.replace(/\//g, "-"));
+  open.value = false;
+};
+</script>
diff --git a/web/src/components/queryHistory/RecentSearchesDetails.vue b/web/src/components/queryHistory/RecentSearchesDetails.vue
new file mode 100644
index 0000000000..cff8aafe12
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesDetails.vue
@@ -0,0 +1,321 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <Teleport to="body">
+    <div
+      v-if="place"
+      ref="paneRef"
+      class="bg-select-content-bg border-dropdown-border rounded-default text-select-item-text fixed flex flex-col overflow-hidden border shadow-lg"
+      :style="paneStyle"
+      data-test="recent-searches-details"
+      @pointerenter="onEnter"
+      @pointerleave="onLeave"
+      @focusout="onFocusOut"
+      @keydown="onKeydown"
+    >
+      <div class="relative flex min-h-0 flex-1 flex-col">
+        <pre
+          ref="queryRef"
+          class="m-0 min-h-0 flex-1 overflow-auto p-2 font-mono text-xs wrap-anywhere whitespace-pre-wrap"
+          data-test="recent-searches-details-query"
+          @scroll="updateFade"
+          >{{ entry.query }}</pre>
+        <div
+          v-if="moreBelow"
+          class="from-select-content-bg pointer-events-none absolute inset-x-0 bottom-0 h-8 bg-linear-to-t to-transparent"
+          data-test="recent-searches-details-fade"
+        />
+      </div>
+      <div
+        v-if="vrl"
+        class="border-border-subtle flex max-h-32 shrink-0 flex-col border-t"
+        data-test="recent-searches-details-function"
+      >
+        <div class="flex shrink-0 items-center gap-2 ps-2 pe-1 pt-1">
+          <span class="text-text-secondary text-2xs flex-1 font-semibold uppercase">{{
+            t("recentSearches.functionLabel")
+          }}</span>
+          <OButton
+            variant="ghost"
+            size="icon-xs"
+            icon-left="content-copy"
+            :aria-label="t('recentSearches.copyFunction')"
+            data-test="recent-searches-details-copy-function"
+            @click="copyFunction"
+          >
+            <OTooltip :content="t('recentSearches.copyFunction')" />
+          </OButton>
+        </div>
+        <pre
+          class="m-0 min-h-0 overflow-auto px-2 pb-2 font-mono text-xs wrap-anywhere whitespace-pre-wrap"
+          data-test="recent-searches-details-function-text"
+          >{{ vrl }}</pre>
+      </div>
+      <div
+        class="bg-select-content-bg border-border-subtle flex shrink-0 flex-col gap-1 border-t px-2 py-1"
+        data-test="recent-searches-details-footer"
+      >
+        <div class="flex min-w-0 items-center gap-2">
+          <div
+            class="text-text-secondary text-2xs flex min-w-0 flex-1 flex-wrap gap-x-2"
+            data-test="recent-searches-details-meta"
+          >
+            <span data-test="recent-searches-details-lines">{{
+              t("recentSearches.lineCount", { count: lineCount }, lineCount)
+            }}</span>
+            <span v-if="entry.streams.length">{{ entry.streams.join(", ") }}</span>
+            <span v-if="windowText(entry)">{{ windowText(entry) }}</span>
+            <span>{{ spanText(entry) }}</span>
+            <span v-if="entry.status === 'error'" class="text-status-error-text">{{
+              t("recentSearches.failed")
+            }}</span>
+          </div>
+          <OButton
+            variant="ghost"
+            size="icon-xs"
+            icon-left="content-copy"
+            class="shrink-0"
+            :aria-label="t('recentSearches.copyQuery')"
+            data-test="recent-searches-details-copy"
+            @click="copyQuery"
+          >
+            <OTooltip :content="t('recentSearches.copyQuery')" />
+          </OButton>
+        </div>
+        <div
+          v-if="entry.status === 'error' && entry.context.error"
+          class="text-status-error-text text-2xs max-h-16 overflow-auto wrap-anywhere whitespace-pre-wrap"
+          data-test="recent-searches-details-error"
+        >
+          {{ entry.context.error }}
+        </div>
+      </div>
+    </div>
+  </Teleport>
+</template>
+
+<script setup lang="ts">
+import { computed, nextTick, onBeforeUnmount, onMounted, ref, watch } from "vue";
+import { useI18nTyped } from "@/types/i18n";
+import { useRecentEntryText } from "@/composables/queryHistory/useRecentEntryText";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { copyToClipboard } from "@/utils/clipboard";
+import { logsEntryFunction } from "@/utils/queryHistory/logs";
+import { observeMoves } from "@/utils/queryHistory/observeMoves";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+
+const WIDTH_PX = 400;
+const WIDE_WIDTH_PX = 560;
+const WIDE_AFTER_LINES = 18;
+const MAX_HEIGHT_PX = 320;
+const GAP_PX = 4;
+const VIEWPORT_GAP_PX = 8;
+const Z_INDEX = 10050;
+const PAGE_OVERLAP_PX = 16;
+
+const props = defineProps<{
+  entry: QueryHistoryEntry;
+  anchor: HTMLElement | null;
+}>();
+
+const emit = defineEmits<{
+  enter: [];
+  leave: [event: PointerEvent];
+  /** Focus left the pane, for the node it went to. */
+  "focus-leave": [to: Node | null];
+  /** Shift+Tab out of the pane, back to the row it details. */
+  back: [];
+  escape: [];
+}>();
+
+const { t } = useI18nTyped();
+const { windowText, spanText } = useRecentEntryText();
+const paneRef = ref<HTMLElement | null>(null);
+const queryRef = ref<HTMLElement | null>(null);
+const pointerInside = ref(false);
+
+const onEnter = () => {
+  pointerInside.value = true;
+  emit("enter");
+};
+
+const onLeave = (event: PointerEvent) => {
+  pointerInside.value = false;
+  emit("leave", event);
+};
+
+const onFocusOut = (event: FocusEvent) => {
+  const to = event.relatedTarget as Node | null;
+  if (!paneRef.value?.contains(to)) emit("focus-leave", to);
+};
+
+// The pane is teleported after the whole page, so the browser's own Shift+Tab would leave the list.
+const onKeydown = (event: KeyboardEvent) => {
+  if (event.key === "Tab" && event.shiftKey) {
+    event.preventDefault();
+    emit("back");
+  } else if (event.key === "Escape") {
+    event.preventDefault();
+    emit("escape");
+  }
+};
+
+const lineCount = computed(() => props.entry.query.split("\n").length);
+const vrl = computed(() => logsEntryFunction(props.entry));
+const wantedWidth = computed(() => (lineCount.value > WIDE_AFTER_LINES ? WIDE_WIDTH_PX : WIDTH_PX));
+
+interface Place {
+  top: number;
+  left: number;
+  width: number;
+  maxHeight: number;
+  beside: boolean;
+}
+const place = ref<Place | null>(null);
+
+const paneStyle = computed(() => {
+  const at = place.value;
+  if (!at) return {};
+  return {
+    top: `${at.top}px`,
+    left: `${at.left}px`,
+    width: `${at.width}px`,
+    maxHeight: `${at.maxHeight}px`,
+    zIndex: Z_INDEX,
+  };
+});
+
+const compute = (): Place | null => {
+  const box = props.anchor?.getBoundingClientRect();
+  if (!box) return null;
+  const roomRight = window.innerWidth - VIEWPORT_GAP_PX - (box.right + GAP_PX);
+  const roomLeft = box.left - GAP_PX - VIEWPORT_GAP_PX;
+  const sideTop = Math.max(VIEWPORT_GAP_PX, box.top);
+  const sideMaxHeight = Math.min(MAX_HEIGHT_PX, window.innerHeight - 2 * VIEWPORT_GAP_PX);
+  if (roomRight >= WIDTH_PX) {
+    const width = Math.min(wantedWidth.value, roomRight);
+    return {
+      top: sideTop,
+      left: box.right + GAP_PX,
+      width,
+      maxHeight: sideMaxHeight,
+      beside: true,
+    };
+  }
+  if (roomLeft >= WIDTH_PX) {
+    const width = Math.min(wantedWidth.value, roomLeft);
+    const left = box.left - GAP_PX - width;
+    return { top: sideTop, left, width, maxHeight: sideMaxHeight, beside: true };
+  }
+  const width = Math.min(wantedWidth.value, window.innerWidth - 2 * VIEWPORT_GAP_PX);
+  const left = Math.max(
+    VIEWPORT_GAP_PX,
+    Math.min(box.left, window.innerWidth - VIEWPORT_GAP_PX - width),
+  );
+  const top = box.bottom + GAP_PX;
+  const maxHeight = Math.min(MAX_HEIGHT_PX, window.innerHeight - top - VIEWPORT_GAP_PX);
+  return maxHeight > 0 ? { top, left, width, maxHeight, beside: false } : null;
+};
+
+const liftIntoView = () => {
+  const at = place.value;
+  const height = paneRef.value?.offsetHeight ?? 0;
+  if (!at?.beside || !height) return;
+  const overflow = at.top + height - (window.innerHeight - VIEWPORT_GAP_PX);
+  if (overflow > 0) place.value = { ...at, top: Math.max(VIEWPORT_GAP_PX, at.top - overflow) };
+};
+
+const moreBelow = ref(false);
+const updateFade = () => {
+  const el = queryRef.value;
+  moreBelow.value = !!el && el.scrollTop + el.clientHeight < el.scrollHeight - 1;
+};
+
+const reposition = () => {
+  place.value = compute();
+  nextTick(() => {
+    liftIntoView();
+    updateFade();
+  });
+};
+
+let placedKey = "";
+let stopObserving: (() => void) | null = null;
+const anchorKey = () => {
+  const box = props.anchor?.getBoundingClientRect();
+  if (!box) return "";
+  return `${box.left}|${box.top}|${box.right}|${box.bottom}|${window.innerWidth}|${window.innerHeight}`;
+};
+// The list moves with the caret, the page and the popover; only a real move re-places the pane.
+const follow = () => {
+  const key = anchorKey();
+  if (key === placedKey) return;
+  placedKey = key;
+  reposition();
+};
+
+watch(
+  () => props.entry,
+  () => {
+    if (queryRef.value) queryRef.value.scrollTop = 0;
+    reposition();
+  },
+);
+
+onMounted(() => {
+  placedKey = anchorKey();
+  reposition();
+  if (props.anchor) stopObserving = observeMoves(props.anchor, follow);
+});
+
+onBeforeUnmount(() => stopObserving?.());
+
+const copyQuery = () =>
+  copyToClipboard(props.entry.query, t, { successMessage: t("recentSearches.queryCopied") });
+
+const copyFunction = () =>
+  copyToClipboard(vrl.value, t, { successMessage: t("recentSearches.functionCopied") });
+
+/** Scrolls the query one page down (1) or up (-1); false when there is nothing to scroll. */
+const scrollPage = (step: 1 | -1) => {
+  const el = queryRef.value;
+  if (!el) return false;
+  el.scrollTop += step * Math.max(el.clientHeight - PAGE_OVERLAP_PX, PAGE_OVERLAP_PX);
+  updateFade();
+  return true;
+};
+
+/** Whether a node is inside the pane, which lives outside the list's own DOM. */
+const contains = (node: Node | null) => !!node && !!paneRef.value?.contains(node);
+
+const hasFocus = () => contains(document.activeElement);
+
+const hasPointer = () => pointerInside.value;
+
+/** Moves keyboard focus to the Copy button; false when the pane is not shown. */
+const focusCopy = () => {
+  const button = paneRef.value?.querySelector<HTMLElement>(
+    '[data-test="recent-searches-details-copy"]',
+  );
+  if (!button) return false;
+  button.focus();
+  return true;
+};
+
+defineExpose({ scrollPage, contains, hasFocus, hasPointer, focusCopy });
+</script>
diff --git a/web/src/components/queryHistory/RecentSearchesDrawer.spec.ts b/web/src/components/queryHistory/RecentSearchesDrawer.spec.ts
new file mode 100644
index 0000000000..5e126292b8
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesDrawer.spec.ts
@@ -0,0 +1,720 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { enableAutoUnmount, flushPromises, mount } from "@vue/test-utils";
+import { nextTick } from "vue";
+import store from "@/test/unit/helpers/store";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { b64EncodeUnicode } from "@/utils/formatters";
+
+const api = vi.hoisted(() => ({
+  list: vi.fn(),
+  record: vi.fn(),
+  star: vi.fn(),
+  remove: vi.fn(),
+  clear: vi.fn(),
+  count: vi.fn(),
+}));
+vi.mock("@/services/query_history", () => ({ default: api }));
+
+const clipboard = vi.hoisted(() => ({ copyToClipboard: vi.fn() }));
+vi.mock("@/utils/clipboard", () => clipboard);
+
+const push = vi.hoisted(() => vi.fn());
+vi.mock("vue-router", () => ({
+  useRouter: () => ({
+    push,
+    resolve: (to: { path: string; query: Record<string, string> }) => ({
+      href: `/web${to.path}?${new URLSearchParams(to.query).toString()}`,
+    }),
+  }),
+}));
+
+import i18n from "@/locales";
+import RecentSearchesDrawer from "./RecentSearchesDrawer.vue";
+import { dismissAll, pauseTimer, toastRecords } from "@/lib/feedback/Toast/useToast";
+
+enableAutoUnmount(afterEach);
+
+const NOW_US = Date.now() * 1000;
+const DAY_US = 86_400_000_000;
+
+const row = (id: string, overrides: Partial<QueryHistoryEntry> = {}): QueryHistoryEntry => ({
+  id,
+  source: "logs",
+  query: `query ${id}`,
+  query_key: "k",
+  streams: ["k8s"],
+  context: { time: { type: "relative", period: "15m", start_time: 1, end_time: 2 } },
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: NOW_US,
+  updated_at: NOW_US,
+  ...overrides,
+});
+
+const input = (name: string) => ({
+  props: ["modelValue"],
+  emits: ["update:modelValue"],
+  template: `<input data-stub="${name}" :value="modelValue" @input="$emit('update:modelValue', $event.target.value)" />`,
+});
+
+const mountDrawer = (open = true) =>
+  mount(RecentSearchesDrawer, {
+    props: { source: "logs", open },
+    global: {
+      plugins: [store],
+      stubs: {
+        ODrawer: {
+          props: ["open"],
+          template: `<div v-if="open"><slot name="header-left" /><slot /><slot name="footer" /></div>`,
+        },
+        ODialog: {
+          props: ["open"],
+          emits: ["click:primary", "click:secondary"],
+          template: `<div v-if="open" data-test="dialog"><slot />
+            <button data-test="dialog-confirm" @click="$emit('click:primary')" /></div>`,
+        },
+        // The real menu is portalled, so its clicks never reach the row.
+        ODropdown: { template: `<div @click.stop><slot name="trigger" /><slot /></div>` },
+        ODropdownItem: {
+          emits: ["select"],
+          template: `<button v-bind="$attrs" @click="$emit('select')"><slot /></button>`,
+        },
+        OSearchInput: input("search"),
+        OSelect: input("select"),
+        RecentSearchesDayPicker: input("date"),
+        OSwitch: {
+          props: ["modelValue"],
+          emits: ["update:modelValue"],
+          template: `<input type="checkbox" :checked="modelValue" @change="$emit('update:modelValue', $event.target.checked)" />`,
+        },
+        OCheckbox: {
+          props: ["modelValue"],
+          emits: ["update:modelValue"],
+          template: `<input type="checkbox" :checked="modelValue" @change="$emit('update:modelValue', $event.target.checked)" />`,
+        },
+        OToggleGroup: {
+          props: ["modelValue"],
+          emits: ["update:modelValue"],
+          template: `<div><button data-test="scope-all" @click="$emit('update:modelValue', 'all')" /><slot /></div>`,
+        },
+        OToggleGroupItem: { template: "<span><slot /></span>" },
+        OTimeCell: true,
+        OTooltip: true,
+      },
+    },
+  });
+
+const lastParams = () => api.list.mock.calls.at(-1)?.[1];
+
+describe("RecentSearchesDrawer", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    api.list.mockResolvedValue({
+      data: [row("today"), row("old", { updated_at: NOW_US - 3 * DAY_US, run_count: 4 })],
+    });
+    api.star.mockResolvedValue({ data: {} });
+    api.remove.mockResolvedValue({ data: {} });
+    api.clear.mockResolvedValue({ data: { deleted: 2 } });
+  });
+  afterEach(() => {
+    store.state.zoConfig.query_history_retention_days = undefined;
+  });
+
+  it("lists this page's rows grouped by day", async () => {
+    const wrapper = mountDrawer();
+    await flushPromises();
+    expect(lastParams()).toEqual({ source: "logs", limit: 50, offset: 0 });
+    const days = wrapper.findAll('[data-test="recent-searches-day"]');
+    expect(days).toHaveLength(2);
+    expect(days[0].text()).toContain("Today");
+    expect(days[1].text()).toContain("ran 4x");
+  });
+
+  it("sends every filter to the server", async () => {
+    const wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-stub="search"]').setValue("checkout");
+    const selects = wrapper.findAll('[data-stub="select"]');
+    await selects[0].setValue("k8s");
+    await selects[1].setValue("error");
+    await wrapper.find('[data-stub="date"]').setValue("2026-10-27");
+    await wrapper.find('[data-test="recent-searches-starred-only"]').setValue(true);
+    await flushPromises();
+    const bounds = {
+      ran_from: new Date(2026, 9, 27).getTime() * 1000,
+      ran_to: new Date(2026, 9, 28).getTime() * 1000 - 1,
+    };
+    expect(lastParams()).toEqual({
+      source: "logs",
+      q: "checkout",
+      stream: "k8s",
+      status: "error",
+      starred: true,
+      ...bounds,
+      limit: 50,
+      offset: 0,
+    });
+
+    await wrapper.find('[data-test="scope-all"]').trigger("click");
+    await flushPromises();
+    expect(lastParams().source).toBe("logs,traces,metrics");
+  });
+
+  describe("Reset filters", () => {
+    const RESET = '[data-test="recent-searches-reset-filters"]';
+    // Opened already filtered, so the unfiltered list is never cached and Reset must fetch it.
+    const mountFiltered = async () => {
+      const wrapper = mountDrawer(false);
+      wrapper.vm.show("error");
+      await wrapper.setProps({ open: true });
+      await flushPromises();
+      await wrapper.find('[data-stub="search"]').setValue("checkout");
+      await wrapper.findAll('[data-stub="select"]')[0].setValue("k8s");
+      await wrapper.find('[data-stub="date"]').setValue("2026-10-27");
+      await wrapper.find('[data-test="recent-searches-starred-only"]').setValue(true);
+      await flushPromises();
+      expect(api.list.mock.calls.every(([, params]) => params.status === "error")).toBe(true);
+      return wrapper;
+    };
+    const expectCleared = (wrapper: ReturnType<typeof mountDrawer>) => {
+      expect((wrapper.find('[data-stub="search"]').element as HTMLInputElement).value).toBe("");
+      const selects = wrapper.findAll('[data-stub="select"]');
+      expect((selects[0].element as HTMLInputElement).value).toBe("");
+      expect((selects[1].element as HTMLInputElement).value).toBe("all");
+      expect((wrapper.find('[data-stub="date"]').element as HTMLInputElement).value).toBe("");
+      expect(
+        (wrapper.find('[data-test="recent-searches-starred-only"]').element as HTMLInputElement)
+          .checked,
+      ).toBe(false);
+      expect(lastParams()).toEqual({ source: "logs", limit: 50, offset: 0 });
+      expect(wrapper.find(RESET).exists()).toBe(false);
+    };
+
+    it("is hidden with no filter and shows once any one filter is set", async () => {
+      const wrapper = mountDrawer();
+      await flushPromises();
+      expect(wrapper.find(RESET).exists()).toBe(false);
+      await wrapper.find('[data-stub="date"]').setValue("2026-10-27");
+      expect(wrapper.find(RESET).exists()).toBe(true);
+      await wrapper.find('[data-stub="date"]').setValue("");
+      await wrapper.findAll('[data-stub="select"]')[1].setValue("ok");
+      expect(wrapper.find(RESET).exists()).toBe(true);
+    });
+
+    it("clears all five filters and refetches unfiltered", async () => {
+      const wrapper = await mountFiltered();
+      await wrapper.find(RESET).trigger("click");
+      await flushPromises();
+      expectCleared(wrapper);
+    });
+
+    it("does the same from the filtered empty state", async () => {
+      api.list.mockResolvedValue({ data: [] });
+      const wrapper = await mountFiltered();
+      const empty = wrapper.find('[data-test="recent-searches-drawer-empty"]');
+      expect(empty.text()).toContain("No searches match these filters");
+      const button = empty.findAll("button").filter((b) => b.text().includes("Reset filters"));
+      expect(button).toHaveLength(1);
+      await button[0].trigger("click");
+      await flushPromises();
+      expectCleared(wrapper);
+    });
+  });
+
+  it("re-runs now on a row click from today, and at original time on demand", async () => {
+    const wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-test="recent-searches-drawer-row-today"]').trigger("click");
+    expect(wrapper.emitted("restore")?.[0]).toEqual([
+      expect.objectContaining({ id: "today" }),
+      "now",
+      true,
+    ]);
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+    await wrapper.setProps({ open: false });
+    await wrapper.setProps({ open: true });
+    await wrapper.find('[data-test="recent-searches-rerun-original-old"]').trigger("click");
+    expect(wrapper.emitted("restore")?.[1]?.slice(1)).toEqual(["original", true]);
+    await wrapper.setProps({ open: false });
+    await wrapper.setProps({ open: true });
+    await wrapper.find('[data-test="recent-searches-load-old"]').trigger("click");
+    expect(wrapper.emitted("restore")?.[2]?.slice(1)).toEqual(["original", false]);
+  });
+
+  it("stars, deletes and copies without restoring", async () => {
+    const wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-test="recent-searches-star-today"]').trigger("click");
+    await flushPromises();
+    expect(api.star).toHaveBeenCalledWith("default", "today", true);
+    await wrapper.find('[data-test="recent-searches-copy-query-old"]').trigger("click");
+    expect(clipboard.copyToClipboard).toHaveBeenLastCalledWith(
+      "query old",
+      expect.any(Function),
+      expect.any(Object),
+    );
+    await wrapper.find('[data-test="recent-searches-copy-link-today"]').trigger("click");
+    const link = clipboard.copyToClipboard.mock.calls.at(-1)?.[0] as string;
+    expect(link).toContain("/web/logs?");
+    expect(link).toContain("from=1");
+    expect(link).toContain("to=2");
+    vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
+    try {
+      await wrapper.find('[data-test="recent-searches-delete-old"]').trigger("click");
+      await flushPromises();
+      expect(wrapper.find('[data-test="recent-searches-drawer-row-old"]').exists()).toBe(false);
+      expect(api.remove).not.toHaveBeenCalled();
+      vi.advanceTimersByTime(6000);
+      await flushPromises();
+      expect(api.remove).toHaveBeenCalledWith("default", "old");
+    } finally {
+      vi.useRealTimers();
+    }
+    expect(wrapper.emitted("restore")).toBeUndefined();
+  });
+
+  it("keeps a row's VRL function: its own copy, a line under the query, and in the cut query's tooltip", async () => {
+    const vrl = '.severity = if .status >= 500 {\n  "critical"\n} else { "info" }';
+    api.list.mockResolvedValue({
+      data: [
+        row("fn", {
+          query: "SELECT 1",
+          context: { page: { stream: "k8s", functionContent: b64EncodeUnicode(vrl) ?? "" } },
+        }),
+        row("plain"),
+      ],
+    });
+    const wrapper = mount(RecentSearchesDrawer, {
+      props: { source: "logs", open: true },
+      global: {
+        plugins: [store],
+        stubs: {
+          ODrawer: { props: ["open"], template: `<div v-if="open"><slot /></div>` },
+          ODialog: true,
+          OTimeCell: true,
+        },
+      },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-copy-function-plain"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="recent-searches-drawer-function"]').text()).toContain(
+      "Function (VRL): .severity",
+    );
+
+    const cell = wrapper.find('[data-test="recent-searches-drawer-query"]').element;
+    Object.defineProperty(cell, "scrollWidth", { configurable: true, value: 1200 });
+    Object.defineProperty(cell, "clientWidth", { configurable: true, value: 300 });
+    vi.useFakeTimers();
+    try {
+      cell.dispatchEvent(new MouseEvent("mouseenter"));
+      vi.advanceTimersByTime(700);
+      await nextTick();
+      await nextTick();
+      const bubble = document.body.querySelector('[data-test="o-tooltip-content"]');
+      expect(bubble?.textContent).toContain("SELECT 1");
+      expect(bubble?.textContent).toContain(vrl);
+    } finally {
+      vi.useRealTimers();
+      wrapper.unmount();
+    }
+  });
+
+  it("copies the function from its own menu item and the query alone from Copy query", async () => {
+    const vrl = ".a = 1\n.b = 2";
+    api.list.mockResolvedValue({
+      data: [
+        row("fn", {
+          query: "SELECT 1",
+          context: { page: { stream: "k8s", functionContent: b64EncodeUnicode(vrl) ?? "" } },
+        }),
+      ],
+    });
+    const wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-test="recent-searches-copy-function-fn"]').trigger("click");
+    expect(clipboard.copyToClipboard).toHaveBeenLastCalledWith(vrl, expect.any(Function), {
+      successMessage: "Function copied",
+    });
+    await wrapper.find('[data-test="recent-searches-copy-query-fn"]').trigger("click");
+    expect(clipboard.copyToClipboard).toHaveBeenLastCalledWith("SELECT 1", expect.any(Function), {
+      successMessage: "Query copied",
+    });
+  });
+
+  describe("delete with Undo", () => {
+    const deleteToast = () => toastRecords.find((r) => r.message.startsWith("Deleted"));
+    const rowShown = (wrapper: ReturnType<typeof mountDrawer>) =>
+      wrapper.find('[data-test="recent-searches-drawer-row-old"]').exists();
+    const deleteOld = async (wrapper: ReturnType<typeof mountDrawer>) => {
+      await wrapper.find('[data-test="recent-searches-delete-old"]').trigger("click");
+      await flushPromises();
+    };
+
+    beforeEach(() => {
+      dismissAll();
+      vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
+    });
+    afterEach(() => {
+      vi.useRealTimers();
+      dismissAll();
+    });
+
+    it("shows the row again when the server refuses the delete", async () => {
+      api.remove.mockRejectedValueOnce(new Error("500"));
+      const wrapper = mountDrawer();
+      await flushPromises();
+      await deleteOld(wrapper);
+      expect(rowShown(wrapper)).toBe(false);
+      vi.advanceTimersByTime(20000);
+      await flushPromises();
+      expect(api.remove).toHaveBeenCalledWith("default", "old");
+      expect(rowShown(wrapper)).toBe(true);
+    });
+
+    it("brings the row back on Undo and never deletes it", async () => {
+      const wrapper = mountDrawer();
+      await flushPromises();
+      await deleteOld(wrapper);
+      expect(rowShown(wrapper)).toBe(false);
+      expect(deleteToast()?.message).toBe("Deleted query old");
+
+      deleteToast()?.action?.handler();
+      await flushPromises();
+      expect(rowShown(wrapper)).toBe(true);
+      expect(deleteToast()?.open ?? false).toBe(false);
+      vi.advanceTimersByTime(20000);
+      await flushPromises();
+      expect(api.remove).not.toHaveBeenCalled();
+    });
+
+    it("deletes only when the toast closes, so a paused toast keeps Undo working", async () => {
+      const wrapper = mountDrawer();
+      await flushPromises();
+      await deleteOld(wrapper);
+      const record = deleteToast();
+      pauseTimer(record!.id);
+      vi.advanceTimersByTime(20000);
+      await flushPromises();
+      expect(api.remove).not.toHaveBeenCalled();
+
+      record?.action?.handler();
+      await flushPromises();
+      expect(rowShown(wrapper)).toBe(true);
+      expect(api.remove).not.toHaveBeenCalled();
+    });
+
+    it("deletes once the toast times out, and Undo then does nothing", async () => {
+      const wrapper = mountDrawer();
+      await flushPromises();
+      await deleteOld(wrapper);
+      const action = deleteToast()?.action;
+      vi.advanceTimersByTime(6000);
+      await flushPromises();
+      expect(api.remove).toHaveBeenCalledWith("default", "old");
+
+      action?.handler();
+      await flushPromises();
+      expect(rowShown(wrapper)).toBe(false);
+      expect(api.remove).toHaveBeenCalledTimes(1);
+    });
+
+    it("deletes in the org the delete started in, after a switch to another org", async () => {
+      const org = store.state.selectedOrganization;
+      const wrapper = mountDrawer();
+      await flushPromises();
+      await deleteOld(wrapper);
+      store.state.selectedOrganization = { ...org, identifier: "other" };
+      try {
+        vi.advanceTimersByTime(6000);
+        await flushPromises();
+        expect(api.remove).toHaveBeenCalledWith("default", "old");
+        expect(api.remove).not.toHaveBeenCalledWith("other", "old");
+      } finally {
+        store.state.selectedOrganization = org;
+      }
+    });
+
+    it("keeps Undo working when the message starts with the lowercase query", async () => {
+      const setMessage = (deletedQuery: string) =>
+        i18n.global.mergeLocaleMessage("en-us", { recentSearches: { deletedQuery } });
+      setMessage("{query} deleted");
+      try {
+        const wrapper = mountDrawer();
+        await flushPromises();
+        await deleteOld(wrapper);
+        const record = toastRecords.find((r) => r.open);
+        expect(record?.message).toBe("Query old deleted");
+        record?.action?.handler();
+        await flushPromises();
+        expect(rowShown(wrapper)).toBe(true);
+        vi.advanceTimersByTime(20000);
+        await flushPromises();
+        expect(api.remove).not.toHaveBeenCalled();
+      } finally {
+        setMessage("Deleted {query}");
+      }
+    });
+
+    it("closes the toast before committing when the drawer goes away", async () => {
+      const wrapper = mountDrawer();
+      await flushPromises();
+      await deleteOld(wrapper);
+      const record = deleteToast();
+      wrapper.unmount();
+      await flushPromises();
+      expect(api.remove).toHaveBeenCalledWith("default", "old");
+      expect(record?.open).toBe(false);
+    });
+  });
+
+  it("stars or unstars only the row clicked, by its own flag", async () => {
+    api.list.mockResolvedValue({
+      data: [
+        row("today", { query: "same", streams: ["k8s"] }),
+        row("other", { query: "same", streams: ["other"], starred: true }),
+      ],
+    });
+    const wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-star-today"]').attributes("aria-label")).toBe(
+      "Star",
+    );
+    await wrapper.find('[data-test="recent-searches-star-today"]').trigger("click");
+    await wrapper.find('[data-test="recent-searches-star-other"]').trigger("click");
+    await flushPromises();
+    expect(api.star.mock.calls).toEqual([
+      ["default", "today", true],
+      ["default", "other", false],
+    ]);
+  });
+
+  it("says search or searches to match each count in the clear dialog", async () => {
+    api.count.mockImplementation((_org: string, params: { starred: boolean }) =>
+      Promise.resolve({ data: { count: params.starred ? 1 : 1 } }),
+    );
+    const wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-test="recent-searches-clear-btn"]').trigger("click");
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-clear-body"]').text()).toContain(
+      "your 1 recent Logs search in",
+    );
+    expect(
+      wrapper.find('[data-test="recent-searches-clear-include-starred"]').attributes("label"),
+    ).toBe("Also remove my 1 starred search");
+  });
+
+  it("clears this page and keeps starred by default, all pages and starred on request", async () => {
+    api.count.mockImplementation((_org: string, params: { starred: boolean }) =>
+      Promise.resolve({ data: { count: params.starred ? 3 : 1234 } }),
+    );
+    const wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-test="recent-searches-clear-btn"]').trigger("click");
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-clear-body"]').text()).toContain(
+      "your 1234 recent Logs searches",
+    );
+    expect(api.count).toHaveBeenCalledWith("default", { source: "logs", starred: false });
+    expect(api.count).toHaveBeenCalledWith("default", { source: "logs", starred: true });
+    expect(api.list).not.toHaveBeenCalledWith("default", expect.objectContaining({ limit: 200 }));
+    await wrapper.find('[data-test="dialog-confirm"]').trigger("click");
+    await flushPromises();
+    expect(api.clear).toHaveBeenLastCalledWith("default", {
+      source: "logs",
+      include_starred: false,
+    });
+
+    await wrapper.find('[data-test="scope-all"]').trigger("click");
+    await wrapper.find('[data-test="recent-searches-clear-btn"]').trigger("click");
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-clear-body"]').text()).toContain(
+      "across Logs, Traces and Metrics",
+    );
+    await wrapper.find('[data-test="recent-searches-clear-include-starred"]').setValue(true);
+    await wrapper.find('[data-test="dialog-confirm"]').trigger("click");
+    await flushPromises();
+    expect(api.clear).toHaveBeenLastCalledWith("default", {
+      source: "logs,traces,metrics",
+      include_starred: true,
+    });
+    expect(api.count).toHaveBeenCalledWith("default", {
+      source: "logs,traces,metrics",
+      starred: false,
+    });
+  });
+
+  it("puts scope and retention in the info tooltip, from /config or kept until deleted", async () => {
+    store.state.zoConfig.query_history_retention_days = 30;
+    const wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.text()).not.toContain("visible only to you");
+    expect(wrapper.find('[data-test="recent-searches-retention"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="recent-searches-about"]').attributes("aria-label")).toContain(
+      "Kept 30 days",
+    );
+    store.state.zoConfig.query_history_retention_days = 0;
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-about"]').attributes("aria-label")).toContain(
+      "Kept until deleted",
+    );
+  });
+});
+
+describe("Starred only (real checkbox)", () => {
+  const ROWS = [row("today"), row("starred", { starred: true }), row("other")];
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    api.list.mockImplementation((_org: string, params: { starred?: boolean }) =>
+      Promise.resolve({ data: params.starred ? ROWS.filter((r) => r.starred) : ROWS }),
+    );
+  });
+
+  const mountWithRealCheckbox = () =>
+    mount(RecentSearchesDrawer, {
+      props: { source: "logs", open: true },
+      global: {
+        plugins: [store],
+        stubs: {
+          ODrawer: {
+            props: ["open"],
+            template: `<div v-if="open"><slot /><slot name="footer" /></div>`,
+          },
+          ODialog: true,
+          OTimeCell: true,
+          OTooltip: true,
+        },
+      },
+    });
+  const shownRows = (wrapper: ReturnType<typeof mountWithRealCheckbox>) =>
+    wrapper.findAll('[data-test^="recent-searches-drawer-row-"]').length;
+  const box = (wrapper: ReturnType<typeof mountWithRealCheckbox>) =>
+    wrapper.find('[data-test="recent-searches-starred-only"] [role="checkbox"]');
+
+  it("shows a checked box and only starred rows, also after the drawer is closed and reopened", async () => {
+    const wrapper = mountWithRealCheckbox();
+    await flushPromises();
+    expect(shownRows(wrapper)).toBe(3);
+    expect(box(wrapper).attributes("aria-checked")).toBe("false");
+
+    await box(wrapper).trigger("click");
+    await flushPromises();
+    expect(box(wrapper).attributes("aria-checked")).toBe("true");
+    expect(api.list).toHaveBeenLastCalledWith(
+      "default",
+      expect.objectContaining({ starred: true }),
+    );
+    expect(shownRows(wrapper)).toBe(1);
+
+    await wrapper.setProps({ open: false });
+    await wrapper.setProps({ open: true });
+    await flushPromises();
+    expect(box(wrapper).attributes("aria-checked")).toBe("true");
+    expect(shownRows(wrapper)).toBe(1);
+
+    await box(wrapper).trigger("click");
+    await flushPromises();
+    expect(box(wrapper).attributes("aria-checked")).toBe("false");
+    expect(shownRows(wrapper)).toBe(3);
+  });
+
+  it("shows a cut query's full multi-line text on hover, line breaks and indentation kept", async () => {
+    const query =
+      "SELECT level,\n       count(*)\n  FROM k8s_logs\n  -- errors only\n WHERE level = 'error'";
+    api.list.mockResolvedValue({ data: [row("long", { query })] });
+    const wrapper = mount(RecentSearchesDrawer, {
+      props: { source: "logs", open: true },
+      global: {
+        plugins: [store],
+        stubs: {
+          ODrawer: { props: ["open"], template: `<div v-if="open"><slot /></div>` },
+          ODialog: true,
+          OTimeCell: true,
+        },
+      },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    const cell = wrapper.find('[data-test="recent-searches-drawer-query"]').element;
+    Object.defineProperty(cell, "scrollWidth", { configurable: true, value: 1200 });
+    Object.defineProperty(cell, "clientWidth", { configurable: true, value: 300 });
+    vi.useFakeTimers();
+    try {
+      cell.dispatchEvent(new MouseEvent("mouseenter"));
+      vi.advanceTimersByTime(700);
+      await nextTick();
+      await nextTick();
+      const bubble = document.body.querySelector('[data-test="o-tooltip-content"]');
+      expect(bubble?.textContent).toContain(query);
+      expect(bubble?.className).toContain("whitespace-pre-wrap");
+      expect(bubble?.className).toContain("font-mono");
+    } finally {
+      vi.useRealTimers();
+      wrapper.unmount();
+    }
+  });
+
+  it("shows a failed row's whole error on hover only when the line is cut", async () => {
+    const message = `Search field not found: ${"x".repeat(300)}`;
+    api.list.mockResolvedValue({
+      data: [row("bad", { status: "error", context: { error: message } })],
+    });
+    const wrapper = mount(RecentSearchesDrawer, {
+      props: { source: "logs", open: true },
+      global: {
+        plugins: [store],
+        stubs: {
+          ODrawer: { props: ["open"], template: `<div v-if="open"><slot /></div>` },
+          ODialog: true,
+          OTimeCell: true,
+        },
+      },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    const line = wrapper.find('[data-test="recent-searches-drawer-error"]').element;
+    const hover = async () => {
+      line.dispatchEvent(new MouseEvent("mouseleave"));
+      await nextTick();
+      line.dispatchEvent(new MouseEvent("mouseenter"));
+      vi.advanceTimersByTime(700);
+      await nextTick();
+      await nextTick();
+    };
+    const bubble = () => document.body.querySelector('[data-test="o-tooltip-content"]');
+    const setWidths = (scrollWidth: number, clientWidth: number) => {
+      Object.defineProperty(line, "scrollWidth", { configurable: true, value: scrollWidth });
+      Object.defineProperty(line, "clientWidth", { configurable: true, value: clientWidth });
+    };
+    vi.useFakeTimers();
+    try {
+      setWidths(300, 300);
+      await hover();
+      expect(bubble()).toBeNull();
+      setWidths(1200, 300);
+      await hover();
+      expect(bubble()?.textContent).toContain(message);
+    } finally {
+      vi.useRealTimers();
+      wrapper.unmount();
+    }
+  });
+});
diff --git a/web/src/components/queryHistory/RecentSearchesDrawer.timezone.spec.ts b/web/src/components/queryHistory/RecentSearchesDrawer.timezone.spec.ts
new file mode 100644
index 0000000000..fe3d7563da
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesDrawer.timezone.spec.ts
@@ -0,0 +1,109 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { enableAutoUnmount, flushPromises, mount } from "@vue/test-utils";
+import store from "@/test/unit/helpers/store";
+import type { QueryHistoryEntry } from "@/services/query_history";
+
+const api = vi.hoisted(() => ({
+  list: vi.fn(),
+  record: vi.fn(),
+  star: vi.fn(),
+  remove: vi.fn(),
+  clear: vi.fn(),
+  count: vi.fn(),
+}));
+vi.mock("@/services/query_history", () => ({ default: api }));
+vi.mock("vue-router", () => ({ useRouter: () => ({ push: vi.fn(), resolve: vi.fn() }) }));
+
+import i18n from "@/locales";
+import RecentSearchesDrawer from "./RecentSearchesDrawer.vue";
+
+enableAutoUnmount(afterEach);
+
+const at = (iso: string) => Date.parse(iso) * 1000;
+
+const row = (id: string, ranAt: string): QueryHistoryEntry => ({
+  id,
+  source: "logs",
+  query: `query ${id}`,
+  query_key: id,
+  streams: ["k8s"],
+  context: {},
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: at(ranAt),
+  updated_at: at(ranAt),
+});
+
+const mountDrawer = () =>
+  mount(RecentSearchesDrawer, {
+    props: { source: "logs", open: true },
+    global: {
+      plugins: [store, i18n],
+      stubs: {
+        ODrawer: {
+          props: ["open"],
+          template: `<div v-if="open"><slot name="header-left" /><slot /><slot name="footer" /></div>`,
+        },
+        RecentSearchesDayPicker: {
+          props: ["modelValue"],
+          emits: ["update:modelValue"],
+          template: `<input data-stub="date" :value="modelValue" @input="$emit('update:modelValue', $event.target.value)" />`,
+        },
+        OTimeCell: true,
+        OTooltip: true,
+      },
+    },
+  });
+
+describe("RecentSearchesDrawer in the configured timezone", () => {
+  const original = store.state.timezone;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.timezone = "Asia/Kolkata";
+    api.count.mockResolvedValue({ data: { count: 0 } });
+    // 20:00 UTC is 01:30 the next day in Kolkata; the test runner's own zone is UTC.
+    api.list.mockResolvedValue({
+      data: [row("late", "2025-03-04T20:00:00Z"), row("noon", "2025-03-04T10:00:00Z")],
+    });
+  });
+  afterEach(() => {
+    store.state.timezone = original;
+  });
+
+  it("cuts the day headers in the app timezone, not the browser's", async () => {
+    const wrapper = mountDrawer();
+    await flushPromises();
+    const days = wrapper.findAll('[data-test="recent-searches-day"]');
+    expect(days).toHaveLength(2);
+    expect(days[0].text()).toContain("Wed, Mar 5");
+    expect(days[1].text()).toContain("Tue, Mar 4");
+  });
+
+  it("asks for a Ran on day's bounds in the app timezone", async () => {
+    const wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-stub="date"]').setValue("2025-03-05");
+    await flushPromises();
+    expect(api.list.mock.calls.at(-1)?.[1]).toMatchObject({
+      ran_from: at("2025-03-04T18:30:00Z"),
+      ran_to: at("2025-03-05T18:30:00Z") - 1,
+    });
+  });
+});
diff --git a/web/src/components/queryHistory/RecentSearchesDrawer.vue b/web/src/components/queryHistory/RecentSearchesDrawer.vue
new file mode 100644
index 0000000000..e77c4eed90
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesDrawer.vue
@@ -0,0 +1,653 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <ODrawer
+    v-model:open="open"
+    :size="isMobile ? 'full' : 'md'"
+    :title="t('recentSearches.title')"
+    bleed
+    data-test="recent-searches-drawer"
+  >
+    <template #header-left>
+      <OButton
+        variant="ghost"
+        size="icon-xs"
+        icon-left="info-outline"
+        :aria-label="aboutText"
+        data-test="recent-searches-about"
+      >
+        <OTooltip :content="aboutText" />
+      </OButton>
+    </template>
+    <div class="flex h-full min-h-0 flex-col">
+      <div class="border-border-default flex shrink-0 flex-col gap-2 border-b px-4 py-2">
+        <div class="flex items-center gap-2">
+          <OSearchInput
+            v-model="search"
+            size="sm"
+            clearable
+            :debounce="300"
+            :placeholder="t('recentSearches.searchPlaceholder')"
+            class="min-w-0 flex-1"
+            data-test="recent-searches-search"
+          />
+          <OToggleGroup v-model="scope" type="single" data-test="recent-searches-scope">
+            <OToggleGroupItem value="page" size="sm" data-test="recent-searches-scope-page">
+              {{ t(`recentSearches.page.${source}`) }}
+            </OToggleGroupItem>
+            <OToggleGroupItem value="all" size="sm" data-test="recent-searches-scope-all">
+              {{ t("recentSearches.allPages") }}
+            </OToggleGroupItem>
+          </OToggleGroup>
+        </div>
+        <div class="flex flex-wrap items-center gap-2">
+          <OSelect
+            v-model="stream"
+            :options="streamOptions"
+            size="sm"
+            clearable
+            searchable
+            creatable
+            :placeholder="t('recentSearches.allStreams')"
+            class="w-44"
+            data-test="recent-searches-stream"
+          />
+          <OSelect
+            v-model="status"
+            :options="statusOptions"
+            size="sm"
+            class="w-32"
+            data-test="recent-searches-status"
+          />
+          <RecentSearchesDayPicker
+            v-model="ranOn"
+            :placeholder="t('recentSearches.datePlaceholder')"
+            :field-label="t('recentSearches.filterByDateRun')"
+            :zone="zone"
+            data-test="recent-searches-ran-on"
+          />
+          <OCheckbox
+            v-model="starredOnly"
+            size="sm"
+            :label="t('recentSearches.starredOnly')"
+            data-test="recent-searches-starred-only"
+          />
+          <OButton
+            v-if="filtered"
+            variant="ghost-primary"
+            size="xs"
+            icon-left="restart-alt"
+            class="ms-auto"
+            data-test="recent-searches-reset-filters"
+            @click="resetFilters"
+          >
+            {{ t("recentSearches.reset") }}
+            <OTooltip :content="t('recentSearches.resetFilters')" />
+          </OButton>
+        </div>
+      </div>
+
+      <div class="min-h-0 flex-1 overflow-auto" data-test="recent-searches-drawer-list">
+        <div v-if="history.isPending.value && open" class="flex flex-col gap-3 p-4">
+          <OSkeleton v-for="n in 5" :key="n" type="text" />
+        </div>
+        <OEmptyState
+          v-else-if="history.isError.value"
+          size="inline"
+          icon="error"
+          :title="t('recentSearches.loadError')"
+          :action-label="t('recentSearches.retry')"
+          action-icon="refresh"
+          @action="history.refetch()"
+        />
+        <OEmptyState
+          v-else-if="!rows.length"
+          size="inline"
+          icon="history"
+          :title="filtered ? t('recentSearches.noMatch') : t('recentSearches.emptyTitle')"
+          :action-label="filtered ? t('recentSearches.resetFilters') : undefined"
+          action-icon="restart-alt"
+          data-test="recent-searches-drawer-empty"
+          @action="resetFilters"
+        />
+        <section v-for="group in groups" :key="group.dayMs" :data-test="`recent-searches-day`">
+          <h3
+            class="bg-surface-panel text-text-secondary border-border-subtle sticky top-0 z-1 border-b px-4 py-1 text-xs font-semibold uppercase"
+          >
+            {{ dayLabel(group) }}
+          </h3>
+          <div
+            v-for="entry in group.entries"
+            :key="entry.id"
+            class="border-border-subtle hover:bg-dropdown-item-hover-bg group flex cursor-pointer flex-col gap-1 border-b px-4 py-2"
+            :data-test="`recent-searches-drawer-row-${entry.id}`"
+            @click="restore(entry, restoreTimeOf(entry), true)"
+          >
+            <div class="flex min-w-0 items-center gap-2">
+              <OTag
+                v-if="scope === 'all'"
+                :label="t(`recentSearches.page.${entry.source}`)"
+                size="sm"
+                variant="primary-outline"
+                class="shrink-0"
+              />
+              <OTag
+                v-for="name in entry.streams.slice(0, 3)"
+                :key="name"
+                :label="raw(name)"
+                size="sm"
+                class="shrink-0"
+              />
+              <span v-if="entry.streams.length > 3" class="text-text-secondary text-xs">
+                +{{ entry.streams.length - 3 }}
+              </span>
+              <span class="ms-auto flex shrink-0 items-center gap-1">
+                <OTag
+                  v-if="entry.status === 'error'"
+                  :label="t('recentSearches.failed')"
+                  variant="error-soft"
+                  size="sm"
+                  data-test="recent-searches-failed-tag"
+                />
+                <span
+                  v-else-if="entry.context.warning !== undefined"
+                  class="bg-status-warning-text size-2 rounded-full"
+                  data-test="recent-searches-drawer-warning"
+                >
+                  <OTooltip :content="t('recentSearches.warning')" />
+                </span>
+                <OButton
+                  variant="ghost"
+                  size="icon-sm"
+                  :icon-left="entry.starred ? 'star' : 'star-outline'"
+                  :class="entry.starred ? 'text-accent' : ''"
+                  :aria-label="
+                    entry.starred ? t('recentSearches.unstar') : t('recentSearches.star')
+                  "
+                  :data-test="`recent-searches-star-${entry.id}`"
+                  @click.stop="toggleStar(entry)"
+                >
+                  <OTooltip
+                    :content="entry.starred ? t('recentSearches.unstar') : t('recentSearches.star')"
+                  />
+                </OButton>
+                <ODropdown side="bottom" align="end">
+                  <template #trigger>
+                    <OButton
+                      variant="ghost"
+                      size="icon-sm"
+                      icon-left="more-vert"
+                      :aria-label="t('common.more')"
+                      :data-test="`recent-searches-more-${entry.id}`"
+                      @click.stop
+                    />
+                  </template>
+                  <ODropdownItem
+                    icon-left="edit-note"
+                    :data-test="`recent-searches-load-${entry.id}`"
+                    @select="restore(entry, restoreTimeOf(entry), false)"
+                  >
+                    <span>{{ t("recentSearches.loadOnly") }}</span>
+                  </ODropdownItem>
+                  <ODropdownItem
+                    icon-left="link"
+                    :data-test="`recent-searches-copy-link-${entry.id}`"
+                    @select="copyLink(entry)"
+                  >
+                    <span>{{ t("recentSearches.copyLink") }}</span>
+                  </ODropdownItem>
+                  <ODropdownItem
+                    icon-left="content-copy"
+                    :data-test="`recent-searches-copy-query-${entry.id}`"
+                    @select="copyQuery(entry)"
+                  >
+                    <span>{{ t("recentSearches.copyQuery") }}</span>
+                  </ODropdownItem>
+                  <ODropdownItem
+                    v-if="functionOf(entry)"
+                    icon-left="content-copy"
+                    :data-test="`recent-searches-copy-function-${entry.id}`"
+                    @select="copyFunction(entry)"
+                  >
+                    <span>{{ t("recentSearches.copyFunction") }}</span>
+                  </ODropdownItem>
+                  <ODropdownItem
+                    variant="destructive"
+                    icon-left="delete"
+                    :data-test="`recent-searches-delete-${entry.id}`"
+                    @select="removeWithUndo(entry)"
+                  >
+                    <span>{{ t("common.delete") }}</span>
+                  </ODropdownItem>
+                </ODropdown>
+              </span>
+            </div>
+            <OTruncatedText
+              :lines="2"
+              :tooltip="queryTooltip(entry)"
+              tooltip-class="whitespace-pre-wrap font-mono"
+              class="text-text-heading font-mono text-xs break-all"
+              data-test="recent-searches-drawer-query"
+            >
+              {{ entry.query }}
+            </OTruncatedText>
+            <OTruncatedText
+              v-if="functionOf(entry)"
+              :tooltip="raw(functionOf(entry))"
+              tooltip-class="whitespace-pre-wrap font-mono"
+              class="text-text-secondary font-mono text-xs"
+              data-test="recent-searches-drawer-function"
+            >
+              {{ t("recentSearches.functionLabel") }}: {{ functionOf(entry) }}
+            </OTruncatedText>
+            <OTruncatedText
+              v-if="entry.status === 'error' && entry.context.error"
+              :tooltip="raw(entry.context.error)"
+              class="text-status-error-text text-xs"
+              data-test="recent-searches-drawer-error"
+            >
+              {{ entry.context.error }}
+            </OTruncatedText>
+            <div class="text-text-secondary flex flex-wrap items-center gap-x-3 gap-y-1 text-xs">
+              <span v-if="windowText(entry)" data-test="recent-searches-window">
+                <OIcon name="schedule" size="xs" class="me-1 align-middle" />{{ windowText(entry) }}
+              </span>
+              <span data-test="recent-searches-span">{{ spanText(entry) }}</span>
+              <span class="ms-auto flex items-center gap-1">
+                <OButton
+                  variant="outline"
+                  size="xs"
+                  icon-left="play-arrow"
+                  :data-test="`recent-searches-rerun-now-${entry.id}`"
+                  @click.stop="restore(entry, 'now', true)"
+                >
+                  {{ t("recentSearches.rerunNow") }}
+                </OButton>
+                <OButton
+                  v-if="entry.context.time || entry.context.time_range"
+                  variant="outline"
+                  size="xs"
+                  icon-left="history"
+                  :data-test="`recent-searches-rerun-original-${entry.id}`"
+                  @click.stop="restore(entry, 'original', true)"
+                >
+                  {{ t("recentSearches.rerunOriginal") }}
+                </OButton>
+              </span>
+            </div>
+          </div>
+        </section>
+        <div v-if="history.hasNextPage.value" class="flex justify-center p-3">
+          <OButton
+            variant="outline"
+            size="sm"
+            :loading="history.isFetchingNextPage.value"
+            data-test="recent-searches-load-more"
+            @click="history.fetchNextPage()"
+          >
+            {{ t("recentSearches.loadMore") }}
+          </OButton>
+        </div>
+      </div>
+    </div>
+
+    <template #footer>
+      <div class="flex w-full flex-col gap-1.5">
+        <div class="flex justify-end">
+          <OButton
+            variant="outline-destructive"
+            size="sm"
+            icon-left="delete"
+            data-test="recent-searches-clear-btn"
+            @click="clearOpen = true"
+          >
+            {{ t("recentSearches.clear") }}
+          </OButton>
+        </div>
+      </div>
+    </template>
+  </ODrawer>
+
+  <ODialog
+    v-model:open="clearOpen"
+    size="sm"
+    :title="t('recentSearches.clear')"
+    :secondary-button-label="t('common.cancel')"
+    :primary-button-label="t('recentSearches.confirmClear')"
+    primary-button-variant="destructive"
+    :primary-button-loading="clearing"
+    primary-button-data-test="recent-searches-clear-confirm"
+    data-test="recent-searches-clear-dialog"
+    @click:secondary="clearOpen = false"
+    @click:primary="confirmClear"
+  >
+    <div class="flex flex-col gap-3">
+      <p data-test="recent-searches-clear-body">
+        {{
+          scope === "page"
+            ? t(
+                "recentSearches.clearBodyPage",
+                {
+                  count: countLabel(unstarredCount.data.value),
+                  page: t(`recentSearches.page.${source}`),
+                  org: orgId,
+                },
+                pluralOf(unstarredCount.data.value),
+              )
+            : t(
+                "recentSearches.clearBodyAll",
+                { count: countLabel(unstarredCount.data.value), org: orgId },
+                pluralOf(unstarredCount.data.value),
+              )
+        }}
+      </p>
+      <OCheckbox
+        v-model="includeStarred"
+        :label="
+          t(
+            'recentSearches.includeStarred',
+            { count: countLabel(starredCount.data.value) },
+            pluralOf(starredCount.data.value),
+          )
+        "
+        data-test="recent-searches-clear-include-starred"
+      />
+    </div>
+  </ODialog>
+</template>
+
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref, watch } from "vue";
+import { useRouter } from "vue-router";
+import { DateTime } from "luxon";
+import { useInfiniteQuery, useQuery } from "@tanstack/vue-query";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import useBreakpoint from "@/composables/useBreakpoint";
+import { useRecentSearches } from "@/composables/queryHistory/useRecentSearches";
+import { queryHistoryCountQuery, queryHistoryQuery } from "@/services/query_history.queries";
+import type {
+  HistorySource,
+  HistoryStatus,
+  QueryHistoryEntry,
+  QueryHistoryListParams,
+} from "@/services/query_history";
+import {
+  absoluteLink,
+  dayBoundsUs,
+  HISTORY_SOURCES,
+  defaultRestoreTime,
+  groupByDay,
+  type DayGroup,
+  type RestoreTime,
+} from "@/utils/queryHistory/recentSearches";
+import { recentSearchRoute } from "@/utils/queryHistory/routes";
+import { logsEntryFunction } from "@/utils/queryHistory/logs";
+import { copyToClipboard } from "@/utils/clipboard";
+import { toast, toastRecords } from "@/lib/feedback/Toast/useToast";
+import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
+import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
+import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
+import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import RecentSearchesDayPicker from "./RecentSearchesDayPicker.vue";
+import { useRecentEntryText } from "@/composables/queryHistory/useRecentEntryText";
+import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
+import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
+import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
+import OSelect from "@/lib/forms/Select/OSelect.vue";
+import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
+
+const props = defineProps<{ source: HistorySource }>();
+
+const UNDO_DELETE_MS = 6000;
+
+const emit = defineEmits<{
+  restore: [entry: QueryHistoryEntry, when: RestoreTime, run: boolean];
+}>();
+
+const open = defineModel<boolean>("open", { default: false });
+
+const { t } = useI18nTyped();
+const router = useRouter();
+const { isMobile } = useBreakpoint();
+const { orgId, about: aboutText, star, remove, clear } = useRecentSearches();
+const { zone, windowText, spanText } = useRecentEntryText();
+
+const search = ref("");
+const scope = ref<"page" | "all">("page");
+const stream = ref<string | null>(null);
+const status = ref<"all" | HistoryStatus>("all");
+const ranOn = ref<string | undefined>(undefined);
+const starredOnly = ref(false);
+const clearOpen = ref(false);
+const includeStarred = ref(false);
+const clearing = ref(false);
+
+const sourceParam = computed(() =>
+  scope.value === "page" ? props.source : HISTORY_SOURCES.join(","),
+);
+
+const filters = computed<QueryHistoryListParams>(() => ({
+  source: sourceParam.value,
+  ...(search.value.trim() ? { q: search.value.trim() } : {}),
+  ...(stream.value ? { stream: stream.value } : {}),
+  ...(status.value !== "all" ? { status: status.value } : {}),
+  ...(starredOnly.value ? { starred: true } : {}),
+  ...(ranOn.value ? (dayBoundsUs(ranOn.value, zone.value) ?? {}) : {}),
+}));
+const filtered = computed(
+  () =>
+    !!search.value.trim() ||
+    !!stream.value ||
+    status.value !== "all" ||
+    starredOnly.value ||
+    !!ranOn.value,
+);
+
+const resetFilters = () => {
+  search.value = "";
+  stream.value = null;
+  status.value = "all";
+  ranOn.value = undefined;
+  starredOnly.value = false;
+};
+
+const history = useInfiniteQuery(() =>
+  Object.assign(queryHistoryQuery(orgId.value, filters.value), {
+    enabled: open.value && !!orgId.value,
+  }),
+);
+const hiddenIds = ref<Set<string>>(new Set());
+const pendingDeletes = new Map<string, { org: string; ids: Set<string>; dismiss: () => void }>();
+const rows = computed(() =>
+  (history.data.value?.pages.flat() ?? []).filter((entry) => !hiddenIds.value.has(entry.id)),
+);
+const groups = computed(() => groupByDay(rows.value, Date.now(), zone.value));
+
+const unstarredCount = useQuery(() =>
+  Object.assign(queryHistoryCountQuery(orgId.value, sourceParam.value, false), {
+    enabled: clearOpen.value && !!orgId.value,
+  }),
+);
+const starredCount = useQuery(() =>
+  Object.assign(queryHistoryCountQuery(orgId.value, sourceParam.value, true), {
+    enabled: clearOpen.value && !!orgId.value,
+  }),
+);
+
+const streamOptions = computed(() => {
+  const names = new Set(rows.value.flatMap((entry) => entry.streams));
+  if (stream.value) names.add(stream.value);
+  return [...names].sort().map((name) => ({ label: raw(name), value: name }));
+});
+const statusOptions = computed(() => [
+  { label: t("recentSearches.statusAll"), value: "all" },
+  { label: t("recentSearches.statusOk"), value: "ok" },
+  { label: t("recentSearches.statusError"), value: "error" },
+]);
+
+const toggleStar = (entry: QueryHistoryEntry) => star(entry.id, !entry.starred);
+
+// Decoded once per loaded entry, not on every use in the row.
+const functions = computed(
+  () => new Map(rows.value.map((entry) => [entry.id, logsEntryFunction(entry)])),
+);
+const functionOf = (entry: QueryHistoryEntry) => functions.value.get(entry.id) ?? "";
+
+const dayLabel = (group: DayGroup): I18nText => {
+  if (group.daysAgo === 0) return t("recentSearches.today");
+  if (group.daysAgo === 1) return t("recentSearches.yesterday");
+  return raw(
+    DateTime.fromMillis(group.dayMs, zone.value ? { zone: zone.value } : {}).toFormat("ccc, LLL d"),
+  );
+};
+
+const restoreTimeOf = (entry: QueryHistoryEntry) =>
+  defaultRestoreTime(entry, Date.now(), zone.value);
+
+const countLabel = (count: number | undefined) => (count === undefined ? "…" : String(count));
+
+// A count still loading reads as plural ("… searches").
+const pluralOf = (count: number | undefined) => count ?? 2;
+
+const restore = (entry: QueryHistoryEntry, when: RestoreTime, run: boolean) => {
+  emit("restore", entry, when, run);
+  open.value = false;
+};
+
+const copyLink = (entry: QueryHistoryEntry) => {
+  const route = recentSearchRoute(entry, "original", orgId.value, "link");
+  if (!route) return;
+  copyToClipboard(absoluteLink(router.resolve(route).href), t, {
+    successMessage: t("recentSearches.linkCopied"),
+  });
+};
+
+const setHidden = (id: string, hidden: boolean) => {
+  const next = new Set(hiddenIds.value);
+  if (hidden) next.add(id);
+  else next.delete(id);
+  hiddenIds.value = next;
+};
+
+const shortQuery = (query: string) => {
+  const flat = query.replace(/\s+/g, " ").trim();
+  return flat.length > 60 ? `${flat.slice(0, 60)}…` : flat;
+};
+
+// The backend has no restore: a row stays hidden while its toast offers Undo, and is deleted once that toast closes.
+const removeWithUndo = (entry: QueryHistoryEntry) => {
+  setHidden(entry.id, true);
+  const org = orgId.value;
+  let toastId = "";
+  const dismissToast = toast({
+    variant: "success",
+    message: t("recentSearches.deletedQuery", { query: shortQuery(entry.query) }),
+    timeout: UNDO_DELETE_MS,
+    action: {
+      label: t("recentSearches.undo"),
+      handler: () => {
+        const pending = pendingDeletes.get(toastId);
+        if (!pending) return;
+        pendingDeletes.delete(toastId);
+        pending.ids.forEach((id) => setHidden(id, false));
+        dismissToast();
+      },
+    },
+  });
+  toastId = dismissToast.id;
+  const pending = pendingDeletes.get(toastId) ?? {
+    org,
+    ids: new Set<string>(),
+    dismiss: dismissToast,
+  };
+  pending.ids.add(entry.id);
+  pendingDeletes.set(toastId, pending);
+  commitClosedDeletes();
+};
+
+const commitDeletes = (toastId: string) => {
+  const pending = pendingDeletes.get(toastId);
+  if (!pending) return;
+  pendingDeletes.delete(toastId);
+  // A delete the server refused shows its row again, since the entry is still stored.
+  pending.ids.forEach((id) => remove(id, pending.org).catch(() => setHidden(id, false)));
+};
+
+const commitClosedDeletes = () => {
+  for (const toastId of [...pendingDeletes.keys()]) {
+    if (!toastRecords.some((r) => r.id === toastId && r.open)) commitDeletes(toastId);
+  }
+};
+
+watch(toastRecords, commitClosedDeletes, { deep: true });
+
+// Leaving commits the deletes, so their Undo must go first.
+onBeforeUnmount(() => {
+  for (const [toastId, pending] of [...pendingDeletes]) {
+    pending.dismiss();
+    commitDeletes(toastId);
+  }
+});
+
+const copyQuery = (entry: QueryHistoryEntry) =>
+  copyToClipboard(entry.query, t, { successMessage: t("recentSearches.queryCopied") });
+
+const copyFunction = (entry: QueryHistoryEntry) =>
+  copyToClipboard(functionOf(entry), t, {
+    successMessage: t("recentSearches.functionCopied"),
+  });
+
+// A cut query's tooltip carries the VRL function too, since the search does not reproduce without it.
+const queryTooltip = (entry: QueryHistoryEntry): I18nText | undefined => {
+  const vrl = functionOf(entry);
+  if (!vrl) return undefined;
+  return raw(`${entry.query}\n\n${t("recentSearches.functionLabel")}:\n${vrl}`);
+};
+
+const confirmClear = async () => {
+  clearing.value = true;
+  try {
+    await clear({
+      source: sourceParam.value,
+      include_starred: includeStarred.value,
+    });
+    clearOpen.value = false;
+  } catch {
+    // The mutation's error toast already told the user.
+  } finally {
+    clearing.value = false;
+  }
+};
+
+watch(clearOpen, (isOpen) => {
+  if (isOpen) includeStarred.value = false;
+});
+
+const show = (initialStatus: HistoryStatus | null = null) => {
+  status.value = initialStatus ?? "all";
+  open.value = true;
+};
+
+defineExpose({ show });
+</script>
diff --git a/web/src/components/queryHistory/RecentSearchesFocusDropdown.editorBox.spec.ts b/web/src/components/queryHistory/RecentSearchesFocusDropdown.editorBox.spec.ts
new file mode 100644
index 0000000000..46b85ec843
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesFocusDropdown.editorBox.spec.ts
@@ -0,0 +1,210 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { enableAutoUnmount, flushPromises, mount } from "@vue/test-utils";
+import { defineComponent, h, nextTick, ref } from "vue";
+import store from "@/test/unit/helpers/store";
+import i18n from "@/locales";
+import {
+  routeEditorKeyToRecents,
+  type RecentsKeyTarget,
+} from "@/utils/queryHistory/recentSearches";
+
+const api = vi.hoisted(() => ({ list: vi.fn(), record: vi.fn(), star: vi.fn(), remove: vi.fn() }));
+vi.mock("@/services/query_history", () => ({ default: api }));
+vi.mock("@/composables/useChatHistory", () => ({
+  useChatHistory: vi.fn(() => ({
+    saveToHistory: vi.fn().mockResolvedValue(1),
+    loadHistory: vi.fn().mockResolvedValue([]),
+    loadChat: vi.fn().mockResolvedValue(null),
+    deleteChatById: vi.fn().mockResolvedValue(true),
+    clearAllHistory: vi.fn().mockResolvedValue(true),
+    updateChatTitle: vi.fn().mockResolvedValue(true),
+  })),
+}));
+
+import QueryEditor from "@/components/QueryEditor.vue";
+import RecentSearchesFocusDropdown from "./RecentSearchesFocusDropdown.vue";
+import { placeCaret } from "@/test/unit/helpers/monacoCaret";
+
+enableAutoUnmount(afterEach);
+
+const NOW_US = Date.now() * 1000;
+const generateSql = vi.fn().mockResolvedValue(undefined);
+
+// Stands in for Monaco: the same `.monaco-editor` surface and caret element the real editor renders.
+const MonacoStub = defineComponent({
+  setup(_, { expose }) {
+    expose({ handleGenerateSQL: generateSql, getValue: () => "" });
+    return () =>
+      h("div", { class: "monaco-editor" }, [
+        h("textarea", { class: "inputarea", "data-test": "monaco-input" }),
+        h("div", { class: "cursors-layer" }, [
+          h("div", { class: "cursor", ref: (el) => placeCaret(el as Element | null) }),
+        ]),
+      ]);
+  },
+});
+
+const mountEditorBox = async () => {
+  const open = ref(false);
+  const box = ref<HTMLElement | null>(null);
+  const dropdown = ref<RecentsKeyTarget | null>(null);
+  const emitted: string[] = [];
+  const Host = defineComponent({
+    setup() {
+      return () =>
+        h("div", [
+          h(
+            "div",
+            {
+              ref: box,
+              onKeydownCapture: (e: KeyboardEvent) =>
+                open.value &&
+                routeEditorKeyToRecents(e, dropdown.value, () => (open.value = false)),
+            },
+            [
+              h(QueryEditor, {
+                query: "",
+                nlpMode: true,
+                editorHeight: "200px",
+                dataTestPrefix: "logs-search-bar",
+              }),
+            ],
+          ),
+          h(RecentSearchesFocusDropdown, {
+            ref: dropdown,
+            source: "logs",
+            anchor: box.value,
+            open: open.value,
+            "onUpdate:open": (value: boolean) => (open.value = value),
+            onRun: () => emitted.push("run"),
+            onLoad: () => emitted.push("load"),
+          }),
+        ]);
+    },
+  });
+  mount(Host, {
+    attachTo: document.body,
+    global: { plugins: [store, i18n], stubs: { CodeQueryEditor: MonacoStub, OTimeCell: true } },
+  });
+  await flushPromises();
+  open.value = true;
+  await vi.waitFor(() =>
+    expect(document.querySelector('[data-test="recent-searches-row-e0"]')).not.toBeNull(),
+  );
+  const aiInput = document.querySelector<HTMLInputElement>(
+    '[data-test^="logs-search-bar-ai-input-field"] input',
+  )!;
+  const monacoInput = document.querySelector<HTMLElement>('[data-test="monaco-input"]')!;
+  return { open, emitted, aiInput, monacoInput };
+};
+
+const keydown = (target: Element, key: string, shiftKey = false) => {
+  const event = new KeyboardEvent("keydown", { key, shiftKey, bubbles: true, cancelable: true });
+  target.dispatchEvent(event);
+  return event;
+};
+
+describe("recent-searches dropdown and the controls that share the editor box", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.zoConfig.query_history_enabled = true;
+    api.list.mockResolvedValue({
+      data: [
+        {
+          id: "e0",
+          source: "logs",
+          query: "level='error'",
+          query_key: "k",
+          streams: ["k8s"],
+          context: {},
+          status: "ok",
+          starred: false,
+          run_count: 1,
+          created_at: NOW_US,
+          updated_at: NOW_US,
+        },
+      ],
+    });
+  });
+  afterEach(() => {
+    delete store.state.zoConfig.query_history_enabled;
+    document.body.innerHTML = "";
+  });
+
+  it("leaves Enter, Shift+Enter and ArrowDown in the AI prompt to the prompt while the dropdown is open", async () => {
+    const { open, emitted, aiInput } = await mountEditorBox();
+    expect(aiInput).not.toBeNull();
+    aiInput.value = "show errors";
+    aiInput.dispatchEvent(new Event("input", { bubbles: true }));
+    await nextTick();
+
+    const arrow = keydown(aiInput, "ArrowDown");
+    const shiftEnter = keydown(aiInput, "Enter", true);
+    const enter = keydown(aiInput, "Enter");
+    await flushPromises();
+
+    expect(arrow.defaultPrevented).toBe(false);
+    expect(shiftEnter.defaultPrevented).toBe(false);
+    expect(enter.defaultPrevented).toBe(false);
+    expect(document.activeElement?.getAttribute("data-test") ?? "").not.toMatch(
+      /^recent-searches-row/,
+    );
+    expect(emitted).toEqual([]);
+    expect(generateSql).toHaveBeenCalledWith("show errors", expect.anything(), expect.anything());
+    expect(open.value).toBe(true);
+  });
+
+  it("leaves Enter to the editor's newline until a row is hovered, then runs that row", async () => {
+    const { emitted, monacoInput } = await mountEditorBox();
+    const plain = keydown(monacoInput, "Enter");
+    await flushPromises();
+    expect(plain.defaultPrevented).toBe(false);
+    expect(emitted).toEqual([]);
+
+    document
+      .querySelector('[data-test="recent-searches-row-e0"]')!
+      .dispatchEvent(new PointerEvent("pointerenter"));
+    await flushPromises();
+    const enter = keydown(monacoInput, "Enter");
+    await flushPromises();
+    expect(enter.defaultPrevented).toBe(true);
+    expect(emitted).toEqual(["run"]);
+  });
+
+  it("closes when focus or a click moves to the AI prompt or a button in the same box", async () => {
+    const first = await mountEditorBox();
+    first.aiInput.focus();
+    await nextTick();
+    expect(first.open.value).toBe(false);
+
+    document.body.innerHTML = "";
+    const second = await mountEditorBox();
+    const send = document.querySelector('[data-test="logs-search-bar-ai-send-btn"]')!;
+    send.dispatchEvent(new MouseEvent("pointerdown", { bubbles: true }));
+    await nextTick();
+    expect(second.open.value).toBe(false);
+  });
+
+  it("stays open on a click or focus inside the editor's own surface", async () => {
+    const { open, monacoInput } = await mountEditorBox();
+    monacoInput.dispatchEvent(new MouseEvent("pointerdown", { bubbles: true }));
+    monacoInput.focus();
+    await nextTick();
+    expect(open.value).toBe(true);
+  });
+});
diff --git a/web/src/components/queryHistory/RecentSearchesFocusDropdown.spec.ts b/web/src/components/queryHistory/RecentSearchesFocusDropdown.spec.ts
new file mode 100644
index 0000000000..f058d617f4
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesFocusDropdown.spec.ts
@@ -0,0 +1,376 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { enableAutoUnmount, mount } from "@vue/test-utils";
+import { defineComponent, h, nextTick } from "vue";
+import store from "@/test/unit/helpers/store";
+import { FIRST_LINE_CARET, type CaretBox } from "@/test/unit/helpers/monacoCaret";
+
+const api = vi.hoisted(() => ({ list: vi.fn(), record: vi.fn(), star: vi.fn(), remove: vi.fn() }));
+vi.mock("@/services/query_history", () => ({ default: api }));
+
+import RecentSearchesFocusDropdown from "./RecentSearchesFocusDropdown.vue";
+
+enableAutoUnmount(afterEach);
+
+const rectOf =
+  ({ left, top, right, bottom }: CaretBox) =>
+  () =>
+    ({
+      left,
+      top,
+      right,
+      bottom,
+      x: left,
+      y: top,
+      width: right - left,
+      height: bottom - top,
+      toJSON: () => ({}),
+    }) as DOMRect;
+
+// The editor box with Monaco's caret element inside, as the real editor renders it.
+const editorWithCaret = (caret: CaretBox) => {
+  const anchor = document.createElement("div");
+  const monaco = document.createElement("div");
+  monaco.className = "monaco-editor";
+  const layer = document.createElement("div");
+  layer.className = "cursors-layer";
+  const cursor = document.createElement("div");
+  cursor.className = "cursor";
+  cursor.getBoundingClientRect = rectOf(caret);
+  layer.appendChild(cursor);
+  monaco.appendChild(layer);
+  anchor.appendChild(monaco);
+  document.body.appendChild(anchor);
+  // Monaco moves its caret by rewriting the element's inline style, which is what the panel listens for.
+  const moveCaret = (to: CaretBox) => {
+    cursor.getBoundingClientRect = rectOf(to);
+    cursor.style.top = `${to.top}px`;
+    cursor.style.left = `${to.left}px`;
+  };
+  // A page scroll or a resize moves the caret on screen with no change inside the editor.
+  const shiftCaret = (to: CaretBox) => (cursor.getBoundingClientRect = rectOf(to));
+  return { anchor, monaco, moveCaret, shiftCaret };
+};
+
+const setViewport = (width: number, height: number) => {
+  Object.defineProperty(window, "innerWidth", { configurable: true, value: width });
+  Object.defineProperty(window, "innerHeight", { configurable: true, value: height });
+};
+
+const panel = () =>
+  document.querySelector<HTMLElement>('[data-test="recent-searches-focus-dropdown"]');
+
+const px = (value: string) => parseFloat(value);
+
+const ownsNode = vi.fn((_node: Node | null) => false);
+const PopoverStub = defineComponent({
+  setup(_, { expose }) {
+    expose({
+      ownsNode,
+      focusFirst: () => false,
+      pickActive: () => false,
+      scrollDetails: () => false,
+    });
+    return () => h("div", { "data-test": "popover-stub" });
+  },
+});
+
+const mountDropdown = (anchor: HTMLElement | null) =>
+  mount(RecentSearchesFocusDropdown, {
+    props: { source: "logs", anchor, open: true },
+    attachTo: document.body,
+    global: { plugins: [store], stubs: { RecentSearchesPopover: PopoverStub } },
+  });
+
+describe("RecentSearchesFocusDropdown placement at the caret", () => {
+  const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+  beforeEach(() => {
+    store.state.zoConfig.query_history_enabled = true;
+    setViewport(1440, 900);
+  });
+  afterEach(() => {
+    vi.restoreAllMocks();
+    delete store.state.zoConfig.query_history_enabled;
+    setViewport(1024, 768);
+    document.body.innerHTML = "";
+  });
+
+  it("opens under the caret line from the caret's x, like the editor's suggest widget", () => {
+    mountDropdown(editorWithCaret(FIRST_LINE_CARET).anchor);
+    const el = panel()!;
+    expect(el.dataset.side).toBe("below");
+    expect(px(el.style.top)).toBe(FIRST_LINE_CARET.bottom);
+    expect(px(el.style.left)).toBe(FIRST_LINE_CARET.left);
+    expect(el.style.bottom).toBe("");
+    expect(px(el.style.maxHeight)).toBe(900 - FIRST_LINE_CARET.bottom - 8);
+  });
+
+  it("shifts left to stay on-screen when the caret is near the right edge", async () => {
+    vi.spyOn(HTMLElement.prototype, "offsetWidth", "get").mockReturnValue(430);
+    mountDropdown(editorWithCaret({ left: 1300, top: 91, right: 1302, bottom: 109 }).anchor);
+    window.dispatchEvent(new Event("resize"));
+    await nextTick();
+    expect(px(panel()!.style.left)).toBe(1440 - 430 - 8);
+    expect(px(panel()!.style.top)).toBe(109);
+  });
+
+  it("flips above the caret line only when there is no room below, never covering it", () => {
+    const caret = { left: 200, top: 800, right: 202, bottom: 818 };
+    mountDropdown(editorWithCaret(caret).anchor);
+    const el = panel()!;
+    expect(el.dataset.side).toBe("above");
+    expect(px(el.style.bottom)).toBe(900 - caret.top);
+    expect(el.style.top).toBe("");
+    expect(px(el.style.left)).toBe(caret.left);
+    expect(px(el.style.maxHeight)).toBe(caret.top - 8);
+  });
+
+  it("stays below with the least room it needs, rather than flipping", () => {
+    const caret = { left: 200, top: 714, right: 202, bottom: 732 };
+    mountDropdown(editorWithCaret(caret).anchor);
+    expect(panel()!.dataset.side).toBe("below");
+    expect(px(panel()!.style.maxHeight)).toBe(160);
+  });
+
+  it("stays closed when there is room neither below nor above the caret line", async () => {
+    setViewport(1440, 200);
+    const wrapper = mountDropdown(
+      editorWithCaret({ left: 200, top: 90, right: 202, bottom: 108 }).anchor,
+    );
+    await nextTick();
+    expect(panel()).toBeNull();
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+  });
+
+  it("stays closed while the editor has no caret on screen", async () => {
+    const anchor = document.createElement("div");
+    document.body.appendChild(anchor);
+    const wrapper = mountDropdown(anchor);
+    await nextTick();
+    expect(panel()).toBeNull();
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+  });
+
+  it("follows the caret as Monaco moves it, without polling", async () => {
+    const { anchor, moveCaret } = editorWithCaret(FIRST_LINE_CARET);
+    mountDropdown(anchor);
+    moveCaret({ left: 420, top: 127, right: 422, bottom: 145 });
+    await settle();
+    await nextTick();
+    expect(px(panel()!.style.top)).toBe(145);
+    expect(px(panel()!.style.left)).toBe(420);
+  });
+
+  it("follows the editor when its page scrolls, and ignores scrolling elsewhere", async () => {
+    const { anchor, shiftCaret } = editorWithCaret(FIRST_LINE_CARET);
+    const page = document.createElement("div");
+    page.appendChild(anchor);
+    document.body.appendChild(page);
+    const elsewhere = document.createElement("div");
+    document.body.appendChild(elsewhere);
+    mountDropdown(anchor);
+    await settle();
+
+    shiftCaret({ left: 113, top: 300, right: 115, bottom: 318 });
+    elsewhere.dispatchEvent(new Event("scroll"));
+    await settle();
+    await nextTick();
+    expect(px(panel()!.style.top)).toBe(109);
+
+    page.dispatchEvent(new Event("scroll"));
+    await nextTick();
+    expect(px(panel()!.style.top)).toBe(318);
+  });
+
+  it("follows the editor when a banner mounts above it inside a container that keeps its size", async () => {
+    const { anchor, shiftCaret } = editorWithCaret(FIRST_LINE_CARET);
+    const column = document.createElement("div");
+    column.appendChild(anchor);
+    document.body.appendChild(column);
+    mountDropdown(anchor);
+    await settle();
+
+    shiftCaret({ left: 113, top: 141, right: 115, bottom: 159 });
+    column.insertBefore(document.createElement("div"), anchor);
+    await settle();
+    expect(px(panel()!.style.top)).toBe(159);
+  });
+
+  it("re-places on a synthetic window resize, as Metrics dispatches one after an edit", async () => {
+    const { anchor, shiftCaret } = editorWithCaret(FIRST_LINE_CARET);
+    const wrapper = mountDropdown(anchor);
+    shiftCaret({ left: 461, top: 649, right: 463, bottom: 667 });
+    window.dispatchEvent(new Event("resize"));
+    await nextTick();
+    expect(px(panel()!.style.top)).toBe(667);
+    expect(px(panel()!.style.left)).toBe(461);
+    expect(wrapper.emitted("update:open")).toBeUndefined();
+  });
+
+  it.each([
+    ["above the viewport", { left: 113, top: -60, right: 115, bottom: -42 }],
+    ["at the viewport top edge", { left: 113, top: -18, right: 115, bottom: 0 }],
+    ["below the viewport", { left: 113, top: 900, right: 115, bottom: 918 }],
+    ["far below the viewport", { left: 113, top: 1400, right: 115, bottom: 1418 }],
+  ])("never opens off-screen with the caret line %s", async (_where, caret) => {
+    const wrapper = mountDropdown(editorWithCaret(caret).anchor);
+    await nextTick();
+    expect(panel()).toBeNull();
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+  });
+
+  it.each([
+    ["above", { left: 113, top: -60, right: 115, bottom: -42 }],
+    ["below", { left: 113, top: 1000, right: 115, bottom: 1018 }],
+  ])("closes when the page scrolls the caret line %s the viewport", async (_where, caret) => {
+    const { anchor, moveCaret } = editorWithCaret(FIRST_LINE_CARET);
+    const wrapper = mountDropdown(anchor);
+    expect(panel()).not.toBeNull();
+    moveCaret(caret);
+    await settle();
+    await nextTick();
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+  });
+
+  it("closes once the caret scrolls out of reach", async () => {
+    const { anchor, moveCaret } = editorWithCaret(FIRST_LINE_CARET);
+    const wrapper = mountDropdown(anchor);
+    setViewport(1440, 300);
+    moveCaret({ left: 113, top: 130, right: 115, bottom: 148 });
+    await settle();
+    await nextTick();
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+  });
+});
+
+describe("RecentSearchesFocusDropdown outside clicks", () => {
+  beforeEach(() => {
+    store.state.zoConfig.query_history_enabled = true;
+    setViewport(1440, 900);
+  });
+  afterEach(() => {
+    delete store.state.zoConfig.query_history_enabled;
+    setViewport(1024, 768);
+    document.body.innerHTML = "";
+  });
+
+  it("closes on a pointerdown elsewhere and lets that click reach its target", async () => {
+    const picker = document.createElement("button");
+    document.body.appendChild(picker);
+    const onPicker = vi.fn();
+    picker.addEventListener("click", onPicker);
+    const seenPointerdown = vi.fn();
+    document.addEventListener("pointerdown", seenPointerdown);
+    const wrapper = mountDropdown(editorWithCaret(FIRST_LINE_CARET).anchor);
+    expect(panel()).not.toBeNull();
+
+    const down = new MouseEvent("pointerdown", { bubbles: true, cancelable: true });
+    picker.dispatchEvent(down);
+    picker.click();
+    await nextTick();
+
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+    expect(down.defaultPrevented).toBe(false);
+    expect(seenPointerdown).toHaveBeenCalledTimes(1);
+    expect(onPicker).toHaveBeenCalledTimes(1);
+    document.removeEventListener("pointerdown", seenPointerdown);
+  });
+
+  it("stays open on a pointerdown in the list's details pane, which lives outside the panel", async () => {
+    const pane = document.createElement("div");
+    document.body.appendChild(pane);
+    ownsNode.mockImplementation((node) => node === pane);
+    const wrapper = mountDropdown(editorWithCaret(FIRST_LINE_CARET).anchor);
+    pane.dispatchEvent(new MouseEvent("pointerdown", { bubbles: true }));
+    pane.dispatchEvent(new FocusEvent("focusin", { bubbles: true }));
+    await nextTick();
+    expect(wrapper.emitted("update:open")).toBeUndefined();
+    ownsNode.mockReset();
+    ownsNode.mockReturnValue(false);
+  });
+
+  it("stays open on a pointerdown in the editor or the panel", async () => {
+    const { anchor, monaco } = editorWithCaret(FIRST_LINE_CARET);
+    const wrapper = mountDropdown(anchor);
+    monaco.dispatchEvent(new MouseEvent("pointerdown", { bubbles: true }));
+    panel()!.dispatchEvent(new MouseEvent("pointerdown", { bubbles: true }));
+    await nextTick();
+    expect(wrapper.emitted("update:open")).toBeUndefined();
+    expect(panel()).not.toBeNull();
+  });
+});
+
+describe("RecentSearchesFocusDropdown when the editor resizes while open", () => {
+  const observers: {
+    callback: ResizeObserverCallback;
+    targets: Element[];
+    boxes: (ResizeObserverBoxOptions | undefined)[];
+  }[] = [];
+  const RealResizeObserver = globalThis.ResizeObserver;
+
+  beforeEach(() => {
+    store.state.zoConfig.query_history_enabled = true;
+    setViewport(1440, 900);
+    observers.length = 0;
+    globalThis.ResizeObserver = class {
+      private entry: (typeof observers)[number];
+      constructor(callback: ResizeObserverCallback) {
+        this.entry = { callback, targets: [], boxes: [] };
+        observers.push(this.entry);
+      }
+      observe(target: Element, options?: ResizeObserverOptions) {
+        this.entry.targets.push(target);
+        this.entry.boxes.push(options?.box);
+      }
+      unobserve() {}
+      disconnect() {
+        this.entry.targets = [];
+      }
+    } as unknown as typeof ResizeObserver;
+  });
+  afterEach(() => {
+    globalThis.ResizeObserver = RealResizeObserver;
+    delete store.state.zoConfig.query_history_enabled;
+    setViewport(1024, 768);
+    document.body.innerHTML = "";
+  });
+
+  const fireResize = () =>
+    observers.forEach((o) => {
+      if (o.targets.length) o.callback([], {} as ResizeObserver);
+    });
+
+  it("stays at the caret as the editor re-lays out, and closes once it would go off-screen", async () => {
+    const { anchor, moveCaret } = editorWithCaret(FIRST_LINE_CARET);
+    const wrapper = mountDropdown(anchor);
+    const active = observers.find((o) => o.targets.length);
+    expect(active?.targets).toEqual([anchor]);
+    expect(active?.boxes).toEqual(["border-box"]);
+
+    moveCaret({ left: 113, top: 300, right: 115, bottom: 318 });
+    fireResize();
+    await nextTick();
+    expect(px(panel()!.style.top)).toBe(318);
+
+    setViewport(1440, 240);
+    moveCaret({ left: 113, top: 100, right: 115, bottom: 118 });
+    fireResize();
+    await nextTick();
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+  });
+});
diff --git a/web/src/components/queryHistory/RecentSearchesFocusDropdown.vue b/web/src/components/queryHistory/RecentSearchesFocusDropdown.vue
new file mode 100644
index 0000000000..ca6e7a1d05
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesFocusDropdown.vue
@@ -0,0 +1,219 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <Teleport to="body">
+    <div
+      v-if="open && enabled && placement"
+      ref="panelRef"
+      class="bg-select-content-bg border-dropdown-border rounded-default fixed flex flex-col overflow-hidden border shadow-lg"
+      :style="position"
+      :data-side="placement.side"
+      data-test="recent-searches-focus-dropdown"
+    >
+      <RecentSearchesPopover
+        ref="listRef"
+        :source="source"
+        :active="open"
+        :examples="examples"
+        @run="(entry, when) => close(() => emit('run', entry, when))"
+        @load="(entry, when) => close(() => emit('load', entry, when))"
+        @view-all="(status) => close(() => emit('view-all', status))"
+        @example="(query) => close(() => emit('example', query))"
+        @close="close(() => emit('dismiss'))"
+      />
+    </div>
+  </Teleport>
+</template>
+
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref, watch } from "vue";
+import { useRecentSearches } from "@/composables/queryHistory/useRecentSearches";
+import type { HistorySource, HistoryStatus, QueryHistoryEntry } from "@/services/query_history";
+import { isQueryEditorInput, type RestoreTime } from "@/utils/queryHistory/recentSearches";
+import { observeMoves } from "@/utils/queryHistory/observeMoves";
+import RecentSearchesPopover from "./RecentSearchesPopover.vue";
+
+// OPopover focuses its content on open; this panel must leave focus in the editor.
+const DROPDOWN_Z_INDEX = 6000;
+const EDGE_GAP_PX = 8;
+const MIN_ROOM_PX = 160;
+const CARET_SELECTOR = ".monaco-editor .cursors-layer .cursor";
+
+const props = withDefaults(
+  defineProps<{
+    source: HistorySource;
+    anchor: HTMLElement | null;
+    examples?: string[];
+  }>(),
+  { examples: () => [] },
+);
+
+const emit = defineEmits<{
+  run: [entry: QueryHistoryEntry, when: RestoreTime];
+  load: [entry: QueryHistoryEntry, when: RestoreTime];
+  "view-all": [status: HistoryStatus | null];
+  example: [query: string];
+  dismiss: [];
+}>();
+
+const open = defineModel<boolean>("open", { default: false });
+
+const { enabled } = useRecentSearches();
+const panelRef = ref<HTMLElement | null>(null);
+const listRef = ref<InstanceType<typeof RecentSearchesPopover> | null>(null);
+
+interface Placement {
+  side: "below" | "above";
+  viewportOffset: number;
+  left: number;
+  maxHeight: number;
+}
+const placement = ref<Placement | null>(null);
+
+const position = computed(() => {
+  const at = placement.value;
+  if (!at) return { zIndex: DROPDOWN_Z_INDEX };
+  return {
+    [at.side === "below" ? "top" : "bottom"]: `${at.viewportOffset}px`,
+    left: `${at.left}px`,
+    maxHeight: `${at.maxHeight}px`,
+    zIndex: DROPDOWN_Z_INDEX,
+  };
+});
+
+const caretRect = () => props.anchor?.querySelector(CARET_SELECTOR)?.getBoundingClientRect();
+
+const place = (): Placement | null => {
+  const caret = caretRect();
+  if (!caret || caret.bottom <= 0 || caret.top >= window.innerHeight) return null;
+  const width = panelRef.value?.offsetWidth ?? 0;
+  const left = Math.max(EDGE_GAP_PX, Math.min(caret.left, window.innerWidth - width - EDGE_GAP_PX));
+  const roomBelow = window.innerHeight - caret.bottom - EDGE_GAP_PX;
+  if (roomBelow >= MIN_ROOM_PX) {
+    return { side: "below", viewportOffset: caret.bottom, left, maxHeight: roomBelow };
+  }
+  const roomAbove = caret.top - EDGE_GAP_PX;
+  if (roomAbove >= MIN_ROOM_PX) {
+    return {
+      side: "above",
+      viewportOffset: window.innerHeight - caret.top,
+      left,
+      maxHeight: roomAbove,
+    };
+  }
+  return null;
+};
+
+const close = (then: () => void) => {
+  open.value = false;
+  then();
+};
+
+// Only the editor's text surface keeps the panel open; the AI prompt and buttons in the same box do not.
+const onOutside = (event: Event) => {
+  const target = event.target as Node | null;
+  if (target && panelRef.value?.contains(target)) return;
+  if (listRef.value?.ownsNode(target)) return;
+  if (target && props.anchor?.contains(target) && isQueryEditorInput(target)) return;
+  open.value = false;
+};
+
+let placedCaret = "";
+let stopObserving: (() => void) | null = null;
+let panelSizes: ResizeObserver | null = null;
+
+const caretKey = () => {
+  const caret = caretRect();
+  const width = panelRef.value?.offsetWidth ?? 0;
+  if (!caret) return "";
+  return `${caret.left}|${caret.top}|${caret.bottom}|${width}|${window.innerWidth}|${window.innerHeight}`;
+};
+
+const reposition = () => {
+  if (!open.value) return;
+  placement.value = place();
+  placedCaret = caretKey();
+  if (!placement.value) open.value = false;
+};
+
+// Editors rewrite inline styles on every keystroke and paint, so only a real move re-places the panel.
+const repositionIfMoved = () => {
+  if (open.value && caretKey() !== placedCaret) reposition();
+};
+
+const listen = (on: boolean) => {
+  const method = on ? "addEventListener" : "removeEventListener";
+  document[method]("pointerdown", onOutside, true);
+  document[method]("focusin", onOutside, true);
+};
+
+// Monaco moves its caret, and scrolls its lines, by rewriting inline styles inside the editor.
+const observe = (anchor: HTMLElement | null) => {
+  stopObserving?.();
+  stopObserving = anchor ? observeMoves(anchor, repositionIfMoved, { subtreeStyles: true }) : null;
+};
+
+watch(panelRef, (panel) => {
+  panelSizes?.disconnect();
+  panelSizes = null;
+  if (!panel || typeof ResizeObserver === "undefined") return;
+  panelSizes = new ResizeObserver(repositionIfMoved);
+  panelSizes.observe(panel);
+});
+
+watch(
+  open,
+  (isOpen) => {
+    placement.value = isOpen ? place() : null;
+    if (isOpen && !placement.value) {
+      open.value = false;
+      return;
+    }
+    placedCaret = isOpen ? caretKey() : "";
+    listen(isOpen);
+    observe(isOpen ? props.anchor : null);
+  },
+  { immediate: true },
+);
+
+// The anchor arrives with the editor's focus; the open watcher does the first placement.
+watch(
+  () => props.anchor,
+  (anchor) => {
+    if (!open.value || !placement.value) return;
+    observe(anchor);
+    reposition();
+  },
+);
+
+onBeforeUnmount(() => {
+  listen(false);
+  observe(null);
+  panelSizes?.disconnect();
+});
+
+/** Moves focus from the editor into the list; false when there is no row to focus. */
+const focusFirst = () => listRef.value?.focusFirst() ?? false;
+
+/** Runs, or with Shift loads, the hovered row while focus is still in the editor. */
+const pickActive = (event: KeyboardEvent) => listRef.value?.pickActive(event) ?? false;
+
+/** Pages the active row's details; false when no row is active, so the editor keeps the key. */
+const scrollDetails = (step: 1 | -1) => listRef.value?.scrollDetails(step) ?? false;
+
+defineExpose({ focusFirst, pickActive, scrollDetails });
+</script>
diff --git a/web/src/components/queryHistory/RecentSearchesPopover.spec.ts b/web/src/components/queryHistory/RecentSearchesPopover.spec.ts
new file mode 100644
index 0000000000..8f55b1b572
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesPopover.spec.ts
@@ -0,0 +1,1287 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { enableAutoUnmount, flushPromises, mount } from "@vue/test-utils";
+import { nextTick } from "vue";
+import store from "@/test/unit/helpers/store";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { b64EncodeUnicode } from "@/utils/formatters";
+
+const api = vi.hoisted(() => ({
+  list: vi.fn(),
+  count: vi.fn(),
+  record: vi.fn(),
+  star: vi.fn(),
+  remove: vi.fn(),
+  clear: vi.fn(),
+}));
+vi.mock("@/services/query_history", () => ({ default: api }));
+const clipboard = vi.hoisted(() => ({ copyToClipboard: vi.fn().mockResolvedValue(true) }));
+vi.mock("@/utils/clipboard", () => clipboard);
+
+import RecentSearchesPopover from "./RecentSearchesPopover.vue";
+import RecentSearchesButton from "./RecentSearchesButton.vue";
+import RecentSearchesFocusDropdown from "./RecentSearchesFocusDropdown.vue";
+import { placeCaret } from "@/test/unit/helpers/monacoCaret";
+import {
+  routeEditorKeyToRecents,
+  type RecentsKeyTarget,
+} from "@/utils/queryHistory/recentSearches";
+
+enableAutoUnmount(afterEach);
+
+const NOW_US = Date.now() * 1000;
+
+const setWidths = (el: Element, scrollWidth: number, clientWidth: number) => {
+  Object.defineProperty(el, "scrollWidth", { configurable: true, value: scrollWidth });
+  Object.defineProperty(el, "clientWidth", { configurable: true, value: clientWidth });
+};
+const HOUR_US = 3_600_000_000;
+
+const setViewport = (width: number, height: number) => {
+  Object.defineProperty(window, "innerWidth", { configurable: true, value: width });
+  Object.defineProperty(window, "innerHeight", { configurable: true, value: height });
+};
+
+// The focus dropdown opens at Monaco's caret element, so every editor box here carries one.
+const editorBox = () => {
+  const box = document.createElement("div");
+  const monaco = document.createElement("div");
+  monaco.className = "monaco-editor";
+  const layer = document.createElement("div");
+  layer.className = "cursors-layer";
+  const cursor = document.createElement("div");
+  cursor.className = "cursor";
+  placeCaret(cursor);
+  layer.appendChild(cursor);
+  monaco.appendChild(layer);
+  box.appendChild(monaco);
+  document.body.appendChild(box);
+  return { box, monaco };
+};
+
+const row = (i: number, overrides: Partial<QueryHistoryEntry> = {}): QueryHistoryEntry => ({
+  id: `e${i}`,
+  source: "logs",
+  query: `q${i}`,
+  query_key: "k",
+  streams: ["k8s"],
+  context: {},
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: NOW_US - i * HOUR_US,
+  updated_at: NOW_US - i * HOUR_US,
+  ...overrides,
+});
+
+const mountPopover = (props: Record<string, unknown> = {}) =>
+  mount(RecentSearchesPopover, {
+    props: { source: "logs", active: true, ...props },
+    global: { plugins: [store], stubs: { OTimeCell: true, OTooltip: true } },
+  });
+
+const rowIds = (wrapper: ReturnType<typeof mountPopover>) =>
+  wrapper
+    .findAll('[data-test^="recent-searches-row-"]')
+    .map((r) => r.attributes("data-test")?.replace("recent-searches-row-", ""));
+
+describe("RecentSearchesPopover", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    api.count.mockResolvedValue({ data: { count: 0 } });
+    store.state.zoConfig.query_history_enabled = true;
+  });
+  afterEach(() => {
+    delete store.state.zoConfig.query_history_enabled;
+  });
+
+  it("asks for this page's recents and shows 8 rows", async () => {
+    api.list.mockResolvedValue({ data: Array.from({ length: 12 }, (_, i) => row(i)) });
+    const wrapper = mountPopover();
+    await flushPromises();
+    expect(api.list).toHaveBeenCalledWith("default", { source: "logs", status: "ok", limit: 8 });
+    expect(rowIds(wrapper)).toEqual(["e0", "e1", "e2", "e3", "e4", "e5", "e6", "e7"]);
+  });
+
+  it("downloads only the 8 successful rows and the newest run, and counts failures on the server", async () => {
+    api.list.mockImplementation((_org: string, params: { status?: string; limit: number }) =>
+      Promise.resolve({
+        data: params.status
+          ? Array.from({ length: params.limit }, (_, i) => row(i + 1))
+          : [row(0, { status: "error" })],
+      }),
+    );
+    api.count.mockResolvedValue({ data: { count: 4 } });
+    const wrapper = mountPopover();
+    await flushPromises();
+    expect(api.list.mock.calls.map(([, params]) => params)).toEqual([
+      { source: "logs", status: "ok", limit: 8 },
+      { source: "logs", limit: 1 },
+    ]);
+    expect(api.count).toHaveBeenCalledWith("default", { source: "logs", status: "error" });
+    expect(wrapper.find('[data-test="recent-searches-pinned-failure"]').text()).toContain("q0");
+    expect(rowIds(wrapper)).toEqual(["e1", "e2", "e3", "e4", "e5", "e6", "e7"]);
+    expect(wrapper.find('[data-test="recent-searches-view-failed"]').text()).toBe("3 failed");
+  });
+
+  it("fetches nothing while inactive", async () => {
+    mountPopover({ active: false });
+    await flushPromises();
+    expect(api.list).not.toHaveBeenCalled();
+    expect(api.count).not.toHaveBeenCalled();
+  });
+
+  it("pins the latest failure with its error and Load to fix, and counts older failures", async () => {
+    api.list.mockResolvedValue({
+      data: [
+        row(0, { status: "error", context: { error: "syntax error near level" } }),
+        row(1),
+        row(2, { status: "error" }),
+      ],
+    });
+    api.count.mockResolvedValue({ data: { count: 2 } });
+    const wrapper = mountPopover();
+    await flushPromises();
+    const pinned = wrapper.find('[data-test="recent-searches-pinned-failure"]');
+    expect(pinned.text()).toContain("q0");
+    expect(pinned.text()).toContain("syntax error near level");
+    expect(rowIds(wrapper)).toEqual(["e1"]);
+
+    await wrapper.find('[data-test="recent-searches-load-to-fix"]').trigger("click");
+    expect(wrapper.emitted("load")?.[0]?.[0]).toMatchObject({ id: "e0" });
+
+    await wrapper.find('[data-test="recent-searches-view-failed"]').trigger("click");
+    expect(wrapper.emitted("view-all")?.[0]).toEqual(["error"]);
+  });
+
+  it("keeps the key hint and the privacy/retention note behind the header info icon", async () => {
+    api.list.mockResolvedValue({ data: [row(0)] });
+    store.state.zoConfig.query_history_retention_days = 14;
+    const wrapper = mountPopover();
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-key-hints"]').exists()).toBe(false);
+    const about = wrapper.find('[data-test="recent-searches-about"]').attributes("aria-label")!;
+    expect(about).toContain("Shift+Enter load only");
+    expect(about).toContain("Enter run");
+    expect(about).not.toMatch(/[⇧⇥]|Tab/);
+    expect(about).toContain("Only your searches in default, visible only to you");
+    expect(about).toContain("Kept 14 days");
+    expect(wrapper.text()).not.toContain("visible only to you");
+    expect(wrapper.find('[data-test="recent-searches-view-all"]').exists()).toBe(true);
+    delete store.state.zoConfig.query_history_retention_days;
+  });
+
+  it.each([
+    [1, "Kept 1 day;"],
+    [7, "Kept 7 days;"],
+    [0, "Kept until deleted."],
+    [-1, "Kept until deleted."],
+  ])("states a retention of %s as %s", async (days, text) => {
+    api.list.mockResolvedValue({ data: [row(0)] });
+    store.state.zoConfig.query_history_retention_days = days;
+    const wrapper = mountPopover();
+    await flushPromises();
+    const about = wrapper.find('[data-test="recent-searches-about"]').attributes("aria-label")!;
+    expect(about).toContain(text);
+    expect(about).not.toMatch(/\b1 days\b|\b0 days\b/);
+    delete store.state.zoConfig.query_history_retention_days;
+  });
+
+  it("shows the hint and the note in the tooltip on hover", async () => {
+    api.list.mockResolvedValue({ data: [row(0)] });
+    const wrapper = mount(RecentSearchesPopover, {
+      props: { source: "logs", active: true },
+      global: { plugins: [store], stubs: { OTimeCell: true } },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    vi.useFakeTimers();
+    const info = wrapper.find('[data-test="recent-searches-about"]').element;
+    [info, ...info.querySelectorAll("*")].forEach((el) =>
+      el.dispatchEvent(new MouseEvent("mouseenter")),
+    );
+    vi.advanceTimersByTime(700);
+    await nextTick();
+    await nextTick();
+    const bubble = document.body.querySelector('[data-test="o-tooltip-content"]');
+    expect(bubble?.textContent).toContain("Esc close");
+    expect(bubble?.textContent).toContain("visible only to you");
+    vi.useRealTimers();
+    wrapper.unmount();
+  });
+
+  describe("the pinned failure's error line", () => {
+    const message = `Search field not found: Valid fields are ${"f, ".repeat(80)}`;
+    const mountWithRealTooltip = async () => {
+      api.list.mockResolvedValue({
+        data: [row(0, { status: "error", context: { error: message } })],
+      });
+      const wrapper = mount(RecentSearchesPopover, {
+        props: { source: "logs", active: true },
+        global: { plugins: [store], stubs: { OTimeCell: true } },
+        attachTo: document.body,
+      });
+      await flushPromises();
+      return wrapper.find('[data-test="recent-searches-pinned-error"]').element as HTMLElement;
+    };
+    const hover = async (el: HTMLElement) => {
+      el.dispatchEvent(new MouseEvent("mouseenter"));
+      vi.advanceTimersByTime(700);
+      await nextTick();
+      await nextTick();
+    };
+    const bubble = () => document.body.querySelector('[data-test="o-tooltip-content"]');
+
+    afterEach(() => vi.useRealTimers());
+
+    it("shows the whole message on hover when the line is cut", async () => {
+      const line = await mountWithRealTooltip();
+      vi.useFakeTimers();
+      setWidths(line, 900, 300);
+      await hover(line);
+      expect(bubble()?.textContent).toContain(message.trim());
+    });
+
+    it("shows no tooltip when the message fits", async () => {
+      const line = await mountWithRealTooltip();
+      vi.useFakeTimers();
+      setWidths(line, 300, 300);
+      await hover(line);
+      expect(bubble()).toBeNull();
+    });
+  });
+
+  it("runs on click and only loads on shift-click", async () => {
+    api.list.mockResolvedValue({ data: [row(0)] });
+    const wrapper = mountPopover();
+    await flushPromises();
+    await wrapper.find('[data-test="recent-searches-row-e0"]').trigger("click");
+    expect(wrapper.emitted("run")?.[0]).toEqual([expect.objectContaining({ id: "e0" }), "now"]);
+    await wrapper.find('[data-test="recent-searches-row-e0"]').trigger("click", { shiftKey: true });
+    expect(wrapper.emitted("load")?.[0]?.[0]).toMatchObject({ id: "e0" });
+  });
+
+  it("runs on Enter, loads on Shift+Enter, and leaves Ctrl/Cmd+Enter to the page's run shortcut", async () => {
+    api.list.mockResolvedValue({ data: [row(0)] });
+    const wrapper = mountPopover();
+    await flushPromises();
+    const rowBtn = wrapper.find('[data-test="recent-searches-row-e0"]');
+    await rowBtn.trigger("keydown", { key: "Enter", ctrlKey: true });
+    await rowBtn.trigger("keydown", { key: "Enter", metaKey: true });
+    expect(wrapper.emitted("run")).toBeUndefined();
+    expect(wrapper.emitted("load")).toBeUndefined();
+    await rowBtn.trigger("keydown", { key: "Enter" });
+    expect(wrapper.emitted("run")).toHaveLength(1);
+    await rowBtn.trigger("keydown", { key: "Enter", shiftKey: true });
+    expect(wrapper.emitted("load")).toHaveLength(1);
+    expect(wrapper.emitted("run")).toHaveLength(1);
+  });
+
+  it("re-runs a row from an earlier day at its original time", async () => {
+    api.list.mockResolvedValue({ data: [row(0, { updated_at: NOW_US - 72 * HOUR_US })] });
+    const wrapper = mountPopover();
+    await flushPromises();
+    await wrapper.find('[data-test="recent-searches-row-e0"]').trigger("click");
+    expect(wrapper.emitted("run")?.[0]?.[1]).toBe("original");
+  });
+
+  it("shows the first-time empty state with examples", async () => {
+    api.list.mockResolvedValue({ data: [] });
+    const wrapper = mountPopover({ examples: ["match_all('error')", "match_all('timeout')"] });
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-empty"]').exists()).toBe(true);
+    await wrapper.find('[data-test="recent-searches-example-1"]').trigger("click");
+    expect(wrapper.emitted("example")?.[0]).toEqual(["match_all('timeout')"]);
+  });
+
+  it("offers a retry when the list fails to load", async () => {
+    api.list.mockRejectedValueOnce(new Error("down")).mockResolvedValue({ data: [row(0)] });
+    const wrapper = mountPopover();
+    await flushPromises();
+    expect(wrapper.find('[data-test="recent-searches-error"]').exists()).toBe(true);
+  });
+});
+
+describe("the editor's suggest widget look", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.zoConfig.query_history_enabled = true;
+  });
+  afterEach(() => {
+    delete store.state.zoConfig.query_history_enabled;
+  });
+
+  it("renders rows at the suggest widget's height with an icon, a monospace one-line query and the time at the end", async () => {
+    api.list.mockResolvedValue({
+      data: [row(0, { query: "SELECT *\n  FROM k8s" }), row(1, { starred: true })],
+    });
+    const wrapper = mountPopover();
+    await flushPromises();
+    const first = wrapper.find('[data-test="recent-searches-row-e0"]');
+    expect(first.classes()).toEqual(expect.arrayContaining(["h-6", "flex", "items-center"]));
+    const parts = first.element.children;
+    expect(parts[0].className).toContain("size-4");
+    expect(parts[0].children).toHaveLength(1);
+    expect(parts[1].className).toContain("font-mono");
+    expect(parts[1].textContent?.trim()).toBe("SELECT * FROM k8s");
+    expect(parts[parts.length - 1].tagName.toLowerCase()).toBe("o-time-cell-stub");
+    expect(parts[parts.length - 1].getAttribute("mode")).toBe("relative");
+    expect(wrapper.find('[data-test="recent-searches-list"]').classes()).toEqual(
+      expect.arrayContaining(["max-h-72", "overflow-auto"]),
+    );
+  });
+});
+
+describe("the details pane for the active row", () => {
+  const QUERY = [
+    "SELECT kubernetes_namespace_name,",
+    "       count(*) AS hits",
+    '  FROM "k8s_logs"',
+    "  -- only errors",
+    " WHERE level = 'error'",
+    " GROUP BY 1",
+  ].join("\n");
+  const details = () =>
+    document.querySelector<HTMLElement>('[data-test="recent-searches-details"]');
+  const detailsQuery = () =>
+    document.querySelector<HTMLElement>('[data-test="recent-searches-details-query"]');
+  const rowEl = (id: string) =>
+    document.querySelector<HTMLElement>(`[data-test="recent-searches-row-${id}"]`)!;
+  const hover = async (id: string) => {
+    rowEl(id).dispatchEvent(new PointerEvent("pointerenter"));
+    await flushPromises();
+  };
+  const press = (target: Element, key: string) =>
+    target.dispatchEvent(new KeyboardEvent("keydown", { key, bubbles: true }));
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.zoConfig.query_history_enabled = true;
+    setViewport(1440, 900);
+    api.list.mockResolvedValue({
+      data: [
+        row(0, {
+          query: QUERY,
+          streams: ["k8s_logs"],
+          run_count: 3,
+          context: { time: { type: "relative", period: "1h", start_time: 0, end_time: 0 } },
+        }),
+        row(1, { query: "level = 'warn'\n  AND code = 500" }),
+      ],
+    });
+  });
+  afterEach(() => {
+    delete store.state.zoConfig.query_history_enabled;
+    setViewport(1024, 768);
+    document.body.innerHTML = "";
+  });
+
+  const mountAttached = async () => {
+    const wrapper = mount(RecentSearchesPopover, {
+      props: { source: "logs", active: true },
+      global: { plugins: [store], stubs: { OTimeCell: true, OTooltip: true } },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    return wrapper;
+  };
+
+  it("renders nothing until a row is hovered or focused", async () => {
+    await mountAttached();
+    expect(details()).toBeNull();
+  });
+
+  it("shows the hovered row's full query exactly as stored, with its line breaks and comments", async () => {
+    await mountAttached();
+    await hover("e0");
+    expect(detailsQuery()!.tagName.toLowerCase()).toBe("pre");
+    expect(detailsQuery()!.textContent).toBe(QUERY);
+    expect(detailsQuery()!.className).toEqual(expect.stringContaining("whitespace-pre"));
+    expect(detailsQuery()!.className).toEqual(expect.stringContaining("font-mono"));
+    expect(detailsQuery()!.className).toEqual(expect.stringContaining("overflow-auto"));
+    const meta = document.querySelector('[data-test="recent-searches-details-meta"]')!.textContent;
+    expect(meta).toContain("k8s_logs");
+    expect(meta).toContain("Last 1h");
+    expect(meta).toContain("ran 3x");
+    expect(document.querySelectorAll('[data-test="recent-searches-details"]')).toHaveLength(1);
+  });
+
+  it("wraps long lines inside the query's own scroll, with the meta and error in an opaque footer outside it", async () => {
+    const longLine = `GROUP BY ${"k8s_namespace_name, k8s_pod_name, level, status, ".repeat(4)}`;
+    api.list.mockResolvedValue({
+      data: [
+        row(0, {
+          status: "error",
+          query: `SELECT *\n  FROM k8s_logs\n${longLine}\nORDER BY 1`,
+          context: { error: "Search field not found" },
+        }),
+      ],
+    });
+    await mountAttached();
+    document
+      .querySelector('[data-test="recent-searches-pinned-failure"]')!
+      .dispatchEvent(new PointerEvent("pointerenter"));
+    await flushPromises();
+    const pane = details()!;
+    const query = detailsQuery()!;
+    const footer = document.querySelector<HTMLElement>(
+      '[data-test="recent-searches-details-footer"]',
+    )!;
+    expect(query.className.split(" ")).toEqual(
+      expect.arrayContaining([
+        "whitespace-pre-wrap",
+        "wrap-anywhere",
+        "overflow-auto",
+        "min-h-0",
+        "flex-1",
+      ]),
+    );
+    expect(query.className.split(" ")).not.toContain("whitespace-pre");
+    expect(query.textContent).toBe(`SELECT *\n  FROM k8s_logs\n${longLine}\nORDER BY 1`);
+    expect(pane.className.split(" ")).toEqual(
+      expect.arrayContaining(["flex-col", "overflow-hidden"]),
+    );
+    expect(pane.children).toHaveLength(2);
+    expect(pane.children[0].contains(query)).toBe(true);
+    expect(pane.children[1]).toBe(footer);
+    expect(query.contains(footer)).toBe(false);
+    expect(footer.className.split(" ")).toEqual(
+      expect.arrayContaining(["shrink-0", "bg-select-content-bg", "border-t"]),
+    );
+    expect(footer.querySelector('[data-test="recent-searches-details-meta"]')).not.toBeNull();
+    expect(footer.querySelector('[data-test="recent-searches-details-error"]')).not.toBeNull();
+  });
+
+  it("shows a failed row's status and error message", async () => {
+    api.list.mockResolvedValue({
+      data: [row(0, { status: "error", query: "level =\n", context: { error: "syntax error" } })],
+    });
+    await mountAttached();
+    document
+      .querySelector('[data-test="recent-searches-pinned-failure"]')!
+      .dispatchEvent(new PointerEvent("pointerenter"));
+    await flushPromises();
+    expect(detailsQuery()!.textContent).toBe("level =\n");
+    expect(
+      document.querySelector('[data-test="recent-searches-details-meta"]')!.textContent,
+    ).toContain("Failed");
+    expect(
+      document.querySelector('[data-test="recent-searches-details-error"]')!.textContent?.trim(),
+    ).toBe("syntax error");
+  });
+
+  it("follows the keyboard-active row on ArrowDown and ArrowUp", async () => {
+    const wrapper = await mountAttached();
+    (wrapper.vm as unknown as { focusFirst: () => boolean }).focusFirst();
+    await flushPromises();
+    expect(detailsQuery()!.textContent).toBe(QUERY);
+
+    press(document.activeElement!, "ArrowDown");
+    await flushPromises();
+    expect(document.activeElement).toBe(rowEl("e1"));
+    expect(detailsQuery()!.textContent).toBe("level = 'warn'\n  AND code = 500");
+
+    press(document.activeElement!, "ArrowUp");
+    await flushPromises();
+    expect(detailsQuery()!.textContent).toBe(QUERY);
+  });
+
+  describe("hover across the gap to the pane", () => {
+    afterEach(() => vi.useRealTimers());
+    const list = () => document.querySelector('[data-test="recent-searches-list"]')!;
+    const leave = (from: Element, to: Element | null) =>
+      from.dispatchEvent(new PointerEvent("pointerleave", { relatedTarget: to }));
+
+    it("keeps the pane while the pointer crosses the gap and enters it", async () => {
+      await mountAttached();
+      await hover("e0");
+      vi.useFakeTimers();
+      leave(list(), document.body);
+      vi.advanceTimersByTime(80);
+      details()!.dispatchEvent(new PointerEvent("pointerenter"));
+      vi.advanceTimersByTime(1000);
+      await nextTick();
+      expect(detailsQuery()!.textContent).toBe(QUERY);
+    });
+
+    it("keeps the pane when the pointer goes straight from the list into it", async () => {
+      await mountAttached();
+      await hover("e0");
+      vi.useFakeTimers();
+      leave(list(), details());
+      vi.advanceTimersByTime(1000);
+      await nextTick();
+      expect(details()).not.toBeNull();
+    });
+
+    it("drops the pane shortly after the pointer leaves both for elsewhere", async () => {
+      await mountAttached();
+      await hover("e0");
+      vi.useFakeTimers();
+      leave(list(), document.body);
+      vi.advanceTimersByTime(80);
+      await nextTick();
+      expect(details()).not.toBeNull();
+      vi.advanceTimersByTime(200);
+      await nextTick();
+      expect(details()).toBeNull();
+    });
+
+    it("drops the pane after the pointer leaves it for elsewhere", async () => {
+      await mountAttached();
+      await hover("e0");
+      vi.useFakeTimers();
+      details()!.dispatchEvent(new PointerEvent("pointerenter"));
+      leave(details()!, document.body);
+      vi.advanceTimersByTime(300);
+      await nextTick();
+      expect(details()).toBeNull();
+    });
+  });
+
+  describe("placement beside the list", () => {
+    const placeRoot = async (box: { left: number; top: number; right: number; bottom: number }) => {
+      await mountAttached();
+      const root = document.querySelector<HTMLElement>('[data-test="recent-searches-popover"]')!;
+      root.getBoundingClientRect = () =>
+        ({
+          ...box,
+          x: box.left,
+          y: box.top,
+          width: box.right - box.left,
+          height: box.bottom - box.top,
+        }) as DOMRect;
+      await hover("e0");
+      const style = details()!.style;
+      return {
+        left: parseFloat(style.left),
+        top: parseFloat(style.top),
+        width: parseFloat(style.width),
+        maxHeight: parseFloat(style.maxHeight),
+      };
+    };
+
+    it("docks to the right of the list, top-aligned, with its own capped height", async () => {
+      const at = await placeRoot({ left: 113, top: 110, right: 543, bottom: 400 });
+      expect(at).toEqual({ left: 547, top: 110, width: 400, maxHeight: 320 });
+    });
+
+    it("flips to the left when there is no room on the right", async () => {
+      const at = await placeRoot({ left: 900, top: 110, right: 1330, bottom: 400 });
+      expect(at.left).toBe(900 - 4 - 400);
+      expect(at.top).toBe(110);
+    });
+
+    it.each([
+      ["a tall pane rises just enough to stay on-screen", 320, 900 - 8 - 320],
+      ["a short pane that fits stays level with the list", 73, 668],
+    ])("beside a list low on the screen, %s", async (_case, height, top) => {
+      vi.spyOn(HTMLElement.prototype, "offsetHeight", "get").mockReturnValue(height);
+      try {
+        const at = await placeRoot({ left: 461, top: 668, right: 891, bottom: 794 });
+        expect(at.left).toBe(895);
+        expect(at.top).toBe(top);
+        expect(at.maxHeight).toBe(320);
+      } finally {
+        vi.restoreAllMocks();
+      }
+    });
+
+    it("drops below the list when neither side has room, and caps its height to the viewport", async () => {
+      setViewport(800, 700);
+      const at = await placeRoot({ left: 200, top: 110, right: 630, bottom: 400 });
+      expect(at.left).toBe(200);
+      expect(at.top).toBe(404);
+      expect(at.maxHeight).toBe(700 - 404 - 8);
+    });
+  });
+});
+
+describe("long queries in the details pane", () => {
+  const LONG = Array.from({ length: 40 }, (_, i) =>
+    i === 0 ? "SELECT" : i === 39 ? "LIMIT 100" : `  col_${i},`,
+  ).join("\n");
+  const details = () =>
+    document.querySelector<HTMLElement>('[data-test="recent-searches-details"]');
+  const query = () =>
+    document.querySelector<HTMLElement>('[data-test="recent-searches-details-query"]')!;
+  const rowEl = (id: string) =>
+    document.querySelector<HTMLElement>(`[data-test="recent-searches-row-${id}"]`)!;
+  const hover = async (id: string) => {
+    rowEl(id).dispatchEvent(new PointerEvent("pointerenter"));
+    await flushPromises();
+  };
+  const key = (target: Element, name: string) => {
+    const event = new KeyboardEvent("keydown", { key: name, bubbles: true, cancelable: true });
+    target.dispatchEvent(event);
+    return event;
+  };
+  const setScroll = (el: HTMLElement, clientHeight: number, scrollHeight: number) => {
+    Object.defineProperty(el, "clientHeight", { configurable: true, value: clientHeight });
+    Object.defineProperty(el, "scrollHeight", { configurable: true, value: scrollHeight });
+  };
+  const placeRoot = (box: { left: number; top: number; right: number; bottom: number }) => {
+    const root = document.querySelector<HTMLElement>('[data-test="recent-searches-popover"]')!;
+    root.getBoundingClientRect = () =>
+      ({
+        ...box,
+        x: box.left,
+        y: box.top,
+        width: box.right - box.left,
+        height: box.bottom - box.top,
+      }) as DOMRect;
+  };
+  const mountAttached = async () => {
+    const wrapper = mount(RecentSearchesPopover, {
+      props: { source: "logs", active: true },
+      global: { plugins: [store], stubs: { OTimeCell: true, OTooltip: true } },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    return wrapper;
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.zoConfig.query_history_enabled = true;
+    setViewport(1440, 900);
+    api.list.mockResolvedValue({
+      data: [row(0, { query: LONG }), row(1, { query: "level='error'" })],
+    });
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    delete store.state.zoConfig.query_history_enabled;
+    setViewport(1024, 768);
+    document.body.innerHTML = "";
+  });
+
+  it("shows the query's line count in the footer, singular for one line", async () => {
+    await mountAttached();
+    await hover("e0");
+    const lines = () =>
+      document.querySelector('[data-test="recent-searches-details-lines"]')!.textContent?.trim();
+    expect(lines()).toBe("40 lines");
+    await hover("e1");
+    expect(lines()).toBe("1 line");
+  });
+
+  it("fades the query's bottom edge only while more of it is below", async () => {
+    await mountAttached();
+    await hover("e0");
+    const fade = () => document.querySelector('[data-test="recent-searches-details-fade"]');
+    setScroll(query(), 280, 640);
+    query().dispatchEvent(new Event("scroll"));
+    await nextTick();
+    expect(fade()).not.toBeNull();
+    query().scrollTop = 360;
+    query().dispatchEvent(new Event("scroll"));
+    await nextTick();
+    expect(fade()).toBeNull();
+  });
+
+  it("copies the full query with the drawer's copy and toast", async () => {
+    await mountAttached();
+    await hover("e0");
+    const copy = document.querySelector<HTMLElement>('[data-test="recent-searches-details-copy"]')!;
+    expect(copy.getAttribute("aria-label")).toBe("Copy query");
+    copy.click();
+    expect(clipboard.copyToClipboard).toHaveBeenCalledWith(LONG, expect.any(Function), {
+      successMessage: "Query copied",
+    });
+  });
+
+  it("pages the query with PageDown and PageUp on the active row, while the arrows keep moving rows", async () => {
+    const wrapper = await mountAttached();
+    (wrapper.vm as unknown as { focusFirst: () => boolean }).focusFirst();
+    await flushPromises();
+    setScroll(query(), 280, 640);
+    const down = key(document.activeElement!, "PageDown");
+    expect(down.defaultPrevented).toBe(true);
+    expect(query().scrollTop).toBe(264);
+    key(document.activeElement!, "PageUp");
+    expect(query().scrollTop).toBe(0);
+    expect(document.activeElement).toBe(rowEl("e0"));
+    key(document.activeElement!, "ArrowDown");
+    await flushPromises();
+    expect(document.activeElement).toBe(rowEl("e1"));
+    expect(query().textContent).toBe("level='error'");
+  });
+
+  describe("a keyboard-selected row's pane, reached without hovering the row", () => {
+    const copyButton = () =>
+      document.querySelector<HTMLElement>('[data-test="recent-searches-details-copy"]')!;
+    const focusFirstRow = async (wrapper: Awaited<ReturnType<typeof mountAttached>>) => {
+      (wrapper.vm as unknown as { focusFirst: () => boolean }).focusFirst();
+      await flushPromises();
+      expect(document.activeElement).toBe(rowEl("e0"));
+    };
+
+    it("stays while Tab moves focus to Copy, and Copy then works from the keyboard", async () => {
+      const wrapper = await mountAttached();
+      await focusFirstRow(wrapper);
+      const tab = key(rowEl("e0"), "Tab");
+      await flushPromises();
+      expect(tab.defaultPrevented).toBe(true);
+      expect(document.activeElement).toBe(copyButton());
+      expect(query().textContent).toBe(LONG);
+      copyButton().click();
+      expect(clipboard.copyToClipboard).toHaveBeenCalledWith(LONG, expect.any(Function), {
+        successMessage: "Query copied",
+      });
+      expect(details()).not.toBeNull();
+    });
+
+    it("stays when focus moves straight to Copy, as a click on it does", async () => {
+      const wrapper = await mountAttached();
+      await focusFirstRow(wrapper);
+      copyButton().focus();
+      await flushPromises();
+      expect(document.activeElement).toBe(copyButton());
+      expect(query().textContent).toBe(LONG);
+    });
+
+    it("stays when the pointer enters the pane and the click takes focus nowhere", async () => {
+      const wrapper = await mountAttached();
+      await focusFirstRow(wrapper);
+      details()!.dispatchEvent(new PointerEvent("pointerenter"));
+      rowEl("e0").blur();
+      await flushPromises();
+      expect(query().textContent).toBe(LONG);
+      copyButton().click();
+      expect(clipboard.copyToClipboard).toHaveBeenCalledWith(LONG, expect.any(Function), {
+        successMessage: "Query copied",
+      });
+    });
+
+    it("goes back to the row on Shift+Tab from Copy, and closes the list on Escape", async () => {
+      const wrapper = await mountAttached();
+      await focusFirstRow(wrapper);
+      key(rowEl("e0"), "Tab");
+      await flushPromises();
+      const back = new KeyboardEvent("keydown", {
+        key: "Tab",
+        shiftKey: true,
+        bubbles: true,
+        cancelable: true,
+      });
+      copyButton().dispatchEvent(back);
+      await flushPromises();
+      expect(back.defaultPrevented).toBe(true);
+      expect(document.activeElement).toBe(rowEl("e0"));
+      key(rowEl("e0"), "Tab");
+      await flushPromises();
+      key(copyButton(), "Escape");
+      expect(wrapper.emitted("close")).toHaveLength(1);
+    });
+
+    it("goes away once focus leaves the pane for elsewhere with the pointer outside it", async () => {
+      const wrapper = await mountAttached();
+      await focusFirstRow(wrapper);
+      key(rowEl("e0"), "Tab");
+      await flushPromises();
+      const elsewhere = document.createElement("button");
+      document.body.appendChild(elsewhere);
+      elsewhere.focus();
+      await flushPromises();
+      expect(details()).toBeNull();
+    });
+
+    it("leaves Tab alone when focus is not on a row", async () => {
+      await mountAttached();
+      const viewAll = document.querySelector<HTMLElement>(
+        '[data-test="recent-searches-view-all"]',
+      )!;
+      const tab = key(viewAll, "Tab");
+      expect(tab.defaultPrevented).toBe(false);
+    });
+  });
+
+  it("shows a row's VRL function in its own block under the query, with its own copy", async () => {
+    const vrl = '.severity = if .status >= 500 {\n  "critical"\n} else {\n  "info"\n}';
+    api.list.mockResolvedValue({
+      data: [
+        row(0, {
+          query: "SELECT 1",
+          context: { page: { stream: "k8s", functionContent: b64EncodeUnicode(vrl) ?? "" } },
+        }),
+        row(1),
+      ],
+    });
+    await mountAttached();
+    await hover("e0");
+    const block = document.querySelector('[data-test="recent-searches-details-function"]')!;
+    expect(query().contains(block)).toBe(false);
+    const text = block.querySelector('[data-test="recent-searches-details-function-text"]')!;
+    expect(text.textContent).toBe(vrl);
+    expect(text.className.split(" ")).toEqual(
+      expect.arrayContaining([
+        "whitespace-pre-wrap",
+        "wrap-anywhere",
+        "font-mono",
+        "overflow-auto",
+      ]),
+    );
+    block
+      .querySelector<HTMLElement>('[data-test="recent-searches-details-copy-function"]')!
+      .click();
+    expect(clipboard.copyToClipboard).toHaveBeenLastCalledWith(vrl, expect.any(Function), {
+      successMessage: "Function copied",
+    });
+    document.querySelector<HTMLElement>('[data-test="recent-searches-details-copy"]')!.click();
+    expect(clipboard.copyToClipboard).toHaveBeenLastCalledWith("SELECT 1", expect.any(Function), {
+      successMessage: "Query copied",
+    });
+
+    await hover("e1");
+    expect(document.querySelector('[data-test="recent-searches-details-function"]')).toBeNull();
+  });
+
+  it("leaves PageDown to its owner when no row is active", async () => {
+    const wrapper = await mountAttached();
+    const vm = wrapper.vm as unknown as {
+      handleOutsideKey: (event: KeyboardEvent) => boolean;
+      scrollDetails: (step: 1 | -1) => boolean;
+    };
+    const event = new KeyboardEvent("keydown", { key: "PageDown", cancelable: true });
+    expect(vm.handleOutsideKey(event)).toBe(false);
+    expect(event.defaultPrevented).toBe(false);
+    expect(vm.scrollDetails(1)).toBe(false);
+  });
+
+  it("widens to 560px for a query over 18 lines when the viewport has room, and stays 400px for short ones", async () => {
+    await mountAttached();
+    placeRoot({ left: 113, top: 110, right: 543, bottom: 400 });
+    await hover("e0");
+    expect(details()!.style.width).toBe("560px");
+    expect(details()!.style.maxHeight).toBe("320px");
+    await hover("e1");
+    expect(details()!.style.width).toBe("400px");
+  });
+
+  it("widens only into the room the viewport has, keeping the pane on-screen", async () => {
+    setViewport(1100, 900);
+    await mountAttached();
+    placeRoot({ left: 113, top: 110, right: 543, bottom: 400 });
+    await hover("e0");
+    expect(details()!.style.left).toBe("547px");
+    expect(details()!.style.width).toBe(`${1100 - 8 - 547}px`);
+  });
+
+  it("follows the list when it moves while the same row stays active", async () => {
+    const holder = document.createElement("div");
+    document.body.appendChild(holder);
+    const wrapper = mount(RecentSearchesPopover, {
+      props: { source: "logs", active: true },
+      global: { plugins: [store], stubs: { OTimeCell: true, OTooltip: true } },
+      attachTo: holder,
+    });
+    await flushPromises();
+    placeRoot({ left: 113, top: 110, right: 543, bottom: 400 });
+    (wrapper.vm as unknown as { focusFirst: () => boolean }).focusFirst();
+    await flushPromises();
+    expect(details()!.style.top).toBe("110px");
+    placeRoot({ left: 420, top: 146, right: 850, bottom: 436 });
+    holder.style.top = "36px";
+    await flushPromises();
+    expect(details()!.style.left).toBe("854px");
+    expect(details()!.style.top).toBe("146px");
+    expect(query().textContent).toBe(LONG);
+  });
+});
+
+describe("when history is disabled", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.zoConfig.query_history_enabled = false;
+  });
+  afterEach(() => {
+    delete store.state.zoConfig.query_history_enabled;
+  });
+
+  it("hides the clock button", () => {
+    const wrapper = mount(RecentSearchesButton, {
+      props: { source: "logs" },
+      global: { plugins: [store] },
+    });
+    expect(wrapper.find('[data-test="recent-searches-btn"]').exists()).toBe(false);
+  });
+
+  it("never opens the focus dropdown and never fetches", async () => {
+    const wrapper = mount(RecentSearchesFocusDropdown, {
+      props: { source: "logs", anchor: null, open: true },
+      global: { plugins: [store] },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    expect(document.querySelector('[data-test="recent-searches-focus-dropdown"]')).toBeNull();
+    expect(api.list).not.toHaveBeenCalled();
+    wrapper.unmount();
+  });
+});
+
+describe("keyboard: arrows then Enter or Shift+Enter", () => {
+  const press = (target: Element, key: string, shiftKey = false) =>
+    target.dispatchEvent(new KeyboardEvent("keydown", { key, shiftKey, bubbles: true }));
+  const activeTest = () => document.activeElement?.getAttribute("data-test");
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.zoConfig.query_history_enabled = true;
+    api.list.mockResolvedValue({ data: [row(0), row(1)] });
+  });
+  afterEach(() => {
+    delete store.state.zoConfig.query_history_enabled;
+  });
+
+  const openFromButton = async () => {
+    const wrapper = mount(RecentSearchesButton, {
+      props: { source: "logs" },
+      global: { plugins: [store], stubs: { OTimeCell: true } },
+      attachTo: document.body,
+    });
+    const trigger = wrapper.find('[data-test="recent-searches-btn"]');
+    await trigger.trigger("click");
+    await flushPromises();
+    await vi.waitFor(() =>
+      expect(document.querySelector('[data-test="recent-searches-row-e1"]')).not.toBeNull(),
+    );
+    return { wrapper, trigger: trigger.element as HTMLElement };
+  };
+
+  it("loads the row Shift+Enter is pressed on, even when focus was left on the clock button", async () => {
+    const { wrapper, trigger } = await openFromButton();
+    trigger.focus();
+    press(trigger, "ArrowDown");
+    press(document.activeElement!, "ArrowDown");
+    expect(activeTest()).toBe("recent-searches-row-e1");
+
+    press(document.activeElement!, "Enter", true);
+    await flushPromises();
+    expect(wrapper.emitted("load")?.[0]?.[0]).toMatchObject({ id: "e1" });
+    expect(wrapper.emitted("run")).toBeUndefined();
+  });
+
+  it("gives the keyboard-focused row, or the hovered one, the menu's active state", async () => {
+    const { trigger } = await openFromButton();
+    trigger.focus();
+    press(trigger, "ArrowDown");
+    press(document.activeElement!, "ArrowDown");
+    await nextTick();
+    const row = (id: string) =>
+      document.querySelector<HTMLElement>(`[data-test="recent-searches-row-${id}"]`)!;
+    expect(row("e1").getAttribute("aria-selected")).toBe("true");
+    expect(row("e1").hasAttribute("data-highlighted")).toBe(true);
+    expect(row("e0").getAttribute("aria-selected")).toBe("false");
+    expect(row("e0").hasAttribute("data-highlighted")).toBe(false);
+    expect(row("e1").className).toContain("data-[highlighted]:bg-select-item-selected-bg");
+    expect(row("e1").className).toContain("data-[highlighted]:border-accent");
+
+    row("e0").dispatchEvent(new PointerEvent("pointerenter"));
+    await nextTick();
+    expect(row("e0").hasAttribute("data-highlighted")).toBe(true);
+    expect(row("e1").hasAttribute("data-highlighted")).toBe(false);
+    vi.useFakeTimers();
+    try {
+      document
+        .querySelector('[data-test="recent-searches-list"]')!
+        .dispatchEvent(new PointerEvent("pointerleave", { relatedTarget: document.body }));
+      vi.advanceTimersByTime(300);
+      await nextTick();
+      expect(row("e1").hasAttribute("data-highlighted")).toBe(true);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  describe("Enter on a hovered row after opening from the clock button", () => {
+    const hoverRow = async (id: string) => {
+      document
+        .querySelector(`[data-test="recent-searches-row-${id}"]`)!
+        .dispatchEvent(new PointerEvent("pointerenter"));
+      await flushPromises();
+    };
+    const enter = (target: Element, shiftKey = false) => {
+      const event = new KeyboardEvent("keydown", {
+        key: "Enter",
+        shiftKey,
+        bubbles: true,
+        cancelable: true,
+      });
+      target.dispatchEvent(event);
+      return event;
+    };
+
+    it("focuses the list itself, so Enter runs the hovered row and never reaches the page", async () => {
+      const pageSaw = vi.fn();
+      document.addEventListener("keydown", pageSaw);
+      try {
+        const { wrapper } = await openFromButton();
+        const list = document.querySelector('[data-test="recent-searches-popover"]')!;
+        expect(document.activeElement).toBe(list);
+        await hoverRow("e1");
+        const event = enter(list);
+        await flushPromises();
+        expect(event.defaultPrevented).toBe(true);
+        expect(pageSaw).not.toHaveBeenCalled();
+        expect(wrapper.emitted("run")?.[0]?.[0]).toMatchObject({ id: "e1" });
+      } finally {
+        document.removeEventListener("keydown", pageSaw);
+      }
+    });
+
+    it("loads the hovered row on Shift+Enter", async () => {
+      const { wrapper } = await openFromButton();
+      await hoverRow("e1");
+      enter(document.querySelector('[data-test="recent-searches-popover"]')!, true);
+      await flushPromises();
+      expect(wrapper.emitted("load")?.[0]?.[0]).toMatchObject({ id: "e1" });
+      expect(wrapper.emitted("run")).toBeUndefined();
+    });
+
+    it("does nothing on Enter when no row is hovered", async () => {
+      const { wrapper } = await openFromButton();
+      const event = enter(document.querySelector('[data-test="recent-searches-popover"]')!);
+      await flushPromises();
+      expect(event.defaultPrevented).toBe(false);
+      expect(wrapper.emitted("run")).toBeUndefined();
+    });
+
+    it("runs the hovered row on Enter even with focus left on the clock button", async () => {
+      const { wrapper, trigger } = await openFromButton();
+      trigger.focus();
+      await hoverRow("e1");
+      const event = enter(trigger);
+      await flushPromises();
+      expect(event.defaultPrevented).toBe(true);
+      expect(wrapper.emitted("run")?.[0]?.[0]).toMatchObject({ id: "e1" });
+    });
+  });
+
+  it("runs the row plain Enter is pressed on", async () => {
+    const { wrapper, trigger } = await openFromButton();
+    trigger.focus();
+    press(trigger, "ArrowDown");
+    press(document.activeElement!, "Enter");
+    await flushPromises();
+    expect(wrapper.emitted("run")?.[0]?.[0]).toMatchObject({ id: "e0" });
+    expect(wrapper.emitted("load")).toBeUndefined();
+  });
+
+  it("loads from the editor's focus dropdown after its ArrowDown handoff", async () => {
+    const wrapper = mount(RecentSearchesFocusDropdown, {
+      props: { source: "logs", anchor: editorBox().box, open: true },
+      global: { plugins: [store], stubs: { OTimeCell: true } },
+      attachTo: document.body,
+    });
+    await vi.waitFor(() =>
+      expect(document.querySelector('[data-test="recent-searches-row-e0"]')).not.toBeNull(),
+    );
+    expect((wrapper.vm as unknown as { focusFirst: () => boolean }).focusFirst()).toBe(true);
+    press(document.activeElement!, "Enter", true);
+    await flushPromises();
+    expect(wrapper.emitted("load")?.[0]?.[0]).toMatchObject({ id: "e0" });
+  });
+
+  const mountWithEditor = async () => {
+    const { box, monaco } = editorBox();
+    const editor = document.createElement("textarea");
+    editor.addEventListener("keydown", (e) => {
+      if (e.key === "Enter") editor.value += "\n";
+    });
+    monaco.appendChild(editor);
+    const wrapper = mount(RecentSearchesFocusDropdown, {
+      props: { source: "logs", anchor: box, open: true },
+      global: { plugins: [store], stubs: { OTimeCell: true } },
+      attachTo: document.body,
+    });
+    const handle = wrapper.vm as unknown as RecentsKeyTarget;
+    box.addEventListener(
+      "keydown",
+      (e) => routeEditorKeyToRecents(e, handle, () => wrapper.setProps({ open: false })),
+      true,
+    );
+    await vi.waitFor(() =>
+      expect(document.querySelector('[data-test="recent-searches-row-e0"]')).not.toBeNull(),
+    );
+    editor.focus();
+    return { wrapper, editor };
+  };
+
+  const hoverRow = async (id: string) => {
+    document
+      .querySelector(`[data-test="recent-searches-row-${id}"]`)!
+      .dispatchEvent(new PointerEvent("pointerenter"));
+    await flushPromises();
+  };
+
+  it("leaves Enter and Shift+Enter to the editor when no row is highlighted", async () => {
+    const { wrapper, editor } = await mountWithEditor();
+    press(editor, "Enter", true);
+    press(editor, "Enter");
+    await flushPromises();
+    expect(wrapper.emitted("load")).toBeUndefined();
+    expect(wrapper.emitted("run")).toBeUndefined();
+    expect(editor.value).toBe("\n\n");
+  });
+
+  it("loads the hovered row on Shift+Enter from the editor", async () => {
+    const { wrapper, editor } = await mountWithEditor();
+    await hoverRow("e1");
+    press(editor, "Enter", true);
+    await flushPromises();
+    expect(wrapper.emitted("load")?.[0]?.[0]).toMatchObject({ id: "e1" });
+    expect(wrapper.emitted("run")).toBeUndefined();
+    expect(editor.value).toBe("");
+  });
+
+  it("runs the hovered row on Enter from the editor", async () => {
+    const { wrapper, editor } = await mountWithEditor();
+    await hoverRow("e1");
+    press(editor, "Enter");
+    await flushPromises();
+    expect(wrapper.emitted("run")?.[0]?.[0]).toMatchObject({ id: "e1" });
+    expect(editor.value).toBe("");
+  });
+
+  it("pages the hovered row's details on PageDown from the editor, and leaves PageDown to the editor with no row active", async () => {
+    const { wrapper, editor } = await mountWithEditor();
+    const pageDown = () => {
+      const event = new KeyboardEvent("keydown", {
+        key: "PageDown",
+        bubbles: true,
+        cancelable: true,
+      });
+      editor.dispatchEvent(event);
+      return event;
+    };
+    expect(pageDown().defaultPrevented).toBe(false);
+
+    document
+      .querySelector('[data-test="recent-searches-row-e0"]')!
+      .dispatchEvent(new PointerEvent("pointerenter"));
+    await flushPromises();
+    const query = document.querySelector<HTMLElement>(
+      '[data-test="recent-searches-details-query"]',
+    )!;
+    Object.defineProperty(query, "clientHeight", { configurable: true, value: 200 });
+    Object.defineProperty(query, "scrollHeight", { configurable: true, value: 900 });
+    expect(pageDown().defaultPrevented).toBe(true);
+    expect(query.scrollTop).toBe(184);
+    expect(document.activeElement).toBe(editor);
+    expect(wrapper.emitted("update:open")).toBeUndefined();
+  });
+
+  it("keeps the clock popover open for a click in the details pane, and closes it for a click elsewhere", async () => {
+    const { wrapper } = await openFromButton();
+    document
+      .querySelector('[data-test="recent-searches-row-e0"]')!
+      .dispatchEvent(new PointerEvent("pointerenter"));
+    await flushPromises();
+    const copy = document.querySelector<HTMLElement>('[data-test="recent-searches-details-copy"]')!;
+    copy.dispatchEvent(new PointerEvent("pointerdown", { bubbles: true }));
+    copy.dispatchEvent(new FocusEvent("focusin", { bubbles: true }));
+    await flushPromises();
+    expect(document.querySelector('[data-test="recent-searches-popover"]')).not.toBeNull();
+
+    const elsewhere = document.createElement("button");
+    document.body.appendChild(elsewhere);
+    elsewhere.dispatchEvent(new PointerEvent("pointerdown", { bubbles: true }));
+    await flushPromises();
+    expect(document.querySelector('[data-test="recent-searches-popover"]')).toBeNull();
+    wrapper.unmount();
+  });
+
+  it("keeps the clock popover open while Tab takes a keyboard-selected row to its details' Copy", async () => {
+    const { wrapper, trigger } = await openFromButton();
+    trigger.focus();
+    press(trigger, "ArrowDown");
+    await flushPromises();
+    expect(activeTest()).toBe("recent-searches-row-e0");
+    press(document.activeElement!, "Tab");
+    await flushPromises();
+    expect(activeTest()).toBe("recent-searches-details-copy");
+    expect(document.querySelector('[data-test="recent-searches-popover"]')).not.toBeNull();
+    expect(document.querySelector('[data-test="recent-searches-details-query"]')?.textContent).toBe(
+      "q0",
+    );
+    wrapper.unmount();
+  });
+
+  it("fits a short dropdown: header and footer keep their rows and the list scrolls the rest", async () => {
+    Object.defineProperty(window, "innerHeight", { configurable: true, value: 300 });
+    api.list.mockResolvedValue({ data: Array.from({ length: 8 }, (_, i) => row(i)) });
+    try {
+      const { box } = editorBox();
+      const cursor = box.querySelector(".cursor")!;
+      placeCaret(cursor, { left: 113, top: 91, right: 115, bottom: 109 });
+      mount(RecentSearchesFocusDropdown, {
+        props: { source: "logs", anchor: box, open: true },
+        global: { plugins: [store], stubs: { OTimeCell: true } },
+        attachTo: document.body,
+      });
+      await vi.waitFor(() =>
+        expect(document.querySelector('[data-test="recent-searches-row-e7"]')).not.toBeNull(),
+      );
+      const panel = document.querySelector<HTMLElement>(
+        '[data-test="recent-searches-focus-dropdown"]',
+      )!;
+      expect(panel.style.maxHeight).toBe(`${300 - 109 - 8}px`);
+      expect(panel.className.split(" ")).toEqual(
+        expect.arrayContaining(["flex", "flex-col", "overflow-hidden"]),
+      );
+      const root = panel.querySelector<HTMLElement>('[data-test="recent-searches-popover"]')!;
+      expect(root.className.split(" ")).toEqual(
+        expect.arrayContaining(["flex", "flex-col", "min-h-0"]),
+      );
+      const list = root.querySelector<HTMLElement>('[data-test="recent-searches-list"]')!;
+      expect(list.className.split(" ")).toEqual(
+        expect.arrayContaining(["min-h-0", "overflow-auto"]),
+      );
+      const [header, , footer] = [...root.children] as HTMLElement[];
+      expect(header.className.split(" ")).toContain("shrink-0");
+      expect(footer.className.split(" ")).toContain("shrink-0");
+      expect(footer.querySelector('[data-test="recent-searches-view-all"]')).not.toBeNull();
+    } finally {
+      Object.defineProperty(window, "innerHeight", { configurable: true, value: 768 });
+    }
+  });
+
+  it("leaves Enter to the editor when the list has no rows", async () => {
+    api.list.mockResolvedValue({ data: [] });
+    const { box, monaco } = editorBox();
+    const editor = document.createElement("textarea");
+    editor.addEventListener("keydown", (e) => {
+      if (e.key === "Enter") editor.value += "\n";
+    });
+    monaco.appendChild(editor);
+    const wrapper = mount(RecentSearchesFocusDropdown, {
+      props: { source: "logs", anchor: box, open: true },
+      global: { plugins: [store], stubs: { OTimeCell: true } },
+      attachTo: document.body,
+    });
+    box.addEventListener(
+      "keydown",
+      (e) => routeEditorKeyToRecents(e, wrapper.vm as unknown as RecentsKeyTarget, () => {}),
+      true,
+    );
+    await flushPromises();
+    press(editor, "Enter", true);
+    expect(editor.value).toBe("\n");
+    expect(wrapper.emitted("load")).toBeUndefined();
+  });
+});
diff --git a/web/src/components/queryHistory/RecentSearchesPopover.vue b/web/src/components/queryHistory/RecentSearchesPopover.vue
new file mode 100644
index 0000000000..48c103cf2f
--- /dev/null
+++ b/web/src/components/queryHistory/RecentSearchesPopover.vue
@@ -0,0 +1,435 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div
+    ref="rootRef"
+    tabindex="-1"
+    class="text-select-item-text flex min-h-0 w-[min(26.75rem,calc(100vw-1rem))] max-w-full flex-col font-sans text-[0.8125rem] outline-none"
+    data-test="recent-searches-popover"
+    @keydown="onKeydown"
+  >
+    <div
+      class="border-border-subtle text-dropdown-label text-2xs flex h-6 shrink-0 items-center gap-1.5 border-b ps-2 pe-1 font-semibold uppercase"
+    >
+      <OIcon name="history" size="xs" />
+      <span class="truncate">{{ t(`recentSearches.pageTitle.${source}`) }}</span>
+      <OButton
+        variant="ghost"
+        size="icon-xs"
+        icon-left="info-outline"
+        class="ms-auto normal-case"
+        :aria-label="`${about} ${t('recentSearches.keyHints')}`"
+        data-test="recent-searches-about"
+      >
+        <OTooltip>
+          <template #content>
+            <span class="flex flex-col gap-1">
+              <span>{{ about }}</span>
+              <span data-test="recent-searches-key-hints">{{ t("recentSearches.keyHints") }}</span>
+            </span>
+          </template>
+        </OTooltip>
+      </OButton>
+    </div>
+
+    <OEmptyState
+      v-if="list.isError.value"
+      size="inline"
+      icon="error"
+      :title="t('recentSearches.loadError')"
+      :action-label="t('recentSearches.retry')"
+      action-icon="refresh"
+      data-test="recent-searches-error"
+      @action="list.refetch()"
+    />
+    <div v-else-if="list.isPending.value" class="flex flex-col gap-2 p-2">
+      <OSkeleton v-for="n in 4" :key="n" type="text" />
+    </div>
+    <div v-else-if="isEmpty" class="flex flex-col items-center gap-2 p-3">
+      <OEmptyState
+        size="inline"
+        icon="history"
+        :title="t('recentSearches.emptyTitle')"
+        data-test="recent-searches-empty"
+      />
+      <div v-if="examples.length" class="flex flex-wrap justify-center gap-2">
+        <OButton
+          v-for="(example, index) in examples"
+          :key="index"
+          variant="outline"
+          size="xs"
+          icon-left="lightbulb"
+          :data-test="`recent-searches-example-${index}`"
+          @click="emit('example', example)"
+        >
+          <OTruncatedText class="max-w-60 font-mono">{{ example }}</OTruncatedText>
+        </OButton>
+      </div>
+    </div>
+    <div
+      v-else
+      ref="listRef"
+      role="listbox"
+      :aria-label="t('recentSearches.title')"
+      class="max-h-72 min-h-0 overflow-auto"
+      data-test="recent-searches-list"
+      @pointerenter="keepHover"
+      @pointerleave="onPointerLeave"
+    >
+      <div
+        v-if="view.pinnedFailure"
+        :class="[ROW_ACTIVE_CLASSES, 'flex flex-col gap-0.5 py-0.5 ps-1.5 pe-1']"
+        :data-highlighted="highlighted(view.pinnedFailure.entry.id)"
+        data-test="recent-searches-pinned-failure"
+        @pointerenter="onRowEnter(view.pinnedFailure.entry.id)"
+      >
+        <div class="flex h-6 min-w-0 items-center gap-2">
+          <button
+            type="button"
+            role="option"
+            data-recent-row
+            :data-recent-id="view.pinnedFailure.entry.id"
+            :aria-selected="activeId === view.pinnedFailure.entry.id"
+            class="flex h-full min-w-0 flex-1 cursor-pointer items-center gap-2 text-left outline-none"
+            @focus="onRowFocus(view.pinnedFailure.entry.id)"
+            @blur="onRowBlur"
+            @click="pick(view.pinnedFailure.entry, $event, true)"
+            @keydown.enter.exact.prevent="pick(view.pinnedFailure.entry, $event, true)"
+            @keydown.shift.enter.exact.prevent="pick(view.pinnedFailure.entry, $event, true)"
+          >
+            <span class="flex size-4 shrink-0 items-center justify-center">
+              <OIcon name="error" size="xs" class="text-status-error-text" />
+            </span>
+            <OTruncatedText class="flex-1 font-mono text-xs">
+              {{ oneLine(view.pinnedFailure.entry.query) }}
+            </OTruncatedText>
+          </button>
+          <OButton
+            variant="outline"
+            size="xs"
+            data-test="recent-searches-load-to-fix"
+            @click="emit('load', view.pinnedFailure.entry, 'original')"
+          >
+            {{ t("recentSearches.loadToFix") }}
+          </OButton>
+        </div>
+        <OTruncatedText
+          v-if="view.pinnedFailure.entry.context.error"
+          :tooltip="raw(view.pinnedFailure.entry.context.error)"
+          class="text-status-error-text text-2xs ps-6"
+          data-test="recent-searches-pinned-error"
+        >
+          {{ view.pinnedFailure.entry.context.error }}
+        </OTruncatedText>
+      </div>
+      <button
+        v-for="row in view.rows"
+        :key="row.entry.id"
+        type="button"
+        role="option"
+        data-recent-row
+        :data-recent-id="row.entry.id"
+        :aria-selected="activeId === row.entry.id"
+        :data-highlighted="highlighted(row.entry.id)"
+        :class="[
+          ROW_ACTIVE_CLASSES,
+          'flex h-6 w-full cursor-pointer items-center gap-2 ps-1.5 pe-2 text-left outline-none',
+        ]"
+        :data-test="`recent-searches-row-${row.entry.id}`"
+        @focus="onRowFocus(row.entry.id)"
+        @blur="onRowBlur"
+        @pointerenter="onRowEnter(row.entry.id)"
+        @click="pick(row.entry, $event, false)"
+        @keydown.enter.exact.prevent="pick(row.entry, $event, false)"
+        @keydown.shift.enter.exact.prevent="pick(row.entry, $event, false)"
+      >
+        <span class="flex size-4 shrink-0 items-center justify-center">
+          <OIcon
+            :name="row.starred ? 'star' : 'history'"
+            size="xs"
+            :class="row.starred ? 'text-accent' : 'text-select-item-selected-text'"
+          />
+        </span>
+        <OTruncatedText :tooltip="false" class="flex-1 font-mono text-xs">
+          {{ oneLine(row.entry.query) }}
+        </OTruncatedText>
+        <span
+          v-if="row.entry.context.warning !== undefined"
+          class="bg-status-warning-text size-2 shrink-0 rounded-full"
+          data-test="recent-searches-warning-dot"
+        >
+          <OTooltip :content="t('recentSearches.warning')" />
+        </span>
+        <OTimeCell
+          :value="row.entry.updated_at"
+          unit="us"
+          mode="relative"
+          class="text-text-secondary text-2xs shrink-0"
+        />
+      </button>
+    </div>
+
+    <div
+      class="border-border-subtle text-text-secondary flex h-7 shrink-0 items-center gap-1 border-t px-1 text-xs"
+    >
+      <OButton
+        variant="ghost-primary"
+        size="xs"
+        icon-left="history"
+        data-test="recent-searches-view-all"
+        @click="emit('view-all', null)"
+      >
+        {{ t("recentSearches.viewAll") }}
+      </OButton>
+      <OButton
+        v-if="failedCount > 0"
+        variant="ghost-muted"
+        size="xs"
+        data-test="recent-searches-view-failed"
+        @click="emit('view-all', 'error')"
+      >
+        {{ t("recentSearches.failedCount", { count: failedCount }) }}
+      </OButton>
+    </div>
+
+    <RecentSearchesDetails
+      v-if="activeEntry"
+      ref="detailsRef"
+      :entry="activeEntry"
+      :anchor="rootRef"
+      @enter="onPaneEnter"
+      @leave="onPointerLeave"
+      @focus-leave="onPaneFocusLeave"
+      @back="focusHeldRow"
+      @escape="emit('close')"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref, toRef } from "vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import {
+  useRecentFailedCount,
+  useRecentSearches,
+  useRecentSearchesList,
+} from "@/composables/queryHistory/useRecentSearches";
+import { useRecentEntryText } from "@/composables/queryHistory/useRecentEntryText";
+import {
+  buildRecents,
+  defaultRestoreTime,
+  type RestoreTime,
+} from "@/utils/queryHistory/recentSearches";
+import type { HistorySource, HistoryStatus, QueryHistoryEntry } from "@/services/query_history";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import RecentSearchesDetails from "./RecentSearchesDetails.vue";
+
+const ROW_ACTIVE_CLASSES =
+  "border-s-2 border-transparent data-[highlighted]:border-accent data-[highlighted]:bg-select-item-selected-bg";
+const HOVER_LEAVE_GRACE_MS = 200;
+
+const props = withDefaults(
+  defineProps<{
+    source: HistorySource;
+    /** Fetches while true, so a closed popover costs nothing. */
+    active: boolean;
+    /** Example queries for the first-time empty state. */
+    examples?: string[];
+  }>(),
+  { examples: () => [] },
+);
+
+const emit = defineEmits<{
+  run: [entry: QueryHistoryEntry, when: RestoreTime];
+  load: [entry: QueryHistoryEntry, when: RestoreTime];
+  "view-all": [status: HistoryStatus | null];
+  example: [query: string];
+  close: [];
+}>();
+
+const { t } = useI18nTyped();
+const { zone } = useRecentEntryText();
+const { about } = useRecentSearches();
+const list = useRecentSearchesList(props.source, toRef(props, "active"));
+const failed = useRecentFailedCount(props.source, toRef(props, "active"));
+const rootRef = ref<HTMLElement | null>(null);
+const listRef = ref<HTMLElement | null>(null);
+const detailsRef = ref<InstanceType<typeof RecentSearchesDetails> | null>(null);
+
+const view = computed(() => buildRecents(list.data.value ?? []));
+// The server counts the pinned failure too, and the two answers can land apart.
+const failedCount = computed(() =>
+  Math.max(0, (failed.data.value ?? 0) - (view.value.pinnedFailure ? 1 : 0)),
+);
+const isEmpty = computed(() => !view.value.pinnedFailure && view.value.rows.length === 0);
+
+const oneLine = (query: string) => query.replace(/\s+/g, " ").trim();
+
+// One row at a time carries the menu's active state: the hovered one, else the keyboard-focused one, else the one whose details hold the pointer or focus.
+const focusedId = ref<string | null>(null);
+const hoveredId = ref<string | null>(null);
+const heldId = ref<string | null>(null);
+const activeId = computed(() => hoveredId.value ?? focusedId.value ?? heldId.value);
+const highlighted = (id: string) => (activeId.value === id ? "" : undefined);
+
+const activeEntry = computed(() => {
+  const id = activeId.value;
+  if (!id) return null;
+  if (view.value.pinnedFailure?.entry.id === id) return view.value.pinnedFailure.entry;
+  return view.value.rows.find((row) => row.entry.id === id)?.entry ?? null;
+});
+
+// The pointer crosses the gap to the details pane, or brushes the list's edge, without meaning to drop the row.
+let leaveTimer: ReturnType<typeof setTimeout> | undefined;
+const keepHover = () => clearTimeout(leaveTimer);
+const onPointerLeave = (event: PointerEvent) => {
+  const to = event.relatedTarget as Node | null;
+  if (to && (detailsRef.value?.contains(to) || listRef.value?.contains(to))) return;
+  clearTimeout(leaveTimer);
+  leaveTimer = setTimeout(() => {
+    hoveredId.value = null;
+    if (!detailsRef.value?.hasFocus()) heldId.value = null;
+  }, HOVER_LEAVE_GRACE_MS);
+};
+onBeforeUnmount(() => clearTimeout(leaveTimer));
+
+// Moving to the pane blurs or un-hovers the row before the pane is used, which would unmount it under the pointer or focus.
+const holdActive = () => {
+  if (activeId.value) heldId.value = activeId.value;
+};
+
+const onRowEnter = (id: string) => {
+  keepHover();
+  hoveredId.value = id;
+  heldId.value = null;
+};
+
+const onRowFocus = (id: string) => {
+  focusedId.value = id;
+  heldId.value = null;
+};
+
+const onRowBlur = (event: FocusEvent) => {
+  if (detailsRef.value?.contains(event.relatedTarget as Node | null)) holdActive();
+  focusedId.value = null;
+};
+
+const onPaneEnter = () => {
+  keepHover();
+  holdActive();
+};
+
+const onPaneFocusLeave = (to: Node | null) => {
+  if (listRef.value?.contains(to)) return;
+  if (!detailsRef.value?.hasPointer()) heldId.value = null;
+};
+
+const focusHeldRow = () => {
+  const id = activeId.value;
+  rows()
+    .find((row) => row.dataset.recentId === id)
+    ?.focus();
+};
+
+// Shift loads without running; a failed row always loads, since running it again fails again.
+const pick = (entry: QueryHistoryEntry, event: MouseEvent | KeyboardEvent, failed: boolean) => {
+  const when = defaultRestoreTime(entry, Date.now(), zone.value);
+  if (failed || event.shiftKey) emit("load", entry, when);
+  else emit("run", entry, when);
+};
+
+const rows = () => [...(rootRef.value?.querySelectorAll<HTMLElement>("[data-recent-row]") ?? [])];
+
+const moveFocus = (step: number) => {
+  const all = rows();
+  if (!all.length) return;
+  const at = all.indexOf(document.activeElement as HTMLElement);
+  const next = at < 0 ? (step > 0 ? 0 : all.length - 1) : (at + step + all.length) % all.length;
+  all[next].focus();
+};
+
+/** Pages the active row's details; false when no row is active, so the key stays with its owner. */
+const scrollDetails = (step: 1 | -1) => detailsRef.value?.scrollPage(step) ?? false;
+
+/** Whether a node belongs to the list, including its details pane outside the list's DOM. */
+const ownsNode = (node: Node | null) =>
+  !!node && (!!rootRef.value?.contains(node) || !!detailsRef.value?.contains(node));
+
+const isPlainEnter = (event: KeyboardEvent) =>
+  event.key === "Enter" && !event.ctrlKey && !event.metaKey && !event.altKey;
+
+const onKeydown = (event: KeyboardEvent) => {
+  const onRow = event.target instanceof HTMLElement && event.target.hasAttribute("data-recent-row");
+  // With focus on the list itself, Enter belongs to the hovered row and must not reach the page's run shortcut.
+  if (isPlainEnter(event) && event.target === rootRef.value) {
+    if (pickActive(event)) {
+      event.preventDefault();
+      event.stopPropagation();
+    }
+  } else if (event.key === "Tab" && !event.shiftKey && onRow && activeEntry.value) {
+    holdActive();
+    if (detailsRef.value?.focusCopy()) event.preventDefault();
+  } else if (event.key === "PageDown" || event.key === "PageUp") {
+    if (scrollDetails(event.key === "PageDown" ? 1 : -1)) event.preventDefault();
+  } else if (event.key === "ArrowDown" || event.key === "ArrowUp") {
+    event.preventDefault();
+    moveFocus(event.key === "ArrowDown" ? 1 : -1);
+  } else if (event.key === "Escape") {
+    event.preventDefault();
+    emit("close");
+  }
+};
+
+/** Moves keyboard focus into the list, for the editor's ArrowDown handoff. */
+const focusFirst = () => {
+  const first = rows()[0];
+  if (!first) return false;
+  first.focus();
+  return true;
+};
+
+/** Runs, or with Shift loads, the active row, as Enter would on it; false when no row is active. */
+const pickActive = (event: KeyboardEvent) => {
+  const entry = activeEntry.value;
+  if (!entry) return false;
+  pick(entry, event, entry.id === view.value.pinnedFailure?.entry.id);
+  return true;
+};
+
+/** Handles a key pressed while focus is still outside the list; true when it was used. */
+const handleOutsideKey = (event: KeyboardEvent) => {
+  if (isPlainEnter(event)) return hoveredId.value !== null && pickActive(event);
+  if (event.key === "PageDown" || event.key === "PageUp") {
+    onKeydown(event);
+    return event.defaultPrevented;
+  }
+  if (!["ArrowDown", "ArrowUp", "Escape"].includes(event.key)) return false;
+  onKeydown(event);
+  return true;
+};
+
+/** Focuses the list itself rather than its first control, so Enter reaches the hovered row. */
+const focusRoot = () => rootRef.value?.focus();
+
+defineExpose({ focusFirst, focusRoot, pickActive, handleOutsideKey, scrollDetails, ownsNode });
+</script>
diff --git a/web/src/components/rum/VideoPlayer.spec.ts b/web/src/components/rum/VideoPlayer.spec.ts
index 46af1d8abf..1705a4f582 100644
--- a/web/src/components/rum/VideoPlayer.spec.ts
+++ b/web/src/components/rum/VideoPlayer.spec.ts
@@ -1490,6 +1490,301 @@ describe("VideoPlayer", () => {
     });
   });
 
+  describe("Full screen", () => {
+    let fullscreenEl: Element | null;
+    let requestSpy: ReturnType<typeof vi.fn>;
+    let exitSpy: ReturnType<typeof vi.fn>;
+    let removeSpy: ReturnType<typeof vi.spyOn> | undefined;
+    const mounted: ReturnType<typeof mount>[] = [];
+
+    const fireChange = async (el: Element | null) => {
+      fullscreenEl = el;
+      document.dispatchEvent(new Event("fullscreenchange"));
+      await flushPromises();
+    };
+
+    const mountSupported = async () => {
+      const local = mountComponent();
+      mounted.push(local);
+      await flushPromises();
+      return local;
+    };
+
+    const mountKept = async () => {
+      const Host = defineComponent({
+        components: { VideoPlayer },
+        props: { show: { type: Boolean, default: true } },
+        setup: () => ({ events: mockEvents }),
+        template: `<KeepAlive><VideoPlayer v-if="show" :events="events" :segments="[]" :is-loading="false" /><div v-else /></KeepAlive>`,
+      });
+      const host = mount(Host, {
+        global: {
+          plugins: [i18n],
+          provide: { store },
+          stubs: {
+            OIcon: {
+              template: '<i data-test="OIcon" :data-name="name"></i>',
+              props: ["name", "size"],
+            },
+          },
+        },
+      });
+      mounted.push(host);
+      await flushPromises();
+      return host;
+    };
+
+    const deferRequest = () => {
+      let settle: () => void = () => {};
+      requestSpy.mockImplementation(
+        () =>
+          new Promise<void>((resolve) => {
+            settle = resolve;
+          }),
+      );
+      return () => settle();
+    };
+
+    const button = (local: ReturnType<typeof mountComponent>) =>
+      local.find('[data-test="video-player-fullscreen-btn"]');
+
+    const isPinned = (local: ReturnType<typeof mountComponent>) =>
+      local.find('[data-test="video-player-root"]').classes().includes("fixed");
+
+    beforeEach(() => {
+      fullscreenEl = null;
+      requestSpy = vi.fn(() => Promise.resolve());
+      exitSpy = vi.fn(() => Promise.resolve());
+      Object.defineProperty(document, "fullscreenEnabled", { configurable: true, value: true });
+      Object.defineProperty(document, "fullscreenElement", {
+        configurable: true,
+        get: () => fullscreenEl,
+      });
+      Object.defineProperty(document, "exitFullscreen", { configurable: true, value: exitSpy });
+      Object.defineProperty(document.documentElement, "requestFullscreen", {
+        configurable: true,
+        value: requestSpy,
+      });
+    });
+
+    afterEach(() => {
+      mounted.splice(0).forEach((w) => {
+        if (!w.vm.$.isUnmounted) w.unmount();
+      });
+      removeSpy?.mockRestore();
+      removeSpy = undefined;
+      delete (document as any).fullscreenEnabled;
+      delete (document as any).fullscreenElement;
+      delete (document as any).exitFullscreen;
+      delete (document.documentElement as any).requestFullscreen;
+    });
+
+    it("renders the button when the browser supports full screen", async () => {
+      const local = await mountSupported();
+      expect(button(local).exists()).toBe(true);
+      expect(button(local).attributes("aria-label")).toBe("Full screen");
+      expect(button(local).find('[data-test="OIcon"]').attributes("data-name")).toBe("fullscreen");
+    });
+
+    it("hides the button when the browser does not allow full screen", async () => {
+      Object.defineProperty(document, "fullscreenEnabled", { configurable: true, value: false });
+      const local = await mountSupported();
+      expect(button(local).exists()).toBe(false);
+    });
+
+    it("requests full screen on the page, and exits it on a click while active", async () => {
+      const local = await mountSupported();
+      await button(local).trigger("click");
+      await flushPromises();
+      expect(requestSpy).toHaveBeenCalledTimes(1);
+      expect(requestSpy.mock.contexts[0]).toBe(document.documentElement);
+
+      await fireChange(document.documentElement);
+      await button(local).trigger("click");
+      await flushPromises();
+      expect(exitSpy).toHaveBeenCalledTimes(1);
+    });
+
+    it("pins the player and swaps icon and label on entry, and unpins on a browser exit", async () => {
+      const local = await mountSupported();
+      await button(local).trigger("click");
+      await fireChange(document.documentElement);
+
+      expect(isPinned(local)).toBe(true);
+      expect(button(local).attributes("aria-label")).toBe("Exit full screen");
+      expect(button(local).find('[data-test="OIcon"]').attributes("data-name")).toBe(
+        "fullscreen-exit",
+      );
+
+      await fireChange(null);
+      expect(isPinned(local)).toBe(false);
+      expect(button(local).attributes("aria-label")).toBe("Full screen");
+      expect(button(local).find('[data-test="OIcon"]').attributes("data-name")).toBe("fullscreen");
+    });
+
+    it("does not pin the player for a full screen another component started", async () => {
+      const local = await mountSupported();
+      await fireChange(document.documentElement);
+      expect(isPinned(local)).toBe(false);
+
+      await fireChange(null);
+      await fireChange(document.createElement("div"));
+      expect(isPinned(local)).toBe(false);
+    });
+
+    it("claims a page full screen another component owns instead of exiting it", async () => {
+      const local = await mountSupported();
+      await fireChange(document.documentElement);
+      expect(isPinned(local)).toBe(false);
+
+      await button(local).trigger("click");
+      await flushPromises();
+      expect(exitSpy).not.toHaveBeenCalled();
+      expect(requestSpy).not.toHaveBeenCalled();
+      expect(isPinned(local)).toBe(true);
+      expect(button(local).attributes("aria-label")).toBe("Exit full screen");
+    });
+
+    it("ignores a second click while the first request is pending, then pins on entry", async () => {
+      const settle = deferRequest();
+      const local = await mountSupported();
+      await button(local).trigger("click");
+      await button(local).trigger("click");
+      expect(requestSpy).toHaveBeenCalledTimes(1);
+
+      await fireChange(document.documentElement);
+      settle();
+      await flushPromises();
+      expect(isPinned(local)).toBe(true);
+      expect(button(local).attributes("aria-label")).toBe("Exit full screen");
+      expect(exitSpy).not.toHaveBeenCalled();
+    });
+
+    it("leaves the player unchanged when the browser denies the request", async () => {
+      requestSpy.mockImplementation(() => Promise.reject(new Error("denied")));
+      const local = await mountSupported();
+      await button(local).trigger("click");
+      await flushPromises();
+      expect(isPinned(local)).toBe(false);
+      expect(button(local).attributes("aria-label")).toBe("Full screen");
+
+      await fireChange(document.documentElement);
+      expect(isPinned(local)).toBe(false);
+    });
+
+    it("exits full screen and drops its listener on unmount while active", async () => {
+      removeSpy = vi.spyOn(document, "removeEventListener");
+      const local = await mountSupported();
+      await button(local).trigger("click");
+      await fireChange(document.documentElement);
+
+      local.unmount();
+      expect(exitSpy).toHaveBeenCalledTimes(1);
+      expect(removeSpy).toHaveBeenCalledWith("fullscreenchange", expect.any(Function));
+    });
+
+    it("exits full screen when deactivated by keep-alive while active", async () => {
+      const host = await mountKept();
+      await host.find('[data-test="video-player-fullscreen-btn"]').trigger("click");
+      await fireChange(document.documentElement);
+
+      await host.setProps({ show: false });
+      await flushPromises();
+      expect(exitSpy).toHaveBeenCalledTimes(1);
+    });
+
+    it("exits a full screen that lands after the player unmounted mid-request", async () => {
+      const settle = deferRequest();
+      const local = await mountSupported();
+      await button(local).trigger("click");
+      local.unmount();
+
+      fullscreenEl = document.documentElement;
+      settle();
+      await flushPromises();
+      expect(exitSpy).toHaveBeenCalledTimes(1);
+    });
+
+    it("exits a full screen that lands after keep-alive deactivated the player mid-request", async () => {
+      const settle = deferRequest();
+      const host = await mountKept();
+      await host.find('[data-test="video-player-fullscreen-btn"]').trigger("click");
+      await host.setProps({ show: false });
+      await flushPromises();
+      expect(exitSpy).not.toHaveBeenCalled();
+
+      fullscreenEl = document.documentElement;
+      settle();
+      await flushPromises();
+      expect(exitSpy).toHaveBeenCalledTimes(1);
+    });
+
+    describe("through the ResizeObserver", () => {
+      let OriginalResizeObserver: typeof ResizeObserver;
+      let callbacks: ResizeObserverCallback[];
+
+      beforeEach(() => {
+        OriginalResizeObserver = global.ResizeObserver;
+        callbacks = [];
+        function MockRO(this: any, cb: ResizeObserverCallback) {
+          callbacks.push(cb);
+        }
+        MockRO.prototype.observe = vi.fn();
+        MockRO.prototype.disconnect = vi.fn();
+        MockRO.prototype.unobserve = vi.fn();
+        global.ResizeObserver = MockRO as unknown as typeof ResizeObserver;
+      });
+
+      afterEach(() => {
+        global.ResizeObserver = OriginalResizeObserver;
+      });
+
+      it("re-fits the frame and the bar through the ResizeObserver after entering and exiting", async () => {
+        const local = await mountSupported();
+        await local.setProps({ segments: mockSegments });
+        await flushPromises();
+        const instance = playerSpies.instances.at(-1);
+        const fire = () => callbacks.forEach((cb) => cb([], {} as ResizeObserver));
+        const setSize = (width: number, height: number) => {
+          Object.defineProperty(HTMLElement.prototype, "clientWidth", {
+            configurable: true,
+            value: width,
+          });
+          Object.defineProperty(HTMLElement.prototype, "clientHeight", {
+            configurable: true,
+            value: height,
+          });
+        };
+        const markerLeft = () =>
+          parseFloat(
+            (local.find('[data-test="video-player-event-marker"]').element as HTMLElement).style
+              .left,
+          );
+        fire();
+        await flushPromises();
+        const leftBefore = markerLeft();
+        expect(leftBefore).toBeGreaterThan(0);
+
+        setSize(1600, 1200);
+        await button(local).trigger("click");
+        await fireChange(document.documentElement);
+        fire();
+        await flushPromises();
+        expect((local.vm as any).playerState.width).toBe(1600);
+        expect(instance.$set).toHaveBeenLastCalledWith(expect.objectContaining({ width: 1600 }));
+        expect(markerLeft()).toBeCloseTo(leftBefore * 2);
+
+        setSize(800, 600);
+        await fireChange(null);
+        fire();
+        await flushPromises();
+        expect((local.vm as any).playerState.width).toBe(800);
+        expect(instance.$set).toHaveBeenLastCalledWith(expect.objectContaining({ width: 800 }));
+        expect(markerLeft()).toBeCloseTo(leftBefore);
+      });
+    });
+  });
+
   describe("Error and empty states", () => {
     it("shows the load error with a Retry that reaches the parent", async () => {
       const local = mountComponent({ loadState: "error" });
diff --git a/web/src/components/rum/VideoPlayer.vue b/web/src/components/rum/VideoPlayer.vue
index cc8e8cf5c1..9688fd3057 100644
--- a/web/src/components/rum/VideoPlayer.vue
+++ b/web/src/components/rum/VideoPlayer.vue
@@ -15,7 +15,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 -->
 
 <template>
-  <div class="player-container flex h-full flex-col p-2">
+  <div
+    class="player-container flex h-full flex-col p-2"
+    :class="{ 'bg-surface-base fixed inset-0 z-5000': isFullscreen }"
+    data-test="video-player-root"
+  >
     <div ref="playerContainerRef" class="relative flex min-h-0 flex-1 items-center justify-center">
       <div
         v-if="showLoader"
@@ -165,6 +169,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             :searchable="false"
             @update:model-value="setSpeed"
           />
+          <OButton
+            v-if="fullscreenSupported"
+            class="ms-2"
+            variant="ghost"
+            size="icon-sm"
+            :aria-label="fullscreenLabel"
+            data-test="video-player-fullscreen-btn"
+            @click="handleFullscreenToggle"
+          >
+            <template #icon-left
+              ><OIcon :name="isFullscreen ? 'fullscreen-exit' : 'fullscreen'" size="sm"
+            /></template>
+            <OTooltip :content="fullscreenLabel" />
+          </OButton>
         </div>
       </div>
     </div>
@@ -191,9 +209,11 @@ import { useStore } from "vuex";
 import { useToast } from "@/lib/feedback/Toast/useToast";
 import { raw, useI18nTyped } from "@/types/i18n";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OSwitch from "@/lib/forms/Switch/OSwitch.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import type { SelectModelValue } from "@/lib/forms/Select/OSelect.types";
 import type { SwitchValue } from "@/lib/forms/Switch/OSwitch.types";
 import ReplayLoadBand from "@/components/rum/ReplayLoadBand.vue";
@@ -328,6 +348,12 @@ const localSkipInactivity = ref(true);
 const timelineMs = ref(0);
 const hoverMs = ref<number | null>(null);
 const hoverEvent = ref<any>(null);
+const fullscreenSupported = document.fullscreenEnabled === true;
+const isFullscreen = ref(false);
+// The page-level full screen may belong to another component; only one this player requested pins it.
+let startedFullscreen = false;
+// A second click while a request is pending would reject and clear the ownership the first one set.
+let fullscreenRequestPending = false;
 
 const speedOptions = [
   {
@@ -358,6 +384,9 @@ const speedOptions = [
 
 const speedValue = computed(() => props.speed ?? localSpeed.value);
 const skipInactivityValue = computed(() => props.skipInactivity ?? localSkipInactivity.value);
+const fullscreenLabel = computed(() =>
+  isFullscreen.value ? t("rum.exitFullScreen") : t("rum.fullScreen"),
+);
 
 // Covers the replay surface until the player is built or loading settles, so its first frame never shows under the loader.
 const showLoader = computed(
@@ -433,7 +462,6 @@ const playerState = ref({
     actions: true,
     errors: true,
   },
-  fullScreen: false,
   startTime: 0,
   endTime: 0,
   totalTime: 0,
@@ -510,10 +538,12 @@ onBeforeMount(async () => {
 
 onMounted(() => {
   attachResizeObserver();
+  document.addEventListener("fullscreenchange", syncFullscreen);
 });
 
 onActivated(() => {
   attachResizeObserver();
+  document.addEventListener("fullscreenchange", syncFullscreen);
   if (player.value) {
     const { width, height } = calculatePlayerDimensions();
     if (playerRef.value) playerRef.value.style.width = `${width}px`;
@@ -524,6 +554,7 @@ onActivated(() => {
 
 onDeactivated(() => {
   detachResizeObserver();
+  leaveFullscreen();
 });
 
 const importVideoPlayer = async () => {
@@ -536,6 +567,7 @@ const importVideoPlayer = async () => {
 
 onBeforeUnmount(() => {
   detachResizeObserver();
+  leaveFullscreen();
   if (worker.value) {
     worker.value.terminate();
   }
@@ -573,6 +605,49 @@ function detachResizeObserver() {
   resizeObserver.value = null;
 }
 
+function syncFullscreen() {
+  const active = document.fullscreenElement === document.documentElement;
+  if (!active) startedFullscreen = false;
+  isFullscreen.value = active && startedFullscreen;
+}
+
+// The listener is gone before the exit's fullscreenchange arrives, so the state is reset here.
+function leaveFullscreen() {
+  document.removeEventListener("fullscreenchange", syncFullscreen);
+  if (isFullscreen.value && document.fullscreenElement) {
+    void document.exitFullscreen().catch(() => {});
+  }
+  isFullscreen.value = false;
+  startedFullscreen = false;
+}
+
+async function handleFullscreenToggle() {
+  if (fullscreenRequestPending) return;
+  if (isFullscreen.value) {
+    await document.exitFullscreen().catch(() => {});
+    return;
+  }
+  startedFullscreen = true;
+  // Re-requesting the current full-screen element may fire no fullscreenchange, so ownership is synced here.
+  if (document.fullscreenElement === document.documentElement) {
+    syncFullscreen();
+    return;
+  }
+  fullscreenRequestPending = true;
+  try {
+    await document.documentElement.requestFullscreen();
+    // Unmount or deactivation during the request cleared ownership, so no player would ever exit it.
+    if (!startedFullscreen && document.fullscreenElement === document.documentElement) {
+      void document.exitFullscreen().catch(() => {});
+    }
+  } catch {
+    // A denied request changes nothing, so this player must not claim a later full screen.
+    startedFullscreen = false;
+  } finally {
+    fullscreenRequestPending = false;
+  }
+}
+
 function calculatePlayerDimensions(): { width: number; height: number } {
   if (!playerContainerRef.value) return { width: 0, height: 0 };
 
diff --git a/web/src/components/rum/performance/PerformanceOverview.spec.ts b/web/src/components/rum/performance/PerformanceOverview.spec.ts
new file mode 100644
index 0000000000..538dc1571e
--- /dev/null
+++ b/web/src/components/rum/performance/PerformanceOverview.spec.ts
@@ -0,0 +1,460 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+import { reactive } from "vue";
+
+const mockSearch = vi.fn();
+const mockReplace = vi.fn();
+const mockPush = vi.fn();
+const mockRoute = reactive<{ query: Record<string, unknown> }>({ query: {} });
+
+vi.mock("vuex", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("vuex")>()),
+  useStore: () => ({
+    state: { selectedOrganization: { identifier: "org" }, zoConfig: {} },
+  }),
+}));
+vi.mock("vue-router", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("vue-router")>()),
+  useRoute: () => mockRoute,
+  useRouter: () => ({ replace: mockReplace, push: mockPush }),
+}));
+vi.mock("@/components/dashboards/PanelSchemaRenderer.vue", () => ({
+  default: { name: "PanelSchemaRenderer", template: "<div />" },
+}));
+vi.mock("@/services/search", () => ({
+  default: { search: (...a: unknown[]) => mockSearch(...a) },
+}));
+
+import PerformanceOverview from "./PerformanceOverview.vue";
+import { b64EncodeUnicode } from "@/utils/zincutils";
+
+type Hits = Record<string, unknown>[];
+type Responder = (sql: string) => Hits | { status: number } | Error;
+
+const SCHEMA = new Set([
+  "service",
+  "env",
+  "version",
+  "session_id",
+  "view_id",
+  "view_url",
+  "view_error_count",
+  "error_handling",
+  "view_largest_contentful_paint",
+  "view_interaction_to_next_paint",
+  "view_cumulative_layout_shift",
+]);
+
+const START = new Date(1_700_000_000_000);
+const END = new Date(1_700_000_000_000 + 24 * 3_600_000);
+
+const vitalsRow = (views: number) => ({
+  views,
+  lcp_p50: 1e9,
+  lcp_p75: 2e9,
+  lcp_p95: 3e9,
+  lcp_n: views,
+  lcp_good: views,
+  lcp_poor: 0,
+  inp_p50: 1e8,
+  inp_p75: 1e8,
+  inp_p95: 1e8,
+  inp_n: views,
+  inp_good: views,
+  inp_poor: 0,
+  cls_p50: 0.01,
+  cls_p75: 0.02,
+  cls_p95: 0.03,
+  cls_n: views,
+  cls_good: views,
+  cls_poor: 0,
+});
+
+const healthy: Responder = (sql) => {
+  if (sql.includes("approx_percentile_cont(lcp, 0.5)")) return [{ w: 1, ...vitalsRow(500) }];
+  if (sql.includes("histogram")) return [];
+  if (sql.includes("COUNT(DISTINCT session_id) AS sessions")) {
+    return [{ w: 1, sessions: 200, err_sessions: 20, errors: 40, unhandled: 10 }];
+  }
+  return [];
+};
+
+let responder: Responder = healthy;
+
+const OverviewPanelStateStub = {
+  name: "OverviewPanelState",
+  props: ["status", "dataTest", "emptyTitle", "busy"],
+  template:
+    '<section :data-status="status" :data-empty-title="emptyTitle" :data-test="dataTest"><slot /></section>',
+};
+const KpiTileStub = {
+  name: "KpiTile",
+  props: ["to", "dataTest", "delta", "value", "ariaLabel"],
+  template: "<i />",
+};
+const VerdictCardStub = {
+  name: "VerdictCard",
+  props: ["percentile", "sessions"],
+  template: "<i />",
+};
+const OSelectStub = { name: "OSelect", props: ["modelValue", "label"], template: "<i />" };
+
+const mountOverview = async (props: Record<string, unknown> = {}) => {
+  mockSearch.mockImplementation(async (args: { query: { query: { sql: string } } }) => {
+    const out = responder(args.query.query.sql);
+    if (out instanceof Error) throw out;
+    if (!Array.isArray(out)) throw { response: { status: out.status, data: { message: "no" } } };
+    return { data: { hits: out } };
+  });
+  const w = mount(PerformanceOverview, {
+    props: {
+      dateTime: { start_time: START, end_time: END },
+      schema: SCHEMA,
+      selectedDate: { valueType: "relative", relativeTimePeriod: "1d" },
+      ...props,
+    },
+    global: {
+      stubs: {
+        OverviewPanelState: OverviewPanelStateStub,
+        KpiTile: KpiTileStub,
+        VerdictCard: VerdictCardStub,
+        OSelect: OSelectStub,
+        PagesToFix: true,
+        SegmentPanel: true,
+        ReleaseComparison: true,
+        FrustrationPanel: true,
+        SessionsErrorsChart: true,
+        OCard: { template: "<div><slot /></div>" },
+        OBanner: { template: "<div><slot /><slot name='actions' /></div>" },
+        OEmptyState: {
+          template:
+            "<div><slot name='title' /><slot name='description' /><slot name='actions' /></div>",
+        },
+        OButton: { template: "<button><slot /></button>" },
+      },
+    },
+  });
+  await flushPromises();
+  return w;
+};
+
+const tile = (w: Awaited<ReturnType<typeof mountOverview>>, key: string) =>
+  w
+    .findAllComponents({ name: "KpiTile" })
+    .find((c) => c.props("dataTest") === `rum-overview-kpi-${key}`)!;
+
+describe("PerformanceOverview", () => {
+  beforeEach(() => {
+    mockSearch.mockReset();
+    mockReplace.mockReset();
+    mockPush.mockReset();
+    mockRoute.query = {};
+    responder = healthy;
+  });
+
+  describe("drill-down links", () => {
+    it("sends the Sessions tile to Sessions with no query text and the relative period", async () => {
+      const w = await mountOverview();
+      expect(tile(w, "sessions").props("to")).toEqual({
+        name: "Sessions",
+        query: { org_identifier: "org", period: "1d" },
+      });
+    });
+
+    it("sends the Error-free tile to Sessions with health=clean and no tautology", async () => {
+      const w = await mountOverview();
+      const to = tile(w, "errorFree").props("to") as { query: Record<string, string> };
+      expect(to.query).toEqual({ org_identifier: "org", period: "1d", health: "clean" });
+    });
+
+    it("sends the unhandled tile to Error Tracking with a base64 filter", async () => {
+      const w = await mountOverview();
+      expect(tile(w, "unhandled").props("to")).toEqual({
+        name: "ErrorTracking",
+        query: {
+          org_identifier: "org",
+          period: "1d",
+          query: b64EncodeUnicode("error_handling='unhandled'"),
+        },
+      });
+    });
+
+    it("passes the absolute range in microseconds for an absolute picker", async () => {
+      const w = await mountOverview({ selectedDate: { valueType: "absolute" } });
+      const to = tile(w, "errors").props("to") as { query: Record<string, string> };
+      expect(to.query.from).toBe(String(START.getTime() * 1000));
+      expect(to.query.to).toBe(String(END.getTime() * 1000));
+      expect(to.query.period).toBeUndefined();
+    });
+
+    it("scopes drill links to browser rows when the stream has a source column", async () => {
+      const w = await mountOverview({ schema: new Set([...SCHEMA, "source"]) });
+      const to = tile(w, "sessions").props("to") as { query: Record<string, string> };
+      expect(to.query.query).toBe(
+        b64EncodeUnicode("(source IS NULL OR source IN ('', 'browser'))"),
+      );
+      expect(
+        mockSearch.mock.calls.every((c) =>
+          c[0].query.query.sql.includes("(source IS NULL OR source IN ('', 'browser'))"),
+        ),
+      ).toBe(true);
+    });
+
+    it("carries the selected filters into the drill scope", async () => {
+      mockRoute.query = { ov_service: "web" };
+      const w = await mountOverview();
+      const to = tile(w, "unhandled").props("to") as { query: Record<string, string> };
+      expect(to.query.query).toBe(
+        b64EncodeUnicode("error_handling='unhandled' AND service IN ('web')"),
+      );
+    });
+  });
+
+  describe("reloads", () => {
+    it("reloads on Refresh even when the absolute range is unchanged", async () => {
+      const w = await mountOverview();
+      const before = mockSearch.mock.calls.length;
+      await w.setProps({ dateTime: { start_time: new Date(START), end_time: new Date(END) } });
+      await flushPromises();
+      expect(mockSearch.mock.calls.length).toBeGreaterThan(before);
+    });
+
+    it("keeps the previous panels on screen, marked busy, while a reload is in flight", async () => {
+      const w = await mountOverview();
+      let open: () => void = () => {};
+      mockSearch.mockImplementation(async (args: { query: { query: { sql: string } } }) => {
+        await new Promise<void>((r) => (open = r));
+        return { data: { hits: healthy(args.query.query.sql) } };
+      });
+      await w.setProps({ dateTime: { start_time: new Date(START), end_time: new Date(END) } });
+      await flushPromises();
+      const verdict = w.find('[data-test="rum-overview-verdict"]');
+      expect(verdict.attributes("data-status")).toBe("ok");
+      expect(w.find('[data-test="rum-overview-kpis"]').attributes("data-status")).toBe("ok");
+      expect(w.findComponent({ name: "VerdictCard" }).exists()).toBe(true);
+      expect(w.findComponent({ name: "OverviewPanelState" }).props("busy")).toBe(true);
+      open();
+    });
+
+    it("gives the chart its own error state whose Retry reruns only the series", async () => {
+      responder = (sql) => (sql.includes("histogram") ? new Error("boom") : healthy(sql));
+      const w = await mountOverview();
+      expect(w.find('[data-test="rum-overview-chart"]').attributes("data-status")).toBe("error");
+      responder = healthy;
+      const before = mockSearch.mock.calls.length;
+      w.findAllComponents({ name: "OverviewPanelState" })
+        .find((c) => c.props("dataTest") === "rum-overview-chart")!
+        .vm.$emit("retry");
+      await flushPromises();
+      const rerun = mockSearch.mock.calls.slice(before).map((c) => c[0].query.query.sql as string);
+      expect(rerun).toHaveLength(1);
+      expect(rerun[0]).toContain("histogram");
+    });
+  });
+
+  describe("empty page actions", () => {
+    it("offers Clear filters first when a filter is active", async () => {
+      responder = () => [];
+      mockRoute.query = { ov_env: "stage" };
+      const w = await mountOverview();
+      const clear = w.find('[data-test="rum-overview-page-clear-filters"]');
+      expect(clear.exists()).toBe(true);
+      expect(w.find('[data-test="rum-overview-page-empty"]').text()).toContain(
+        "Nothing matches these filters",
+      );
+      await clear.trigger("click");
+      await flushPromises();
+      expect(mockReplace).toHaveBeenLastCalledWith({ query: {} });
+    });
+
+    it("suggests widening a quiet range and keeps SDK setup as the other action", async () => {
+      responder = () => [];
+      const w = await mountOverview();
+      expect(w.find('[data-test="rum-overview-page-clear-filters"]').exists()).toBe(false);
+      expect(w.find('[data-test="rum-overview-page-empty"]').text()).toContain(
+        "Widen the time range",
+      );
+      expect(w.find('[data-test="rum-overview-page-setup"]').exists()).toBe(true);
+    });
+  });
+
+  describe("panel links", () => {
+    it("names each KPI tile's destination for assistive tech", async () => {
+      const w = await mountOverview();
+      expect(tile(w, "sessions").props("ariaLabel")).toBe("Sessions: 200. Open Sessions");
+      expect(tile(w, "errors").props("ariaLabel")).toBe("Total errors: 40. Open Error Tracking");
+    });
+
+    it("opens Product Analytics Overview for all pages with the org and relative period", async () => {
+      const w = await mountOverview();
+      expect(w.findComponent({ name: "PagesToFix" }).props("allPagesLink")).toEqual({
+        name: "productAnalyticsOverview",
+        query: { org_identifier: "org", period: "1d" },
+      });
+    });
+
+    it("carries an absolute range to Product Analytics as from/to microseconds", async () => {
+      const w = await mountOverview({ selectedDate: { valueType: "absolute" } });
+      expect(w.findComponent({ name: "PagesToFix" }).props("allPagesLink")).toEqual({
+        name: "productAnalyticsOverview",
+        query: {
+          org_identifier: "org",
+          from: String(START.getTime() * 1000),
+          to: String(END.getTime() * 1000),
+        },
+      });
+    });
+
+    it("sends the replay link to frustrated sessions in the same range", async () => {
+      const w = await mountOverview();
+      expect(w.findComponent({ name: "FrustrationPanel" }).props("replaysLink")).toEqual({
+        name: "Sessions",
+        query: { org_identifier: "org", period: "1d", health: "frustrated" },
+      });
+    });
+  });
+
+  describe("lazy pages", () => {
+    let observed: ((entries: { isIntersecting: boolean }[]) => void) | null;
+    const pageCalls = () =>
+      mockSearch.mock.calls.filter((c) => c[0].query.query.sql.includes("GROUP BY pg")).length;
+
+    beforeEach(() => {
+      observed = null;
+      vi.stubGlobal(
+        "IntersectionObserver",
+        class {
+          constructor(cb: (entries: { isIntersecting: boolean }[]) => void) {
+            observed = cb;
+          }
+          observe() {}
+          disconnect() {}
+        },
+      );
+    });
+    afterEach(() => {
+      vi.unstubAllGlobals();
+    });
+
+    it("holds the pages query until its panel scrolls into view", async () => {
+      const w = await mountOverview();
+      expect(pageCalls()).toBe(0);
+      expect(w.find('[data-test="rum-overview-pages"]').attributes("data-status")).toBe("loading");
+      observed!([{ isIntersecting: false }]);
+      await flushPromises();
+      expect(pageCalls()).toBe(0);
+      observed!([{ isIntersecting: true }]);
+      await flushPromises();
+      expect(pageCalls()).toBe(1);
+    });
+
+    it("does not count unrequested pages against the page-level error", async () => {
+      responder = () => new Error("boom");
+      const w = await mountOverview();
+      expect(pageCalls()).toBe(0);
+      expect(w.find('[data-test="rum-overview-page-error"]').exists()).toBe(true);
+    });
+  });
+
+  describe("page states", () => {
+    it("shows one page-level empty state with the setup action", async () => {
+      responder = () => [];
+      const w = await mountOverview();
+      expect(w.find('[data-test="rum-overview-page-empty"]').exists()).toBe(true);
+      expect(w.find('[data-test="rum-overview-verdict"]').exists()).toBe(false);
+    });
+
+    it("shows one page-level error with a single Retry that reloads everything", async () => {
+      responder = () => new Error("boom");
+      const w = await mountOverview();
+      expect(w.find('[data-test="rum-overview-page-error"]').exists()).toBe(true);
+      const before = mockSearch.mock.calls.length;
+      responder = healthy;
+      await w.find('[data-test="rum-overview-page-retry"]').trigger("click");
+      await flushPromises();
+      expect(mockSearch.mock.calls.length).toBeGreaterThan(before);
+      expect(w.find('[data-test="rum-overview-page-error"]').exists()).toBe(false);
+    });
+
+    it("shows a distinct no-permission message without Retry when forbidden", async () => {
+      responder = () => ({ status: 403 });
+      const w = await mountOverview();
+      expect(w.find('[data-test="rum-overview-page-forbidden"]').exists()).toBe(true);
+      expect(w.find('[data-test="rum-overview-page-retry"]').exists()).toBe(false);
+      expect(w.find('[data-test="rum-overview-page-error"]').exists()).toBe(false);
+    });
+
+    it("marks the verdict panel low-data under 100 views", async () => {
+      responder = (sql) =>
+        sql.includes("approx_percentile_cont(lcp, 0.5)")
+          ? [{ w: 1, ...vitalsRow(38) }]
+          : healthy(sql);
+      const w = await mountOverview();
+      expect(w.find('[data-test="rum-overview-verdict"]').attributes("data-status")).toBe("low");
+    });
+
+    it("hands the verdict a session count only once the KPIs have loaded", async () => {
+      const w = await mountOverview();
+      expect(w.findComponent({ name: "VerdictCard" }).props("sessions")).toBe(200);
+    });
+  });
+
+  it("gives the KPI panel sessions-specific empty copy, not page-view copy", async () => {
+    const w = await mountOverview();
+    expect(w.find('[data-test="rum-overview-kpis"]').attributes("data-empty-title")).toBe(
+      "No sessions in this range",
+    );
+  });
+
+  describe("filters and percentile in the route", () => {
+    it("restores filters and percentile from the query on mount", async () => {
+      mockRoute.query = { ov_env: ["prod", "stage"], ov_pct: "p95" };
+      const w = await mountOverview();
+      const env = w
+        .findAllComponents({ name: "OSelect" })
+        .find((c) => c.props("label") === "Environment")!;
+      expect(env.props("modelValue")).toEqual(["prod", "stage"]);
+      expect(w.findComponent({ name: "VerdictCard" }).props("percentile")).toBe("p95");
+    });
+
+    it("writes a changed filter to the route, merging the page's own params", async () => {
+      mockRoute.query = { period: "1d", org_identifier: "org" };
+      const w = await mountOverview();
+      w.findAllComponents({ name: "OSelect" })
+        .find((c) => c.props("label") === "Service")!
+        .vm.$emit("update:modelValue", ["web"]);
+      await flushPromises();
+      expect(mockReplace).toHaveBeenLastCalledWith({
+        query: { period: "1d", org_identifier: "org", ov_service: ["web"] },
+      });
+    });
+
+    it("writes a changed percentile and drops it again at p75", async () => {
+      const w = await mountOverview();
+      w.findComponent({ name: "VerdictCard" }).vm.$emit("update:percentile", "p50");
+      await flushPromises();
+      expect(mockReplace).toHaveBeenLastCalledWith({ query: { ov_pct: "p50" } });
+    });
+
+    it("hides a filter whose column the stream lacks", async () => {
+      const w = await mountOverview({ schema: new Set([...SCHEMA].filter((f) => f !== "env")) });
+      const labels = w.findAllComponents({ name: "OSelect" }).map((c) => c.props("label"));
+      expect(labels).toEqual(["Service", "Version"]);
+    });
+  });
+});
diff --git a/web/src/components/rum/performance/PerformanceOverview.vue b/web/src/components/rum/performance/PerformanceOverview.vue
new file mode 100644
index 0000000000..1f746ff3c1
--- /dev/null
+++ b/web/src/components/rum/performance/PerformanceOverview.vue
@@ -0,0 +1,479 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <OContent
+    y
+    class="flex flex-col gap-4"
+    :aria-label="t('rum.overviewPage.regionLabel')"
+    role="region"
+    data-test="rum-overview"
+  >
+    <div
+      v-if="visibleFilters.length"
+      class="flex flex-wrap items-center gap-2"
+      data-test="rum-overview-filters"
+    >
+      <OSelect
+        v-for="f in visibleFilters"
+        :key="f.key"
+        :model-value="filters[f.key]"
+        :options="filterOptions[f.key]"
+        multiple
+        searchable
+        size="sm"
+        width="md"
+        label-position="inside"
+        :label="t(f.label)"
+        :placeholder="t('rum.overviewPage.filterAll')"
+        :data-test="`rum-overview-filter-${f.key}`"
+        @update:model-value="setFilter(f.key, $event)"
+      />
+    </div>
+
+    <div v-if="pageState === 'error'" role="alert" data-test="rum-overview-page-error">
+      <OEmptyState size="compact" preset="load-error">
+        <template #title>{{ t("rum.overviewPage.pageErrorTitle") }}</template>
+        <template #description>{{ t("rum.overviewPage.pageErrorBody") }}</template>
+        <template #actions>
+          <OButton
+            variant="outline"
+            size="sm"
+            icon-left="refresh"
+            data-test="rum-overview-page-retry"
+            @click="loadAll"
+          >
+            {{ t("rum.overviewPage.retry") }}
+          </OButton>
+        </template>
+      </OEmptyState>
+    </div>
+
+    <OEmptyState
+      v-else-if="pageState === 'forbidden'"
+      size="compact"
+      preset="no-access"
+      data-test="rum-overview-page-forbidden"
+    >
+      <template #title>{{ t("rum.overviewPage.pageForbiddenTitle") }}</template>
+      <template #description>{{ t("rum.overviewPage.forbiddenBody") }}</template>
+    </OEmptyState>
+
+    <OEmptyState
+      v-else-if="pageState === 'empty'"
+      size="compact"
+      data-test="rum-overview-page-empty"
+    >
+      <template #title>{{ t("rum.overviewPage.stateEmptyTitle") }}</template>
+      <template #description>
+        {{
+          filtersActive
+            ? t("rum.overviewPage.stateEmptyFiltered")
+            : t("rum.overviewPage.stateEmptyQuiet")
+        }}
+      </template>
+      <template #actions>
+        <OButton
+          v-if="filtersActive"
+          variant="primary"
+          size="sm"
+          data-test="rum-overview-page-clear-filters"
+          @click="clearFilters"
+        >
+          {{ t("rum.overviewPage.clearFilters") }}
+        </OButton>
+        <OButton
+          :variant="filtersActive ? 'ghost' : 'outline'"
+          size="sm"
+          data-test="rum-overview-page-setup"
+          @click="openSetup"
+        >
+          {{ t("rum.overviewPage.stateEmptyAction") }}
+        </OButton>
+      </template>
+    </OEmptyState>
+
+    <div v-else class="grid grid-cols-1 items-start gap-4 xl:grid-cols-[minmax(0,1fr)_22rem]">
+      <div class="flex min-w-0 flex-col gap-4">
+        <OverviewPanelState
+          :status="status.verdict"
+          :busy="busy.verdict"
+          :panel-label="t('rum.overviewPage.panelVitals')"
+          :low-count="vitals?.views ?? 0"
+          data-test="rum-overview-verdict"
+          @retry="retry('verdict')"
+        >
+          <VerdictCard
+            v-if="vitals"
+            v-model:percentile="percentile"
+            :vitals="vitals"
+            :prev="prevUsable ? vitalsPrev : null"
+            :sessions="status.kpis === 'ok' ? (totals.cur?.sessions ?? null) : null"
+            :hide-verdict="status.verdict === 'low'"
+            :sessions-link="sessionsLink"
+          />
+        </OverviewPanelState>
+
+        <OverviewPanelState
+          :status="status.kpis"
+          :busy="busy.kpis"
+          :panel-label="t('rum.overviewPage.panelKpis')"
+          :empty-title="t('rum.overviewPage.kpiEmptyTitle')"
+          :empty-body="t('rum.overviewPage.kpiEmptyBody')"
+          data-test="rum-overview-kpis"
+          @retry="retry('kpis')"
+        >
+          <ul
+            class="m-0 grid list-none grid-cols-1 gap-3 p-0 sm:grid-cols-2 2xl:grid-cols-4"
+            :aria-label="t('rum.overviewPage.kpiRegion')"
+          >
+            <li v-for="k in kpis" :key="k.key">
+              <KpiTile v-bind="k" />
+            </li>
+          </ul>
+        </OverviewPanelState>
+
+        <OverviewPanelState
+          v-if="chartQuery && chartInterval && range"
+          :status="status.chart"
+          :busy="busy.chart"
+          :panel-label="t('rum.overviewPage.chartTitle')"
+          :empty-title="t('rum.overviewPage.kpiEmptyTitle')"
+          :empty-body="t('rum.overviewPage.kpiEmptyBody')"
+          data-test="rum-overview-chart"
+          @retry="retry('chart')"
+        >
+          <SessionsErrorsChart
+            :sql="chartQuery"
+            :interval="chartInterval"
+            :range="range"
+            :points="series"
+            :hits="chartHits"
+            :marker="releaseMarker"
+          />
+        </OverviewPanelState>
+
+        <div ref="pagesEl">
+          <OverviewPanelState
+            :status="status.pages"
+            :busy="busy.pages"
+            :panel-label="t('rum.overviewPage.panelPages')"
+            :empty-title="t('rum.overviewPage.pagesEmptyTitle')"
+            :empty-body="t('rum.overviewPage.pagesEmptyBody', { n: MIN_VIEWS })"
+            data-test="rum-overview-pages"
+            @retry="retry('pages')"
+          >
+            <PagesToFix
+              :pages="pages"
+              :sessions-link="sessionsLink"
+              :errors-link="errorsLink"
+              :all-pages-link="allPagesLink"
+              :schema="schema ?? new Set()"
+            />
+          </OverviewPanelState>
+        </div>
+      </div>
+
+      <aside class="flex min-w-0 flex-col gap-4" :aria-label="t('rum.overviewPage.asideLabel')">
+        <OverviewPanelState
+          :status="status.segments"
+          :busy="busy.segments"
+          :panel-label="t('rum.overviewPage.panelSegments')"
+          :empty-title="t('rum.overviewPage.segEmptyTitle')"
+          :empty-body="t('rum.overviewPage.segEmptyBody')"
+          data-test="rum-overview-segments"
+          @retry="retry('segments')"
+        >
+          <SegmentPanel
+            :segments="segments"
+            :difference="difference"
+            :sessions-link="sessionsLink"
+          />
+        </OverviewPanelState>
+
+        <OverviewPanelState
+          :status="status.release"
+          :busy="busy.release"
+          :panel-label="t('rum.overviewPage.panelRelease')"
+          :empty-title="t('rum.overviewPage.releaseEmptyTitle')"
+          :empty-body="t('rum.overviewPage.releaseEmptyBody')"
+          data-test="rum-overview-release"
+          @retry="retry('release')"
+        >
+          <ReleaseComparison v-if="release" :release="release" :errors-link="errorsLink" />
+        </OverviewPanelState>
+
+        <OverviewPanelState
+          :status="status.frustration"
+          :busy="busy.frustration"
+          :panel-label="t('rum.overviewPage.panelFrustration')"
+          data-test="rum-overview-frustration"
+          @retry="retry('frustration')"
+        >
+          <FrustrationPanel
+            :cur="frustration.cur"
+            :prev="prevUsable ? frustration.prev : null"
+            :sessions-link="sessionsLink"
+            :replays-link="drill('Sessions', '', { health: 'frustrated' })"
+          />
+        </OverviewPanelState>
+      </aside>
+    </div>
+  </OContent>
+</template>
+
+<script setup lang="ts">
+import { computed, onBeforeUnmount, ref, toRef, watch } from "vue";
+import { useStore } from "vuex";
+import { useRoute, useRouter } from "vue-router";
+import type { RouteLocationRaw } from "vue-router";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OContent from "@/lib/core/Content/OContent.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OSelect from "@/lib/forms/Select/OSelect.vue";
+import FrustrationPanel from "@/components/rum/performance/overview/FrustrationPanel.vue";
+import KpiTile from "@/components/rum/performance/overview/KpiTile.vue";
+import OverviewPanelState from "@/components/rum/performance/overview/OverviewPanelState.vue";
+import PagesToFix from "@/components/rum/performance/overview/PagesToFix.vue";
+import ReleaseComparison from "@/components/rum/performance/overview/ReleaseComparison.vue";
+import SegmentPanel from "@/components/rum/performance/overview/SegmentPanel.vue";
+import SessionsErrorsChart from "@/components/rum/performance/overview/SessionsErrorsChart.vue";
+import VerdictCard from "@/components/rum/performance/overview/VerdictCard.vue";
+import useRumOverviewData from "@/composables/rum/useRumOverviewData";
+import type { RumTabDateTime } from "@/composables/rum/useRumPerformanceTab";
+import { raw, useI18nTyped, type I18nKey } from "@/types/i18n";
+import { PA_ROUTES } from "@/utils/rum/productAnalyticsRoutes";
+import { b64EncodeUnicode } from "@/utils/zincutils";
+import {
+  MIN_VIEWS,
+  analyticsQuery,
+  drillQuery,
+  formatCount,
+  formatPercent,
+  kpiDelta,
+  previousUsable,
+  queryFromState,
+  scopeWhere,
+  sparkValues,
+  stateFromQuery,
+  withoutOverviewState,
+  type OverviewFilters,
+  type Percentile,
+  type PickerRange,
+} from "@/utils/rum/performanceOverview";
+
+const props = defineProps<{
+  dateTime?: RumTabDateTime;
+  schema: Set<string> | null;
+  selectedDate?: PickerRange | null;
+}>();
+const { t } = useI18nTyped();
+const store = useStore();
+const route = useRoute();
+const router = useRouter();
+
+const FILTERS: { key: keyof OverviewFilters; label: I18nKey }[] = [
+  { key: "service", label: "rum.overviewPage.filterService" },
+  { key: "env", label: "rum.overviewPage.filterEnv" },
+  { key: "version", label: "rum.overviewPage.filterVersion" },
+];
+
+const {
+  pageState,
+  chartInterval,
+  chartQuery,
+  filters,
+  filterOptions,
+  range,
+  status,
+  vitals,
+  vitalsPrev,
+  totals,
+  series,
+  pages,
+  segments,
+  difference,
+  release,
+  releaseMarker,
+  frustration,
+  chartHits,
+  busy,
+  loadAll,
+  retry,
+  markPagesVisible,
+  abortAll,
+} = useRumOverviewData(toRef(props, "dateTime"), toRef(props, "schema"));
+
+const restored = stateFromQuery(route.query);
+filters.value = restored.filters;
+const percentile = ref<Percentile>(restored.percentile);
+
+// A filter on a column the stream lacks would only select nothing.
+const visibleFilters = computed(() => FILTERS.filter((f) => props.schema?.has(f.key)));
+
+const setFilter = (key: keyof OverviewFilters, value: unknown) => {
+  filters.value = { ...filters.value, [key]: Array.isArray(value) ? value.map(String) : [] };
+};
+
+// Primitive keys, so a new object with the same range, schema or filters does not rerun the queries.
+const rangeKey = () =>
+  `${(props.dateTime?.start_time as Date | undefined)?.getTime?.()}-${(props.dateTime?.end_time as Date | undefined)?.getTime?.()}`;
+const schemaKey = () => [...(props.schema ?? [])].sort().join(",");
+
+// The picker hands over a new object on every Refresh, even when the absolute range is unchanged.
+watch(
+  [rangeKey, schemaKey, () => JSON.stringify(filters.value), () => props.dateTime],
+  () => {
+    loadAll();
+  },
+  { immediate: true },
+);
+
+// Filters and percentile live in the URL so Share, reload and deep links restore them.
+watch([() => JSON.stringify(filters.value), percentile], () => {
+  router.replace({
+    query: {
+      ...withoutOverviewState(route.query),
+      ...queryFromState(filters.value, percentile.value),
+    },
+  });
+});
+
+const pagesEl = ref<HTMLElement | null>(null);
+let pagesObserver: IntersectionObserver | null = null;
+// Without an observer (jsdom) the pages load eagerly rather than never.
+watch(pagesEl, (el) => {
+  pagesObserver?.disconnect();
+  pagesObserver = null;
+  if (!el) return;
+  if (typeof IntersectionObserver === "undefined") {
+    markPagesVisible();
+    return;
+  }
+  pagesObserver = new IntersectionObserver(
+    (entries) => {
+      if (!entries.some((e) => e.isIntersecting)) return;
+      markPagesVisible();
+      pagesObserver?.disconnect();
+      pagesObserver = null;
+    },
+    // eslint-disable-next-line local/no-hardcoded-px -- IntersectionObserver rootMargin parses px/% only — a rem value throws SyntaxError
+    { rootMargin: "200px 0px" },
+  );
+  pagesObserver.observe(el);
+});
+onBeforeUnmount(() => {
+  pagesObserver?.disconnect();
+  abortAll();
+});
+
+const drill = (name: string, filter: string, extra?: Record<string, string>): RouteLocationRaw => ({
+  name,
+  query: drillQuery({
+    org: String(store.state.selectedOrganization.identifier),
+    filter,
+    scope: scopeWhere({ schema: props.schema ?? new Set(), filters: filters.value }),
+    range: range.value,
+    picker: props.selectedDate,
+    extra,
+    encode: b64EncodeUnicode,
+  }),
+});
+const openSetup = () =>
+  router.push({
+    name: "frontendMonitoring",
+    query: { org_identifier: String(store.state.selectedOrganization.identifier) },
+  });
+const sessionsLink = (filter: string) => drill("Sessions", filter);
+const allPagesLink = computed<RouteLocationRaw>(() => ({
+  name: PA_ROUTES.overview,
+  query: analyticsQuery({
+    org: String(store.state.selectedOrganization.identifier),
+    range: range.value,
+    picker: props.selectedDate,
+  }),
+}));
+const errorsLink = (filter: string) => drill("ErrorTracking", filter);
+
+const prevUsable = computed(() =>
+  previousUsable(
+    { views: vitalsPrev.value?.views, sessions: totals.value.prev?.sessions },
+    { views: vitals.value?.views, sessions: totals.value.cur?.sessions },
+  ),
+);
+
+const filtersActive = computed(() => Object.values(filters.value).some((v) => v.length));
+const clearFilters = () => {
+  filters.value = { service: [], env: [], version: [] };
+};
+
+const kpis = computed(() => {
+  const cur = totals.value.cur;
+  const prev = prevUsable.value ? totals.value.prev : null;
+  const spark = (pick: Parameters<typeof sparkValues>[1]) => sparkValues(series.value, pick);
+  return [
+    {
+      key: "sessions",
+      label: t("rum.overviewPage.kpiSessions"),
+      value: raw(formatCount(cur?.sessions)),
+      delta: kpiDelta(cur?.sessions ?? null, prev?.sessions ?? null, { higherIsBetter: true }),
+      spark: spark("sessions"),
+      sparkTone: "default" as const,
+      to: drill("Sessions", ""),
+    },
+    {
+      key: "errorFree",
+      label: t("rum.overviewPage.kpiErrorFree"),
+      value: raw(formatPercent(cur?.errorFree)),
+      delta: kpiDelta(cur?.errorFree ?? null, prev?.errorFree ?? null, {
+        higherIsBetter: true,
+        points: true,
+      }),
+      points: true,
+      spark: sparkValues(series.value, "errorFree"),
+      sparkTone: "success" as const,
+      to: drill("Sessions", "", { health: "clean" }),
+    },
+    {
+      key: "errors",
+      label: t("rum.overviewPage.kpiErrors"),
+      value: raw(formatCount(cur?.errors)),
+      delta: kpiDelta(cur?.errors ?? null, prev?.errors ?? null, { higherIsBetter: false }),
+      spark: spark("errors"),
+      sparkTone: "danger" as const,
+      to: errorsLink(""),
+    },
+    {
+      key: "unhandled",
+      label: t("rum.overviewPage.kpiUnhandled"),
+      value: raw(formatCount(cur?.unhandled)),
+      delta: kpiDelta(cur?.unhandled ?? null, prev?.unhandled ?? null, { higherIsBetter: false }),
+      spark: spark("unhandled"),
+      sparkTone: "warning" as const,
+      to: errorsLink("error_handling='unhandled'"),
+    },
+  ].map((k) => ({
+    ...k,
+    dataTest: `rum-overview-kpi-${k.key}`,
+    ariaLabel: t(
+      k.key === "errors" || k.key === "unhandled"
+        ? "rum.overviewPage.tileOpenErrors"
+        : "rum.overviewPage.tileOpenSessions",
+      { label: k.label, value: k.value },
+    ),
+  }));
+});
+</script>
diff --git a/web/src/components/rum/performance/PerformanceSummary.spec.ts b/web/src/components/rum/performance/PerformanceSummary.spec.ts
index 795a1383ee..e41ca731f8 100644
--- a/web/src/components/rum/performance/PerformanceSummary.spec.ts
+++ b/web/src/components/rum/performance/PerformanceSummary.spec.ts
@@ -50,7 +50,26 @@ const mockHasMobile = ref(false);
 const mockResolvedKey = ref<string | null>("0-0");
 const mockDetectPlatforms = vi.fn().mockResolvedValue(undefined);
 
+vi.mock("@/components/dashboards/PanelSchemaRenderer.vue", () => ({
+  default: { name: "PanelSchemaRenderer", template: "<div />" },
+}));
+
 vi.mock("@/composables/rum/useRumPlatforms", () => ({
+  BROWSER_ONLY_FIELDS: [
+    "view_largest_contentful_paint",
+    "view_cumulative_layout_shift",
+    "view_interaction_to_next_paint",
+    "view_first_contentful_paint",
+    "view_first_byte",
+    "view_loading_time",
+  ],
+  MOBILE_ONLY_FIELDS: [
+    "view_slow_frames_rate",
+    "view_freeze_rate",
+    "view_frozen_frame_count",
+    "view_refresh_rate_average",
+    "error_is_crash",
+  ],
   default: () => ({
     hasBrowser: mockHasBrowser,
     hasMobile: mockHasMobile,
@@ -153,10 +172,21 @@ function mountComponent(routeQuery: Record<string, any> = {}, props: Record<stri
         $route: { query: { dashboard: "test-dashboard", folder: "test-folder", ...routeQuery } },
       },
       stubs: {
+        PerformanceOverview: {
+          name: "PerformanceOverview",
+          props: ["dateTime", "schema", "selectedDate"],
+          template: "<div />",
+        },
         OSpinner: { template: '<div data-test="spinner" v-bind="$attrs" />', inheritAttrs: false },
         OEmptyState: {
           name: "OEmptyState",
-          template: '<div><slot name="title" /><slot name="description" /></div>',
+          props: ["preset"],
+          template:
+            '<div :data-preset="preset"><slot name="title" /><slot name="description" /><slot name="actions" /></div>',
+        },
+        OButton: {
+          name: "OButton",
+          template: '<button v-bind="$attrs"><slot /></button>',
         },
       },
     },
@@ -181,8 +211,16 @@ function seedRumSchema(schemaMap: Record<string, any> | null) {
 async function mountResolved(
   routeQuery: Record<string, any> = {},
   props: Record<string, any> = {},
+  platform: "mobile" | "mixed" = "mobile",
 ) {
-  seedRumSchema({ view_name: { name: "view_name" } });
+  // Mobile-only keeps the whole tile dashboard; a mixed stream adds the native overview above the mobile tiles.
+  mockHasBrowser.value = platform === "mixed";
+  mockHasMobile.value = true;
+  seedRumSchema(
+    platform === "mixed"
+      ? { view_largest_contentful_paint: { name: "x" }, error_is_crash: { name: "y" } }
+      : { view_name: { name: "view_name" } },
+  );
   const mounted = mountComponent(routeQuery, props);
   await flushPromises();
   return mounted;
@@ -282,43 +320,77 @@ describe("PerformanceSummary", () => {
   // RenderDashboardCharts integration
   // -------------------------------------------------------------------------
 
-  it("renders RenderDashboardCharts component", async () => {
-    // Arrange
-    wrapper = await mountResolved();
+  describe.each(["mobile", "mixed"] as const)(
+    "RenderDashboardCharts on a %s stream",
+    (platform) => {
+      it("renders the dashboard", async () => {
+        wrapper = await mountResolved({}, {}, platform);
+        expect(wrapper.findComponent({ name: "RenderDashboardCharts" }).exists()).toBe(true);
+      });
 
-    // Assert
-    expect(wrapper.findComponent({ name: "RenderDashboardCharts" }).exists()).toBe(true);
-  });
+      it("passes viewOnly=true and searchType=RUM", async () => {
+        wrapper = await mountResolved({}, {}, platform);
+        expect(wrapper.findComponent({ name: "RenderDashboardCharts" }).props()).toMatchObject({
+          viewOnly: true,
+          searchType: "RUM",
+        });
+      });
+    },
+  );
 
-  it("passes viewOnly=true to RenderDashboardCharts", async () => {
-    // Arrange
-    wrapper = await mountResolved();
+  it("hands the overview the real-millisecond range, the schema and the picker value", async () => {
+    mockHasBrowser.value = true;
+    mockHasMobile.value = false;
+    seedRumSchema({ view_largest_contentful_paint: { name: "view_largest_contentful_paint" } });
+    const startUs = 1_700_000_000_000_000;
 
-    // Assert
-    const charts = wrapper.findComponent({ name: "RenderDashboardCharts" });
-    expect(charts.props("viewOnly")).toBe(true);
-  });
-
-  it("passes searchType=RUM to RenderDashboardCharts", async () => {
-    // Arrange
-    wrapper = await mountResolved();
-
-    // Assert
-    const charts = wrapper.findComponent({ name: "RenderDashboardCharts" });
-    expect(charts.props("searchType")).toBe("RUM");
-  });
-
-  it("integrates with RenderDashboardCharts with correct props", async () => {
-    // Arrange
-    wrapper = await mountResolved();
-
-    // Assert
-    const chartsComponent = wrapper.findComponent({ name: "RenderDashboardCharts" });
-    expect(chartsComponent.exists()).toBe(true);
-    expect(chartsComponent.props()).toMatchObject({
-      viewOnly: true,
-      searchType: "RUM",
+    wrapper = mount(PerformanceSummary, {
+      props: {
+        dateTime: {
+          __global: { start_time: new Date(startUs), end_time: new Date(startUs + 3.6e9) },
+        },
+        selectedDate: { valueType: "relative", relativeTimePeriod: "1d" },
+      },
+      global: {
+        provide: { store: mockStore },
+        mocks: { $store: mockStore, $router: mockRouter, $route: { query: {} } },
+        stubs: {
+          PerformanceOverview: {
+            name: "PerformanceOverview",
+            props: ["dateTime", "schema", "selectedDate"],
+            template: "<div />",
+          },
+          OSpinner: true,
+          OEmptyState: true,
+        },
+      },
     });
+    await flushPromises();
+
+    const overview = wrapper.findComponent({ name: "PerformanceOverview" });
+    expect((overview.props("dateTime") as { start_time: Date }).start_time.getTime()).toBe(
+      1_700_000_000_000,
+    );
+    expect((overview.props("schema") as Set<string>).has("view_largest_contentful_paint")).toBe(
+      true,
+    );
+    expect(overview.props("selectedDate")).toEqual({
+      valueType: "relative",
+      relativeTimePeriod: "1d",
+    });
+  });
+
+  it("keeps the native overview visible while the mobile tiles are loading", async () => {
+    wrapper = await mountResolved({}, {}, "mixed");
+    wrapper.vm.isLoading.push("loading");
+    await nextTick();
+
+    const overview = wrapper.findComponent({ name: "PerformanceOverview" });
+    expect(overview.exists()).toBe(true);
+    expect(overview.element.closest(".invisible")).toBeNull();
+    expect(
+      wrapper.findComponent({ name: "RenderDashboardCharts" }).element.closest(".invisible"),
+    ).not.toBeNull();
   });
 
   // -------------------------------------------------------------------------
@@ -414,7 +486,7 @@ describe("PerformanceSummary", () => {
     expect(charts.props("dashboardData")).toEqual(convertedDashboard);
   });
 
-  it("renders the full dashboard when getStream rejects and the schema stays inconclusive", async () => {
+  it("shows an error state with Retry when the schema fetch fails", async () => {
     // Arrange
     mockGetStream.mockRejectedValueOnce(new Error("network error"));
 
@@ -422,9 +494,104 @@ describe("PerformanceSummary", () => {
     wrapper = mountComponent();
     await flushPromises();
 
-    // Assert — a transient error must never degrade a working dashboard.
-    expect(wrapper.find('[data-test="performance-summary-empty"]').exists()).toBe(false);
+    // Assert — the failure is surfaced instead of silently rendering the full dashboard
+    expect(wrapper.find('[data-test="performance-summary-schema-error"]').exists()).toBe(true);
+    expect(wrapper.findComponent({ name: "RenderDashboardCharts" }).exists()).toBe(false);
+  });
+
+  it("shows the no-permission state without Retry when the schema read is forbidden", async () => {
+    mockGetStream.mockRejectedValueOnce(
+      Object.assign(new Error("forbidden"), { response: { status: 403 } }),
+    );
+    wrapper = mountComponent();
+    await flushPromises();
+    const state = wrapper.find('[data-test="performance-summary-schema-forbidden"]');
+    expect(state.attributes("data-preset")).toBe("no-access");
+    expect(state.text()).toContain("No permission to view the performance overview");
+    expect(wrapper.find('[data-test="performance-summary-schema-retry"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="performance-summary-schema-error"]').exists()).toBe(false);
+  });
+
+  it("retries the schema fetch from the error state", async () => {
+    // Arrange
+    mockGetStream.mockRejectedValueOnce(new Error("network error"));
+    wrapper = mountComponent();
+    await flushPromises();
+
+    // Act
+    await wrapper.find('[data-test="performance-summary-schema-retry"]').trigger("click");
+    await flushPromises();
+
+    // Assert
+    expect(mockGetStream).toHaveBeenCalledTimes(2);
+    expect(wrapper.find('[data-test="performance-summary-schema-error"]').exists()).toBe(false);
+  });
+
+  it("renders the native overview, not the tile dashboard, for a browser-only stream", async () => {
+    // Arrange
+    seedRumSchema({ view_largest_contentful_paint: { name: "view_largest_contentful_paint" } });
+
+    // Act
+    wrapper = mountComponent();
+    await flushPromises();
+
+    // Assert
+    expect(wrapper.findComponent({ name: "PerformanceOverview" }).exists()).toBe(true);
+    expect(wrapper.findComponent({ name: "RenderDashboardCharts" }).exists()).toBe(false);
+  });
+
+  it("shows the overview empty state for a browser stream with no platform data in range", async () => {
+    mockHasBrowser.value = false;
+    mockHasMobile.value = false;
+    seedRumSchema({ view_largest_contentful_paint: { name: "view_largest_contentful_paint" } });
+
+    wrapper = mountComponent();
+    await flushPromises();
+
+    expect(wrapper.findComponent({ name: "PerformanceOverview" }).exists()).toBe(true);
+    expect(wrapper.findComponent({ name: "RenderDashboardCharts" }).exists()).toBe(false);
+  });
+
+  it("keeps the legacy dashboard for a mobile-only stream with no data in range", async () => {
+    mockHasBrowser.value = false;
+    mockHasMobile.value = false;
+    seedRumSchema({ error_is_crash: { name: "error_is_crash" } });
+
+    wrapper = mountComponent();
+    await flushPromises();
+
+    expect(wrapper.findComponent({ name: "PerformanceOverview" }).exists()).toBe(false);
+  });
+
+  it("does not show the overview for a stream with no browser fields and no data", async () => {
+    mockHasBrowser.value = false;
+    mockHasMobile.value = false;
+    seedRumSchema({ view_name: { name: "view_name" } });
+
+    wrapper = mountComponent();
+    await flushPromises();
+
+    expect(wrapper.findComponent({ name: "PerformanceOverview" }).exists()).toBe(false);
+  });
+
+  it("keeps the mobile tiles under the overview on a mixed stream", async () => {
+    // Arrange
+    mockHasMobile.value = true;
+    seedRumSchema({ view_largest_contentful_paint: { name: "view_largest_contentful_paint" } });
+
+    // Act
+    wrapper = mountComponent();
+    await flushPromises();
+
+    // Assert
+    expect(wrapper.findComponent({ name: "PerformanceOverview" }).exists()).toBe(true);
     expect(wrapper.findComponent({ name: "RenderDashboardCharts" }).exists()).toBe(true);
+    expect(wrapper.find('[data-test="performance-summary-browser-only-note"]').text()).toBe(
+      "This overview counts browser sessions only. Mobile app metrics are below.",
+    );
+    expect(wrapper.find('[data-test="performance-summary-mobile-filters-note"]').text()).toBe(
+      "The filters below apply to the mobile app metrics only.",
+    );
   });
 
   // -------------------------------------------------------------------------
@@ -678,7 +845,7 @@ describe("PerformanceSummary", () => {
     };
 
     // Act
-    wrapper.vm.selectedDate = newDate;
+    wrapper.vm.pickerDate = newDate;
     await nextTick();
 
     // Assert
@@ -695,7 +862,7 @@ describe("PerformanceSummary", () => {
     };
 
     // Act
-    wrapper.vm.selectedDate = dateRange;
+    wrapper.vm.pickerDate = dateRange;
     await nextTick();
 
     // Assert
@@ -731,7 +898,7 @@ describe("PerformanceSummary", () => {
 
     // Act
     wrapper.vm.refreshInterval = 0;
-    wrapper.vm.selectedDate = { relativeTimePeriod: "1h" };
+    wrapper.vm.pickerDate = { relativeTimePeriod: "1h" };
     await nextTick();
     await nextTick();
 
@@ -766,7 +933,7 @@ describe("PerformanceSummary", () => {
     expect(wrapper.vm.showEmptyState).toBe(false);
     expect(wrapper.vm.showDashboardSettingsDialog).toBe(false);
     expect(wrapper.vm.variablesData).toBeDefined();
-    expect(wrapper.vm.selectedDate).toBeDefined();
+    expect(wrapper.vm.pickerDate).toBeDefined();
     expect(wrapper.vm.currentTimeObj).toBeDefined();
     expect(wrapper.vm.refreshInterval).toBeDefined();
     expect(wrapper.vm.isLoading).toEqual([]);
diff --git a/web/src/components/rum/performance/PerformanceSummary.vue b/web/src/components/rum/performance/PerformanceSummary.vue
index 7ebd10bb20..1b469961d7 100644
--- a/web/src/components/rum/performance/PerformanceSummary.vue
+++ b/web/src/components/rum/performance/PerformanceSummary.vue
@@ -30,9 +30,40 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </div>
     </div>
 
+    <!-- The schema read was refused, which a retry cannot change -->
+    <div v-else-if="schemaForbidden" class="p-4">
+      <OEmptyState
+        size="compact"
+        preset="no-access"
+        data-test="performance-summary-schema-forbidden"
+      >
+        <template #title>{{ t("rum.overviewPage.pageForbiddenTitle") }}</template>
+        <template #description>{{ t("rum.overviewPage.forbiddenBody") }}</template>
+      </OEmptyState>
+    </div>
+
+    <!-- The schema read failed, so which panels apply is unknown -->
+    <div v-else-if="schemaError" class="p-4">
+      <OEmptyState size="compact" preset="load-error" data-test="performance-summary-schema-error">
+        <template #title>{{ t("rum.overviewPage.schemaErrorTitle") }}</template>
+        <template #description>{{ t("rum.overviewPage.schemaErrorBody") }}</template>
+        <template #actions>
+          <OButton
+            variant="outline"
+            size="sm"
+            icon-left="refresh"
+            data-test="performance-summary-schema-retry"
+            @click="retrySchema"
+          >
+            {{ t("rum.overviewPage.retry") }}
+          </OButton>
+        </template>
+      </OEmptyState>
+    </div>
+
     <!-- Stream has no metrics this view can render (e.g. no recognised RUM fields) -->
     <OEmptyState
-      v-else-if="showEmptyState"
+      v-else-if="showEmptyState && !showBrowserOverview"
       data-test="performance-summary-empty"
       size="block"
       illustration="pulse"
@@ -44,20 +75,38 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
     <template v-else>
       <!-- eslint-disable local/no-hardcoded-px -- mixed with vh/vw — vh tracks the window while rem tracks font-size; keep the expression unit-consistent -->
-      <div
-        class="max-h-[calc(100vh-200px)] min-h-0! overflow-y-auto"
-        :class="isLoading.length ? 'invisible' : 'visible'"
-      >
+      <div class="max-h-[calc(100vh-200px)] min-h-0! overflow-y-auto">
         <!-- eslint-enable local/no-hardcoded-px -->
-        <RenderDashboardCharts
-          ref="performanceChartsRef"
-          :viewOnly="true"
-          :frame="false"
-          :dashboardData="dashboardData"
-          :currentTimeObj="dateTime"
-          searchType="RUM"
-          @variablesManagerReady="onVariablesManagerReady"
+        <div v-if="showBrowserOverview && showMobileSection" class="px-4 pt-3">
+          <OText variant="meta" data-test="performance-summary-browser-only-note">
+            {{ t("rum.overviewPage.mixedBrowserNote") }}
+          </OText>
+        </div>
+        <PerformanceOverview
+          v-if="showBrowserOverview"
+          :date-time="overviewDateTime"
+          :schema="presentFields"
+          :selected-date="overviewPicker"
         />
+        <div
+          v-if="!showBrowserOverview || showMobileSection"
+          :class="isLoading.length ? 'invisible' : 'visible'"
+        >
+          <div v-if="showBrowserOverview" class="px-4 pt-4">
+            <OText variant="meta" data-test="performance-summary-mobile-filters-note">
+              {{ t("rum.overviewPage.mixedMobileNote") }}
+            </OText>
+          </div>
+          <RenderDashboardCharts
+            ref="performanceChartsRef"
+            :viewOnly="true"
+            :frame="false"
+            :dashboardData="renderedDashboard"
+            :currentTimeObj="dateTime"
+            searchType="RUM"
+            @variablesManagerReady="onVariablesManagerReady"
+          />
+        </div>
       </div>
       <div
         v-show="isLoading.length"
@@ -81,13 +130,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import {
   defineComponent,
   ref,
-  toRef,
   watch,
   onMounted,
   nextTick,
   onActivated,
+  computed,
+  shallowRef,
   type Ref,
 } from "vue";
+import { isEqual } from "lodash-es";
 import { useStore } from "vuex";
 import { useI18nTyped } from "@/types/i18n";
 import { useRouter } from "vue-router";
@@ -97,9 +148,14 @@ import { reactive } from "vue";
 import { useRoute } from "vue-router";
 import RenderDashboardCharts from "@/views/Dashboards/RenderDashboardCharts.vue";
 import overviewDashboard from "@/utils/rum/overview.json";
-import useRumPerformanceTab from "@/composables/rum/useRumPerformanceTab";
+import useRumPerformanceTab, { rangeFromPage } from "@/composables/rum/useRumPerformanceTab";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import PerformanceOverview from "@/components/rum/performance/PerformanceOverview.vue";
+import { BROWSER_ONLY_FIELDS, MOBILE_ONLY_FIELDS } from "@/composables/rum/useRumPlatforms";
+import { keepPlatformPanels } from "@/utils/rum/dashboardCapability";
 
 export default defineComponent({
   name: "PerformanceSummary",
@@ -107,12 +163,19 @@ export default defineComponent({
     RenderDashboardCharts,
     OSpinner,
     OEmptyState,
+    OButton,
+    OText,
+    PerformanceOverview,
   },
   props: {
     dateTime: {
       type: Object,
       default: () => ({}),
     },
+    selectedDate: {
+      type: Object,
+      default: null,
+    },
   },
   emits: ["variablesManagerReady"],
   setup(props, { emit }) {
@@ -123,13 +186,58 @@ export default defineComponent({
     const performanceChartsRef = ref(null);
     const isLoading: Ref<boolean[]> = ref([]);
 
-    // Adaptive dashboard: drops panels whose columns the stream can't serve, and — because
-    // this tab passes its time range — panels tagged for a platform with no data in that
-    // range, reflowing the survivors. So a browser-only stream keeps the Web Vitals section
-    // and never sees the mobile ones, a mobile-only stream the reverse, and a mixed stream
-    // gets both. See docs/designs/MOBILE_RUM_ADAPTIVE_UI_DESIGN.md.
-    const { dashboardData, schemaResolved, showEmptyState, wasFiltered, ensureRumSchema } =
-      useRumPerformanceTab(overviewDashboard, toRef(props, "dateTime"));
+    // Panels the stream cannot serve are dropped; see docs/designs/MOBILE_RUM_ADAPTIVE_UI_DESIGN.md.
+    const pageRange = computed(() => rangeFromPage(props.dateTime));
+    const {
+      dashboardData,
+      schemaResolved,
+      schemaError,
+      schemaForbidden,
+      presentFields,
+      platforms,
+      showEmptyState,
+      wasFiltered,
+      ensureRumSchema,
+    } = useRumPerformanceTab(overviewDashboard, pageRange);
+
+    const hasAny = (fields: string[]) =>
+      !presentFields.value || fields.some((f) => presentFields.value.has(f));
+
+    // With no platform data in range, the schema decides: browser-only fields mean the overview shows its empty state.
+    const schemaIsBrowserOnly = computed(
+      () =>
+        !!presentFields.value &&
+        BROWSER_ONLY_FIELDS.some((f) => presentFields.value.has(f)) &&
+        !MOBILE_ONLY_FIELDS.some((f) => presentFields.value.has(f)),
+    );
+    const showBrowserOverview = computed(() => {
+      const p = platforms.value;
+      if (!p) return hasAny(BROWSER_ONLY_FIELDS);
+      return p.hasBrowser || (!p.hasMobile && schemaIsBrowserOnly.value);
+    });
+    const showMobileSection = computed(
+      () =>
+        showBrowserOverview.value &&
+        (platforms.value
+          ? platforms.value.hasMobile
+          : !!presentFields.value && MOBILE_ONLY_FIELDS.some((f) => presentFields.value.has(f))),
+    );
+    const nextDashboard = computed(() =>
+      showBrowserOverview.value
+        ? keepPlatformPanels(dashboardData.value, "mobile")
+        : dashboardData.value,
+    );
+    // Equal content keeps one reference, so the probe landing does not make the charts requery.
+    const renderedDashboard = shallowRef(nextDashboard.value);
+    watch(nextDashboard, (next) => {
+      if (!isEqual(next, renderedDashboard.value)) renderedDashboard.value = next;
+    });
+    const overviewDateTime = pageRange;
+    const overviewPicker = computed(() => props.selectedDate);
+    const retrySchema = () => {
+      schemaResolved.value = false;
+      ensureRumSchema();
+    };
 
     onMounted(() => {
       // Fire-and-forget: ensureRumSchema resolves the gate independently and handles its
@@ -186,7 +294,7 @@ export default defineComponent({
     const dateTimePicker = ref(null); // holds a reference to the date time picker
 
     // holds the date picker v-modal
-    const selectedDate = ref(getSelectedDateFromQueryParams(route.query));
+    const pickerDate = ref(getSelectedDateFromQueryParams(route.query));
 
     // holds the current time for the dashboard
     const currentTimeObj = ref({});
@@ -195,10 +303,10 @@ export default defineComponent({
     const refreshInterval = ref(0);
 
     // when the date changes from the picker, update the current time object for the dashboard
-    watch(selectedDate, () => {
+    watch(pickerDate, () => {
       currentTimeObj.value = {
-        start_time: new Date(selectedDate.value.startTime),
-        end_time: new Date(selectedDate.value.endTime),
+        start_time: new Date(pickerDate.value.startTime),
+        end_time: new Date(pickerDate.value.endTime),
       };
     });
 
@@ -264,14 +372,14 @@ export default defineComponent({
     });
 
     // whenever the refreshInterval is changed, update the query params
-    watch([refreshInterval, selectedDate], () => {
+    watch([refreshInterval, pickerDate], () => {
       router.replace({
         query: {
           org_identifier: store.state.selectedOrganization.identifier,
           dashboard: route.query.dashboard,
           folder: route.query.folder,
           refresh: generateDurationLabel(refreshInterval.value),
-          ...getQueryParamsForDuration(selectedDate.value),
+          ...getQueryParamsForDuration(pickerDate.value),
         },
       });
     });
@@ -288,6 +396,15 @@ export default defineComponent({
 
     return {
       dashboardData,
+      renderedDashboard,
+      showBrowserOverview,
+      showMobileSection,
+      overviewDateTime,
+      overviewPicker,
+      schemaError,
+      schemaForbidden,
+      presentFields,
+      retrySchema,
       schemaResolved,
       showEmptyState,
       wasFiltered,
@@ -298,7 +415,7 @@ export default defineComponent({
       store,
       // date variables
       dateTimePicker,
-      selectedDate,
+      pickerDate,
       currentTimeObj,
       refreshInterval,
       refreshData,
diff --git a/web/src/components/rum/performance/overview/FrustrationPanel.spec.ts b/web/src/components/rum/performance/overview/FrustrationPanel.spec.ts
new file mode 100644
index 0000000000..f2410da3f5
--- /dev/null
+++ b/web/src/components/rum/performance/overview/FrustrationPanel.spec.ts
@@ -0,0 +1,85 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import FrustrationPanel from "./FrustrationPanel.vue";
+
+const RouterLinkStub = { props: ["to"], template: "<a :data-to='JSON.stringify(to)'><slot /></a>" };
+
+const mountPanel = (cur: unknown, prev: unknown) =>
+  mount(FrustrationPanel, {
+    props: {
+      cur,
+      prev,
+      sessionsLink: (f: string) => ({ name: "Sessions", query: { query: f } }),
+      replaysLink: { name: "Sessions", query: { health: "frustrated" } },
+    } as never,
+    global: {
+      components: { "router-link": RouterLinkStub },
+      stubs: { OTruncatedText: { template: "<span><slot /></span>" } },
+    },
+  });
+
+describe("FrustrationPanel", () => {
+  it("shows counts with a bad-toned increase and links to the matching sessions", () => {
+    const w = mountPanel({ rage: 148, dead: 291 }, { rage: 100, dead: 290 });
+    const rage = w.find('[data-test="rum-overview-frustration-rage"]');
+    expect(rage.text()).toContain("148");
+    expect(rage.text()).toContain("+48% vs previous period");
+    expect(rage.find("span.text-status-error-text").exists()).toBe(true);
+    expect(JSON.parse(rage.attributes("data-to") as string).query.query).toBe(
+      "strpos(action_frustration_type, 'rage_click') > 0",
+    );
+  });
+
+  it("offers frustrated sessions as the way to a replay, saying only recorded ones have one", () => {
+    const w = mountPanel({ rage: 1, dead: 1 }, null);
+    const link = w.find('[data-test="rum-overview-frustration-replays"]');
+    expect(link.text()).toBe("Watch a replay →");
+    expect(JSON.parse(link.attributes("data-to") as string)).toEqual({
+      name: "Sessions",
+      query: { health: "frustrated" },
+    });
+    expect(w.text()).toContain("Opens the frustrated sessions in this range");
+  });
+
+  it("hides the replay link when there were no rage or dead clicks", () => {
+    const w = mountPanel({ rage: 0, dead: 0 }, null);
+    expect(w.find('[data-test="rum-overview-frustration-replays"]').exists()).toBe(false);
+    expect(w.text()).not.toContain("Opens the frustrated sessions");
+  });
+
+  it("names each tile's destination for assistive tech", () => {
+    const w = mountPanel({ rage: 148, dead: 291 }, null);
+    expect(w.find('[data-test="rum-overview-frustration-rage"]').attributes("aria-label")).toBe(
+      "Rage clicks: 148. Open Sessions",
+    );
+  });
+
+  it("treats a flat count as no change", () => {
+    const w = mountPanel({ rage: 10, dead: 20 }, { rage: 10, dead: 20 });
+    expect(w.find('[data-test="rum-overview-frustration-dead"]').text()).toContain(
+      "No change vs previous period",
+    );
+  });
+
+  it("says there is not enough previous data without a previous window", () => {
+    const w = mountPanel({ rage: 10, dead: 20 }, null);
+    expect(w.find('[data-test="rum-overview-frustration-rage"]').text()).toContain(
+      "not enough previous data",
+    );
+  });
+});
diff --git a/web/src/components/rum/performance/overview/FrustrationPanel.vue b/web/src/components/rum/performance/overview/FrustrationPanel.vue
new file mode 100644
index 0000000000..168cbb2004
--- /dev/null
+++ b/web/src/components/rum/performance/overview/FrustrationPanel.vue
@@ -0,0 +1,105 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div>
+    <h2 class="text-text-heading text-base font-bold">
+      {{ t("rum.overviewPage.frustrationTitle") }}
+    </h2>
+    <p class="text-text-secondary mt-1 text-sm">{{ t("rum.overviewPage.frustrationHint") }}</p>
+    <div class="mt-3 grid grid-cols-2 gap-3">
+      <KpiCard
+        v-for="tile in tiles"
+        :key="tile.key"
+        as="router-link"
+        :to="sessionsLink(tile.filter)"
+        :label="tile.label"
+        :aria-label="
+          t('rum.overviewPage.tileOpenSessions', {
+            label: tile.label,
+            value: raw(formatCount(tile.value)),
+          })
+        "
+        class="no-underline"
+        :data-test="`rum-overview-frustration-${tile.key}`"
+      >
+        <template #value>
+          <span class="text-text-heading text-xl font-bold">{{ formatCount(tile.value) }}</span>
+          <span class="text-text-secondary text-xs lg:hidden">
+            {{ tile.label }} ·
+            <span :class="TONE[tile.delta?.tone ?? 'flat']">{{ tile.deltaText }}</span>
+          </span>
+        </template>
+        <template #trend>
+          <span class="text-xs font-semibold" :class="TONE[tile.delta?.tone ?? 'flat']">
+            {{ tile.deltaText }}
+          </span>
+        </template>
+      </KpiCard>
+    </div>
+    <router-link
+      v-if="(cur?.rage ?? 0) + (cur?.dead ?? 0) > 0"
+      :to="replaysLink"
+      class="text-text-link mt-3 inline-block text-sm font-bold"
+      data-test="rum-overview-frustration-replays"
+    >
+      {{ t("rum.overviewPage.frustrationReplayLink") }} →
+    </router-link>
+    <p v-if="(cur?.rage ?? 0) + (cur?.dead ?? 0) > 0" class="text-text-secondary mt-1 text-xs">
+      {{ t("rum.overviewPage.frustrationReplayHint") }}
+    </p>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import type { RouteLocationRaw } from "vue-router";
+import KpiCard from "@/components/common/KpiCard.vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import { deltaSentenceKey, formatCount, kpiDelta } from "@/utils/rum/performanceOverview";
+
+const props = defineProps<{
+  cur: { rage: number; dead: number } | null;
+  prev: { rage: number; dead: number } | null;
+  sessionsLink: (filter: string) => RouteLocationRaw;
+  replaysLink: RouteLocationRaw;
+}>();
+const { t } = useI18nTyped();
+
+const TONE = {
+  good: "text-status-success-text",
+  bad: "text-status-error-text",
+  flat: "text-text-secondary",
+} as const;
+
+const tiles = computed(() =>
+  (["rage", "dead"] as const).map((key) => {
+    const delta = kpiDelta(props.cur?.[key] ?? null, props.prev?.[key] ?? null, {
+      higherIsBetter: false,
+    });
+    return {
+      key,
+      label: t(key === "rage" ? "rum.overviewPage.rageClicks" : "rum.overviewPage.deadClicks"),
+      value: props.cur?.[key] ?? 0,
+      delta,
+      deltaText: delta
+        ? t(deltaSentenceKey(delta, false), { delta: raw(delta.text) })
+        : t("rum.overviewPage.deltaNoPrev"),
+      filter: `strpos(action_frustration_type, '${key}_click') > 0`,
+    };
+  }),
+);
+</script>
diff --git a/web/src/components/rum/performance/overview/KpiTile.spec.ts b/web/src/components/rum/performance/overview/KpiTile.spec.ts
new file mode 100644
index 0000000000..2e71fef5e5
--- /dev/null
+++ b/web/src/components/rum/performance/overview/KpiTile.spec.ts
@@ -0,0 +1,103 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import KpiTile from "./KpiTile.vue";
+
+const RouterLinkStub = { props: ["to"], template: "<a :data-to='JSON.stringify(to)'><slot /></a>" };
+
+const mountTile = (delta: unknown, extra: Record<string, unknown> = {}) =>
+  mount(KpiTile, {
+    props: {
+      label: "Sessions",
+      value: "4,812",
+      delta,
+      spark: [1, 2, 3],
+      sparkTone: "default",
+      to: { name: "Sessions", query: { q: "x" } },
+      dataTest: "kpi-sessions",
+      ariaLabel: "Sessions: 4,812. Open Sessions",
+      ...extra,
+    } as never,
+    global: {
+      components: { "router-link": RouterLinkStub },
+      stubs: {
+        OSparkline: { props: ["dataTest"], template: "<svg :data-test='dataTest' />" },
+        OTruncatedText: { template: "<span><slot /></span>" },
+      },
+    },
+  });
+
+describe("KpiTile", () => {
+  it("names the link's destination for assistive tech", () => {
+    expect(mountTile(null).find('[data-test="kpi-sessions"]').attributes("aria-label")).toBe(
+      "Sessions: 4,812. Open Sessions",
+    );
+  });
+
+  it("shows the value, the signed delta and links to the target", () => {
+    const w = mountTile({ kind: "change", text: "+12%", tone: "good" });
+    expect(w.find('[data-test="kpi-sessions-value"]').text()).toBe("4,812");
+    expect(w.find('[data-test="kpi-sessions-delta"]').text()).toBe("+12% vs previous period");
+    expect(JSON.parse(w.find("a").attributes("data-to") as string)).toEqual({
+      name: "Sessions",
+      query: { q: "x" },
+    });
+  });
+
+  it("uses translated words for a flat delta and a muted tone", () => {
+    const el = mountTile({ kind: "flat", text: "", tone: "flat" }).find(
+      '[data-test="kpi-sessions-delta"]',
+    );
+    expect(el.text()).toBe("No change vs previous period");
+    expect(el.classes()).toContain("text-text-secondary");
+  });
+
+  it("says there is not enough previous data without a delta", () => {
+    expect(mountTile(null).find('[data-test="kpi-sessions-delta"]').text()).toBe(
+      "not enough previous data",
+    );
+  });
+
+  it("says points for a percentage-point change", () => {
+    const el = mountTile({ kind: "change", text: "-1.4", tone: "bad" }, { points: true }).find(
+      '[data-test="kpi-sessions-delta"]',
+    );
+    expect(el.text()).toBe("-1.4 pts vs previous period");
+  });
+
+  it("states the new case as one sentence", () => {
+    const el = mountTile({ kind: "new", text: "", tone: "flat" }).find(
+      '[data-test="kpi-sessions-delta"]',
+    );
+    expect(el.text()).toBe("New vs previous period");
+  });
+
+  it("keeps the label and delta visible below the lg breakpoint", () => {
+    const compact = mountTile({ kind: "change", text: "+12%", tone: "good" }).find(
+      '[data-test="kpi-sessions-compact"]',
+    );
+    expect(compact.classes()).toContain("lg:hidden");
+    expect(compact.text()).toContain("Sessions");
+    expect(compact.text()).toContain("+12% vs previous period");
+  });
+
+  it("gives the sparkline its own data-test, not the tile's", () => {
+    const w = mountTile(null);
+    expect(w.find('[data-test="kpi-sessions-trend"]').exists()).toBe(true);
+    expect(w.findAll('[data-test="kpi-sessions"]')).toHaveLength(1);
+  });
+});
diff --git a/web/src/components/rum/performance/overview/KpiTile.vue b/web/src/components/rum/performance/overview/KpiTile.vue
new file mode 100644
index 0000000000..dabc25f933
--- /dev/null
+++ b/web/src/components/rum/performance/overview/KpiTile.vue
@@ -0,0 +1,90 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <KpiCard
+    as="router-link"
+    :to="to"
+    :label="label"
+    :aria-label="ariaLabel"
+    :data-test="dataTest"
+    class="no-underline"
+  >
+    <template #value>
+      <span class="text-text-heading text-2xl font-bold" :data-test="`${dataTest}-value`">
+        {{ value }}
+      </span>
+      <span class="text-text-secondary text-xs lg:hidden" :data-test="`${dataTest}-compact`">
+        {{ label }} ·
+        <span :class="TONE[delta?.tone ?? 'flat']">{{ deltaText }}</span>
+      </span>
+    </template>
+    <template #trend>
+      <span
+        class="text-xs font-semibold"
+        :class="TONE[delta?.tone ?? 'flat']"
+        :data-test="`${dataTest}-delta`"
+      >
+        {{ deltaText }}
+      </span>
+    </template>
+    <template #footer>
+      <OSparkline
+        :points="spark"
+        :tone="sparkTone"
+        size="sm"
+        :aria-label="t('rum.overviewPage.sparkAria', { label })"
+        :data-test="`${dataTest}-trend`"
+      />
+    </template>
+  </KpiCard>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import type { RouteLocationRaw } from "vue-router";
+import KpiCard from "@/components/common/KpiCard.vue";
+import OSparkline from "@/lib/data/Sparkline/OSparkline.vue";
+import type { SparklineTone } from "@/lib/data/Sparkline/OSparkline.types";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import { deltaSentenceKey, type KpiDelta } from "@/utils/rum/performanceOverview";
+
+const props = defineProps<{
+  label: I18nText;
+  value: I18nText;
+  delta: KpiDelta | null;
+  /** The change is in percentage points, not percent. */
+  points?: boolean;
+  spark: number[];
+  sparkTone: SparklineTone;
+  to: RouteLocationRaw;
+  dataTest: string;
+  ariaLabel: I18nText;
+}>();
+const { t } = useI18nTyped();
+
+const TONE = {
+  good: "text-status-success-text",
+  bad: "text-status-error-text",
+  flat: "text-text-secondary",
+} as const;
+
+const deltaText = computed(() =>
+  props.delta
+    ? t(deltaSentenceKey(props.delta, !!props.points), { delta: raw(props.delta.text) })
+    : t("rum.overviewPage.deltaNoPrev"),
+);
+</script>
diff --git a/web/src/components/rum/performance/overview/MarkedValue.vue b/web/src/components/rum/performance/overview/MarkedValue.vue
new file mode 100644
index 0000000000..4a96d5efcd
--- /dev/null
+++ b/web/src/components/rum/performance/overview/MarkedValue.vue
@@ -0,0 +1,33 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <span>
+    <span v-if="band === 'needs' || band === 'poor'" aria-hidden="true">{{ GLYPH[band] }} </span>
+    {{ text }}
+    <span v-if="band === 'needs'" class="sr-only">{{ t("rum.overviewPage.markNeeds") }}</span>
+    <span v-else-if="band === 'poor'" class="sr-only">{{ t("rum.overviewPage.markPoor") }}</span>
+  </span>
+</template>
+
+<script setup lang="ts">
+import { useI18nTyped, type I18nText } from "@/types/i18n";
+import type { Band } from "@/utils/rum/performanceOverview";
+
+defineProps<{ band: Band | null; text: I18nText }>();
+const { t } = useI18nTyped();
+const GLYPH = { needs: "\u25B2", poor: "\u25A0" } as const;
+</script>
diff --git a/web/src/components/rum/performance/overview/OverviewPanelState.spec.ts b/web/src/components/rum/performance/overview/OverviewPanelState.spec.ts
new file mode 100644
index 0000000000..5a91f35f70
--- /dev/null
+++ b/web/src/components/rum/performance/overview/OverviewPanelState.spec.ts
@@ -0,0 +1,106 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import OverviewPanelState from "./OverviewPanelState.vue";
+
+const mountState = (status: string, busy = false) =>
+  mount(OverviewPanelState, {
+    props: {
+      status: status as never,
+      busy,
+      panelLabel: "Core Web Vitals",
+      dataTest: "panel",
+      lowCount: 38,
+    },
+    slots: { default: '<p data-test="content">ok</p>' },
+    global: {
+      mocks: { t: (k: string) => k },
+      stubs: {
+        OButton: { template: "<button><slot /></button>" },
+        OEmptyState: {
+          props: ["preset"],
+          template:
+            '<div :data-preset="preset"><slot name="title" /><slot name="description" /><slot name="actions" /></div>',
+        },
+        OSpinner: true,
+      },
+    },
+  });
+
+describe("OverviewPanelState", () => {
+  it("renders the slot when ok", () => {
+    const w = mountState("ok");
+    expect(w.find('[data-test="content"]').exists()).toBe(true);
+    expect(w.find('[data-test="panel-error"]').exists()).toBe(false);
+  });
+
+  it("renders an alert with Retry on error and emits retry", async () => {
+    const w = mountState("error");
+    expect(w.find('[data-test="panel-error"]').attributes("role")).toBe("alert");
+    expect(w.find('[data-test="panel-error"] [data-preset]').attributes("data-preset")).toBe(
+      "load-error",
+    );
+    await w.find('[data-test="panel-retry"]').trigger("click");
+    expect(w.emitted("retry")).toHaveLength(1);
+    expect(w.find('[data-test="content"]').exists()).toBe(false);
+  });
+
+  it("marks the panel busy while loading", () => {
+    const w = mountState("loading");
+    expect(w.find('[data-test="panel"]').attributes("aria-busy")).toBe("true");
+    expect(w.find('[data-test="panel-loading"]').exists()).toBe(true);
+  });
+
+  it("shows the empty state without the slot", () => {
+    const w = mountState("empty");
+    expect(w.find('[data-test="panel-empty"]').text()).toContain(
+      "rum.overviewPage.stateEmptyTitle",
+    );
+    expect(w.find('[data-test="content"]').exists()).toBe(false);
+  });
+
+  it("shows the low-data notice and still renders the slot", () => {
+    const w = mountState("low");
+    expect(w.find('[data-test="panel-low-data"]').exists()).toBe(true);
+    expect(w.find('[data-test="content"]').exists()).toBe(true);
+  });
+
+  it("keeps the previous content on screen with a busy marker while it reloads", () => {
+    const w = mountState("ok", true);
+    expect(w.find('[data-test="content"]').exists()).toBe(true);
+    expect(w.find('[data-test="panel-loading"]').exists()).toBe(false);
+    expect(w.find('[data-test="panel-refreshing"]').exists()).toBe(true);
+    expect(w.find('[data-test="panel"]').attributes("aria-busy")).toBe("true");
+    expect(mountState("ok").find('[data-test="panel-refreshing"]').exists()).toBe(false);
+  });
+
+  it("shows a no-permission message without Retry when forbidden", () => {
+    const w = mountState("forbidden");
+    expect(w.find('[data-test="panel-forbidden"]').attributes("data-preset")).toBe("no-access");
+    expect(w.find('[data-test="panel-retry"]').exists()).toBe(false);
+  });
+
+  it("names the panel as a region", () => {
+    const root = mountState("ok").find('[data-test="panel"]');
+    expect(root.attributes("role")).toBe("region");
+    expect(root.attributes("aria-label")).toBe("Core Web Vitals");
+  });
+
+  it("renders nothing when hidden", () => {
+    expect(mountState("hidden").find('[data-test="panel"]').exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/rum/performance/overview/OverviewPanelState.vue b/web/src/components/rum/performance/overview/OverviewPanelState.vue
new file mode 100644
index 0000000000..e8b4ededa0
--- /dev/null
+++ b/web/src/components/rum/performance/overview/OverviewPanelState.vue
@@ -0,0 +1,124 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <OCard
+    v-if="status !== 'hidden'"
+    variant="outlined"
+    class="p-4"
+    role="region"
+    :aria-label="panelLabel"
+    :aria-busy="status === 'loading' || busy"
+    :data-test="dataTest"
+  >
+    <span v-if="busy && status !== 'loading'" class="sr-only" :data-test="`${dataTest}-refreshing`">
+      {{ t("rum.overviewPage.stateRefreshing", { panel: panelLabel }) }}
+    </span>
+
+    <div v-if="status === 'loading'" :data-test="`${dataTest}-loading`">
+      <OSkeleton class="h-4 w-1/2" />
+      <OSkeleton class="mt-3 h-8 w-1/3" />
+      <OSkeleton class="mt-3 h-2 w-full" />
+      <p class="text-text-secondary mt-3 text-sm">
+        {{ t("rum.overviewPage.stateLoading", { panel: panelLabel }) }}
+      </p>
+    </div>
+
+    <div v-else-if="status === 'error'" role="alert" :data-test="`${dataTest}-error`">
+      <OEmptyState size="inline" preset="load-error">
+        <template #title>{{
+          t("rum.overviewPage.stateErrorTitle", { panel: panelLabel })
+        }}</template>
+        <template #description>{{ t("rum.overviewPage.stateErrorBody") }}</template>
+        <template #actions>
+          <OButton
+            variant="outline"
+            size="sm"
+            icon-left="refresh"
+            :data-test="`${dataTest}-retry`"
+            @click="emit('retry')"
+          >
+            {{ t("rum.overviewPage.retry") }}
+          </OButton>
+        </template>
+      </OEmptyState>
+    </div>
+
+    <OEmptyState
+      v-else-if="status === 'forbidden'"
+      size="inline"
+      preset="no-access"
+      :data-test="`${dataTest}-forbidden`"
+    >
+      <template #title>{{ t("rum.overviewPage.forbiddenTitle", { panel: panelLabel }) }}</template>
+      <template #description>{{ t("rum.overviewPage.forbiddenBody") }}</template>
+    </OEmptyState>
+
+    <OEmptyState
+      v-else-if="status === 'empty'"
+      size="compact"
+      :hide-action="true"
+      :data-test="`${dataTest}-empty`"
+    >
+      <template #title>{{ emptyTitle ?? t("rum.overviewPage.stateEmptyTitle") }}</template>
+      <template #description>{{ emptyBody ?? t("rum.overviewPage.stateEmptyBody") }}</template>
+    </OEmptyState>
+
+    <template v-else>
+      <div v-if="status === 'low'" class="mb-3">
+        <OBanner variant="info" :data-test="`${dataTest}-low-data`">
+          <p class="font-bold">
+            {{ t("rum.overviewPage.stateLowTitle", { count: formatCount(lowCount) }, lowCount) }}
+          </p>
+          <p>{{ t("rum.overviewPage.stateLowBody", { min: MIN_VIEWS }) }}</p>
+        </OBanner>
+      </div>
+      <div
+        class="transition-opacity"
+        :class="busy ? 'opacity-60' : ''"
+        :data-test="`${dataTest}-content`"
+      >
+        <slot />
+      </div>
+    </template>
+  </OCard>
+</template>
+
+<script setup lang="ts">
+import OButton from "@/lib/core/Button/OButton.vue";
+import OCard from "@/lib/core/Card/OCard.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import { useI18nTyped, type I18nText } from "@/types/i18n";
+import type { WidgetStatus } from "@/composables/rum/useRumOverviewData";
+import { MIN_VIEWS, formatCount } from "@/utils/rum/performanceOverview";
+
+withDefaults(
+  defineProps<{
+    status: WidgetStatus;
+    panelLabel: I18nText;
+    dataTest: string;
+    lowCount?: number;
+    emptyTitle?: I18nText;
+    emptyBody?: I18nText;
+    busy?: boolean;
+  }>(),
+  { lowCount: 0, emptyTitle: undefined, emptyBody: undefined, busy: false },
+);
+const emit = defineEmits<{ (e: "retry"): void }>();
+const { t } = useI18nTyped();
+</script>
diff --git a/web/src/components/rum/performance/overview/PagesToFix.spec.ts b/web/src/components/rum/performance/overview/PagesToFix.spec.ts
new file mode 100644
index 0000000000..ee61be9789
--- /dev/null
+++ b/web/src/components/rum/performance/overview/PagesToFix.spec.ts
@@ -0,0 +1,142 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import PagesToFix from "./PagesToFix.vue";
+import { pageFilter } from "@/utils/rum/performanceOverview";
+
+const page = (path: string, over: Record<string, unknown> = {}) => ({
+  path,
+  views: 1920,
+  lcp: 3.1e9,
+  inp: 2.4e8,
+  cls: 0.05,
+  errors: 142,
+  bad: 100,
+  impact: 92,
+  ...over,
+});
+
+const SCHEMA = new Set(["view_url", "view_name"]);
+
+const OTableStub = {
+  props: ["data", "columns"],
+  template: `<div data-test="table"><div v-for="(row, index) in data" :key="row.path" :data-test="'row-' + index">
+    <slot name="cell-path" :row="row" :index="index" /><slot name="cell-views" :row="row" /><slot name="cell-lcp" :row="row" />
+    <slot name="cell-inp" :row="row" /><slot name="cell-cls" :row="row" /><slot name="cell-errors" :row="row" :index="index" /><slot name="cell-impact" :row="row" />
+  </div></div>`,
+};
+
+const mountPages = (pages: ReturnType<typeof page>[]) =>
+  mount(PagesToFix, {
+    props: {
+      pages,
+      sessionsLink: (f: string) => ({ name: "Sessions", query: { query: f } }),
+      errorsLink: (f: string) => ({ name: "ErrorTracking", query: { query: f } }),
+      allPagesLink: { name: "productAnalyticsOverview", query: { period: "1d" } },
+      schema: SCHEMA,
+    },
+    global: {
+      stubs: {
+        OTable: OTableStub,
+        ODataBarCell: {
+          props: ["value", "display"],
+          template: "<b data-test='impact'>{{ display }}</b>",
+        },
+        RouterLink: { props: ["to"], template: "<a :data-to='JSON.stringify(to)'><slot /></a>" },
+        OPopover: { template: "<div><slot name='trigger' /><slot /></div>" },
+        OButton: { template: "<button><slot /></button>" },
+      },
+    },
+  });
+
+describe("PagesToFix", () => {
+  it("labels the table region for assistive tech", () => {
+    const w = mountPages([page("/checkout")]);
+    expect(w.find('[role="region"]').attributes("aria-label")).toBe("Pages ranked by impact");
+  });
+
+  it("links every page to Product Analytics, besides the in-place expander", () => {
+    const w = mountPages([page("/checkout")]);
+    const link = w.find('[data-test="rum-overview-pages-all-link"]');
+    expect(link.text()).toBe("All pages →");
+    expect(link.attributes("aria-label")).toBe("All pages in Product Analytics");
+    expect(JSON.parse(link.attributes("data-to") as string)).toEqual({
+      name: "productAnalyticsOverview",
+      query: { period: "1d" },
+    });
+  });
+
+  it("puts the explanation in an About popover, not under the title", () => {
+    const w = mountPages([page("/checkout")]);
+    expect(w.find('[data-test="rum-overview-pages-about"]').exists()).toBe(true);
+    expect(w.find('[data-test="rum-overview-pages-hint"]').text()).toContain("Ranked by impact");
+  });
+
+  it("links the path to Sessions and the error count to Error Tracking, filtered to the page", () => {
+    const w = mountPages([page("/checkout")]);
+    const sessions = JSON.parse(
+      w.find('[data-test="rum-overview-pages-link-0"]').attributes("data-to") as string,
+    );
+    const errors = JSON.parse(
+      w.find('[data-test="rum-overview-pages-errors-link-0"]').attributes("data-to") as string,
+    );
+    expect(sessions).toEqual({
+      name: "Sessions",
+      query: { query: pageFilter("/checkout", SCHEMA) },
+    });
+    expect(errors).toEqual({
+      name: "ErrorTracking",
+      query: { query: pageFilter("/checkout", SCHEMA) },
+    });
+  });
+
+  it("shows real values, needs-improvement markers and the impact score", () => {
+    const row = mountPages([page("/checkout")]).find('[data-test="row-0"]');
+    expect(row.text()).toContain((1920).toLocaleString());
+    expect(row.text()).toContain("\u25B2 3.10 s");
+    expect(row.text()).toContain("\u25B2 240 ms");
+    expect(row.text()).toContain("142");
+    expect(row.find('[data-test="impact"]').text()).toBe("92");
+  });
+
+  it("shows CLS with the same markers, since it counts toward impact", () => {
+    const w = mountPages([page("/checkout", { cls: 0.18 }), page("/home", { cls: 0.3 })]);
+    expect(w.find('[data-test="row-0"]').text()).toContain("\u25B2 0.18");
+    expect(w.find('[data-test="row-1"]').text()).toContain("\u25A0 0.30");
+  });
+
+  it("exposes the impact bar as an image with its score", () => {
+    const row = mountPages([page("/checkout")]).find('[data-test="row-0"]');
+    const img = row.find('[role="img"]');
+    expect(img.attributes("aria-label")).toBe("Impact 92 out of 100");
+    expect(img.find('[data-test="impact"]').exists()).toBe(true);
+  });
+
+  it("marks a poor value with a square and leaves a good one unmarked", () => {
+    const row = mountPages([page("/a", { lcp: 5e9, inp: 1e8 })]).find('[data-test="row-0"]');
+    expect(row.text()).toContain("\u25A0 5.00 s");
+    expect(row.text()).not.toContain("\u25B2");
+  });
+
+  it("shows ten rows and expands to all", async () => {
+    const many = Array.from({ length: 12 }, (_, i) => page(`/p${i}`));
+    const w = mountPages(many);
+    expect(w.findAll('[data-test^="row-"]')).toHaveLength(10);
+    await w.find('[data-test="rum-overview-pages-toggle"]').trigger("click");
+    expect(w.findAll('[data-test^="row-"]')).toHaveLength(12);
+  });
+});
diff --git a/web/src/components/rum/performance/overview/PagesToFix.vue b/web/src/components/rum/performance/overview/PagesToFix.vue
new file mode 100644
index 0000000000..debbb17b3f
--- /dev/null
+++ b/web/src/components/rum/performance/overview/PagesToFix.vue
@@ -0,0 +1,222 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div>
+    <div class="flex items-center gap-1">
+      <h2 class="text-text-heading text-base font-bold">{{ t("rum.overviewPage.pagesTitle") }}</h2>
+      <OPopover
+        v-model:open="aboutOpen"
+        side="bottom"
+        align="start"
+        :aria-label="t('rum.overviewPage.pagesAbout')"
+      >
+        <template #trigger>
+          <OButton
+            variant="ghost"
+            size="xs"
+            icon-left="info-outline"
+            data-test="rum-overview-pages-about"
+          >
+            <span class="max-md:sr-only">{{ t("rum.overviewPage.pagesAbout") }}</span>
+          </OButton>
+        </template>
+        <p
+          class="w-96 max-w-[calc(100vw-1.5rem)] p-3 leading-5"
+          data-test="rum-overview-pages-hint"
+        >
+          <OText variant="meta">{{ t("rum.overviewPage.pagesHint") }}</OText>
+        </p>
+      </OPopover>
+      <router-link
+        :to="allPagesLink"
+        class="text-text-link ms-auto text-sm font-bold"
+        :aria-label="t('rum.overviewPage.pagesAllLinkAria')"
+        data-test="rum-overview-pages-all-link"
+      >
+        {{ t("rum.overviewPage.pagesAllLink") }} →
+      </router-link>
+    </div>
+    <div role="region" :aria-label="t('rum.overviewPage.pagesTableLabel')">
+      <OTable
+        :data="visible"
+        :columns="columns"
+        :default-columns="false"
+        row-key="path"
+        pagination="none"
+        sorting="none"
+        :show-global-filter="false"
+        :frame="false"
+        data-test="rum-overview-pages-table"
+      >
+        <template #cell-path="{ row, index }">
+          <router-link
+            :to="sessionsLink(pageFilter(row.path, schema))"
+            class="text-text-link inline-block min-h-6 font-mono font-semibold"
+            :aria-label="t('rum.overviewPage.pagesOpenSessions', { path: raw(row.path) })"
+            :data-test="`rum-overview-pages-link-${index}`"
+          >
+            {{ row.path }}
+          </router-link>
+        </template>
+        <template #cell-views="{ row }">{{ formatCount(row.views) }}</template>
+        <template #cell-lcp="{ row }">
+          <MarkedValue
+            :band="bandOf('lcp', row.lcp)"
+            :text="raw(formatVital('lcp', row.lcp))"
+            :class="BAND_TEXT[bandOf('lcp', row.lcp) ?? 'good']"
+          />
+        </template>
+        <template #cell-inp="{ row }">
+          <MarkedValue
+            :band="bandOf('inp', row.inp)"
+            :text="raw(formatVital('inp', row.inp))"
+            :class="BAND_TEXT[bandOf('inp', row.inp) ?? 'good']"
+          />
+        </template>
+        <template #cell-cls="{ row }">
+          <MarkedValue
+            :band="bandOf('cls', row.cls)"
+            :text="raw(formatVital('cls', row.cls))"
+            :class="BAND_TEXT[bandOf('cls', row.cls) ?? 'good']"
+          />
+        </template>
+        <template #cell-errors="{ row, index }">
+          <router-link
+            :to="errorsLink(pageFilter(row.path, schema))"
+            class="text-text-link inline-block min-h-6"
+            :aria-label="
+              t('rum.overviewPage.pagesOpenErrors', { count: formatCount(row.errors) }, row.errors)
+            "
+            :data-test="`rum-overview-pages-errors-link-${index}`"
+          >
+            {{ formatCount(row.errors) }}
+          </router-link>
+        </template>
+        <template #cell-impact="{ row }">
+          <span role="img" :aria-label="t('rum.overviewPage.pagesImpactAria', { n: row.impact })">
+            <ODataBarCell :value="row.impact" :max="100" :display="row.impact" />
+          </span>
+        </template>
+      </OTable>
+    </div>
+    <div v-if="pages.length > LIMIT" class="mt-2">
+      <OButton
+        variant="ghost"
+        size="sm"
+        :aria-expanded="expanded"
+        data-test="rum-overview-pages-toggle"
+        @click="expanded = !expanded"
+      >
+        {{
+          expanded
+            ? t("rum.overviewPage.pagesShowFewer")
+            : t("rum.overviewPage.pagesShowAll", { n: pages.length })
+        }}
+      </OButton>
+    </div>
+    <p class="text-text-secondary mt-2 text-xs">
+      {{ t("rum.overviewPage.pagesLegend", { n: MIN_VIEWS }) }}
+    </p>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import type { RouteLocationRaw } from "vue-router";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import ODataBarCell from "@/lib/core/Table/cells/ODataBarCell.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import OText from "@/lib/core/Typography/OText.vue";
+import OPopover from "@/lib/overlay/Popover/OPopover.vue";
+import MarkedValue from "@/components/rum/performance/overview/MarkedValue.vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import {
+  MIN_VIEWS,
+  bandOf,
+  formatCount,
+  formatVital,
+  pageFilter,
+  type Band,
+  type PageRow,
+} from "@/utils/rum/performanceOverview";
+
+const LIMIT = 10;
+
+const props = defineProps<{
+  pages: PageRow[];
+  sessionsLink: (filter: string) => RouteLocationRaw;
+  errorsLink: (filter: string) => RouteLocationRaw;
+  allPagesLink: RouteLocationRaw;
+  schema: Set<string>;
+}>();
+const { t } = useI18nTyped();
+const expanded = ref(false);
+const aboutOpen = ref(false);
+const visible = computed(() => (expanded.value ? props.pages : props.pages.slice(0, LIMIT)));
+
+const BAND_TEXT: Record<Band, string> = {
+  good: "text-text-body",
+  needs: "text-status-warning-text",
+  poor: "text-status-error-text",
+};
+
+const columns = computed<OTableColumnDef<PageRow>[]>(() => [
+  {
+    id: "path",
+    header: t("rum.overviewPage.pagesColPage"),
+    size: 240,
+    meta: { fillRemaining: true },
+  },
+  {
+    id: "views",
+    header: t("rum.overviewPage.pagesColViews"),
+    accessorKey: "views",
+    size: 80,
+    meta: { align: "right" },
+  },
+  {
+    id: "lcp",
+    header: t("rum.overviewPage.pagesColLcp"),
+    accessorKey: "lcp",
+    size: 100,
+    meta: { align: "right" },
+  },
+  {
+    id: "inp",
+    header: t("rum.overviewPage.pagesColInp"),
+    accessorKey: "inp",
+    size: 100,
+    meta: { align: "right" },
+  },
+  {
+    id: "cls",
+    header: t("rum.overviewPage.pagesColCls"),
+    accessorKey: "cls",
+    size: 80,
+    meta: { align: "right" },
+  },
+  {
+    id: "errors",
+    header: t("rum.overviewPage.pagesColErrors"),
+    accessorKey: "errors",
+    size: 80,
+    meta: { align: "right" },
+  },
+  { id: "impact", header: t("rum.overviewPage.pagesColImpact"), accessorKey: "impact", size: 150 },
+]);
+</script>
diff --git a/web/src/components/rum/performance/overview/ReleaseComparison.spec.ts b/web/src/components/rum/performance/overview/ReleaseComparison.spec.ts
new file mode 100644
index 0000000000..60e7f2fca7
--- /dev/null
+++ b/web/src/components/rum/performance/overview/ReleaseComparison.spec.ts
@@ -0,0 +1,120 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import ReleaseComparison from "./ReleaseComparison.vue";
+
+const side = (version: string, over: Record<string, unknown> = {}) => ({
+  version,
+  predates: false,
+  sessions: 100,
+  errorFree: 95,
+  lcp: 2e9,
+  inp: 2e8,
+  ...over,
+});
+
+const OTableStub = {
+  props: ["data", "columns"],
+  template: `<div data-test="table"><span data-test="cols">{{ columns.map((c) => c.header).join("|") }}</span>
+    <div v-for="row in data" :key="row.key" :data-test="'row-' + row.key"><slot name="cell-cur" :row="row" /><i>{{ row.prev }}</i></div></div>`,
+};
+
+const mountRelease = (release: Record<string, unknown>) =>
+  mount(ReleaseComparison, {
+    props: {
+      release,
+      errorsLink: (f: string) => ({ name: "ErrorTracking", query: { query: f } }),
+    } as never,
+    global: {
+      stubs: {
+        OTable: OTableStub,
+        RouterLink: { props: ["to"], template: "<a :data-to='JSON.stringify(to)'><slot /></a>" },
+      },
+    },
+  });
+
+describe("ReleaseComparison", () => {
+  it("compares the two versions in the table columns", () => {
+    const w = mountRelease({ cur: side("2.0"), prev: side("1.0"), newErrors: null });
+    expect(w.find('[data-test="cols"]').text()).toBe("Metric|1.0|2.0");
+  });
+
+  it("colours a worse current value and formats real values", () => {
+    const w = mountRelease({
+      cur: side("2.0", { inp: 3e8 }),
+      prev: side("1.0", { inp: 2e8 }),
+      newErrors: null,
+    });
+    expect(w.find('[data-test="row-inp"]').text()).toContain("300 ms");
+    expect(w.find('[data-test="rum-overview-release-tone-inp"]').classes()).toContain(
+      "text-status-error-text",
+    );
+  });
+
+  it("says improved or worse in words, never with the band triangles the tables use", () => {
+    const w = mountRelease({
+      cur: side("2.0", { inp: 3e8, lcp: 1e9 }),
+      prev: side("1.0", { inp: 2e8, lcp: 2e9 }),
+      newErrors: null,
+    });
+    expect(w.find('[data-test="rum-overview-release-tone-inp"]').text()).toBe("worse");
+    expect(w.find('[data-test="rum-overview-release-tone-lcp"]').text()).toBe("improved");
+    expect(w.text()).not.toMatch(/[\u25B2\u25BC\u25A0]/);
+    expect(w.find('[data-test="rum-overview-release-tone-sessions"]').exists()).toBe(false);
+  });
+
+  it("leaves values equal once formatted, or inside half a percent, unmarked", () => {
+    const w = mountRelease({
+      cur: side("2.0", { inp: 232.4e6, lcp: 2.001e9 }),
+      prev: side("1.0", { inp: 231.6e6, lcp: 2e9 }),
+      newErrors: null,
+    });
+    expect(w.find('[data-test="rum-overview-release-tone-inp"]').exists()).toBe(false);
+    expect(w.find('[data-test="rum-overview-release-tone-lcp"]').exists()).toBe(false);
+  });
+
+  it("says it ignores the Version filter", () => {
+    const w = mountRelease({ cur: side("2.0"), prev: side("1.0"), newErrors: null });
+    expect(w.find('[data-test="rum-overview-release-note"]').text()).toContain(
+      "whatever the Version filter says",
+    );
+  });
+
+  it("links to the version's errors and shows the new-error count beside it as plain text", () => {
+    const w = mountRelease({ cur: side("2.0"), prev: side("1.0"), newErrors: 3 });
+    const link = w.find('[data-test="rum-overview-release-errors-link"]');
+    expect(link.text()).toBe("Errors in 2.0");
+    expect(JSON.parse(link.attributes("data-to") as string).query.query).toBe("version='2.0'");
+    expect(w.find('[data-test="rum-overview-release-new-errors"]').text()).toBe(
+      "3 new errors in this release",
+    );
+  });
+
+  it("omits the new-error text when the count is unknown", () => {
+    const w = mountRelease({ cur: side("2.0"), prev: side("1.0"), newErrors: null });
+    expect(w.find('[data-test="rum-overview-release-new-errors"]').exists()).toBe(false);
+  });
+
+  it("notes a release that predates the range", () => {
+    const w = mountRelease({
+      cur: side("2.0", { predates: true }),
+      prev: side("1.0"),
+      newErrors: 0,
+    });
+    expect(w.find('[data-test="rum-overview-release-before"]').text()).toContain("2.0");
+  });
+});
diff --git a/web/src/components/rum/performance/overview/ReleaseComparison.vue b/web/src/components/rum/performance/overview/ReleaseComparison.vue
new file mode 100644
index 0000000000..18e669c925
--- /dev/null
+++ b/web/src/components/rum/performance/overview/ReleaseComparison.vue
@@ -0,0 +1,202 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div>
+    <h2 class="text-text-heading text-base font-bold">{{ t("rum.overviewPage.releaseTitle") }}</h2>
+    <p class="text-text-secondary mt-1 text-sm">
+      {{
+        t("rum.overviewPage.releaseHint", {
+          cur: raw(release.cur.version),
+          prev: raw(release.prev.version),
+        })
+      }}
+    </p>
+    <p class="text-text-secondary mt-1 text-xs" data-test="rum-overview-release-note">
+      {{ t("rum.overviewPage.releaseNote") }}
+    </p>
+    <p
+      v-if="release.cur.predates"
+      class="text-text-secondary mt-2 text-xs"
+      data-test="rum-overview-release-before"
+    >
+      {{ t("rum.overviewPage.releaseBefore", { version: raw(release.cur.version) }) }}
+    </p>
+    <div class="mt-3">
+      <OTable
+        :data="rows"
+        :columns="columns"
+        :default-columns="false"
+        row-key="key"
+        pagination="none"
+        sorting="none"
+        :show-global-filter="false"
+        :frame="false"
+        data-test="rum-overview-release-table"
+      >
+        <template #cell-cur="{ row }">
+          <span class="text-text-heading font-bold">{{ row.cur }}</span>
+          <span
+            v-if="row.tone !== 'same'"
+            class="ms-1 text-xs font-semibold"
+            :class="TONE[row.tone]"
+            :data-test="`rum-overview-release-tone-${row.key}`"
+          >
+            {{ t(TONE_TEXT[row.tone]) }}
+          </span>
+        </template>
+      </OTable>
+    </div>
+    <div class="mt-3 flex flex-wrap items-center gap-x-2">
+      <router-link
+        :to="errorsLink(versionFilter(release.cur.version))"
+        class="text-text-link text-sm font-bold"
+        data-test="rum-overview-release-errors-link"
+      >
+        {{ t("rum.overviewPage.releaseLink", { version: raw(release.cur.version) }) }}
+      </router-link>
+      <span
+        v-if="release.newErrors !== null"
+        class="text-text-secondary text-sm"
+        data-test="rum-overview-release-new-errors"
+      >
+        {{
+          t(
+            "rum.overviewPage.releaseNewErrors",
+            { count: formatCount(release.newErrors) },
+            release.newErrors,
+          )
+        }}
+      </span>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import type { RouteLocationRaw } from "vue-router";
+import OTable from "@/lib/core/Table/OTable.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
+import {
+  formatCount,
+  formatPercent,
+  formatVital,
+  releaseTone,
+  versionFilter,
+} from "@/utils/rum/performanceOverview";
+
+interface Side {
+  version: string;
+  predates: boolean;
+  sessions: number;
+  errorFree: number | null;
+  lcp: unknown;
+  inp: unknown;
+}
+
+interface Row {
+  key: string;
+  label: I18nText;
+  prev: I18nText;
+  cur: I18nText;
+  tone: "better" | "worse" | "same";
+}
+
+const props = defineProps<{
+  release: { cur: Side; prev: Side; newErrors: number | null };
+  errorsLink: (filter: string) => RouteLocationRaw;
+}>();
+const { t } = useI18nTyped();
+
+const TONE = {
+  better: "text-status-success-text",
+  worse: "text-status-error-text",
+} as const;
+const TONE_TEXT: Record<"better" | "worse", I18nKey> = {
+  better: "rum.overviewPage.releaseImproved",
+  worse: "rum.overviewPage.releaseWorse",
+};
+
+const n = (v: unknown): number | null => (v === null || v === undefined ? null : Number(v));
+
+const columns = computed<OTableColumnDef<Row>[]>(() => [
+  {
+    id: "label",
+    header: t("rum.overviewPage.releaseMetric"),
+    accessorKey: "label",
+    size: 90,
+    meta: { fillRemaining: true },
+  },
+  {
+    id: "prev",
+    header: raw(props.release.prev.version),
+    accessorKey: "prev",
+    size: 80,
+    meta: { align: "right" },
+  },
+  {
+    id: "cur",
+    header: raw(props.release.cur.version),
+    accessorKey: "cur",
+    size: 140,
+    meta: { align: "right" },
+  },
+]);
+
+const rows = computed<Row[]>(() => {
+  const { cur, prev } = props.release;
+  return [
+    {
+      key: "lcp",
+      label: t("rum.overviewPage.releaseLcp"),
+      prev: raw(formatVital("lcp", n(prev.lcp))),
+      cur: raw(formatVital("lcp", n(cur.lcp))),
+      tone: releaseTone(n(cur.lcp), n(prev.lcp), false, {
+        cur: formatVital("lcp", n(cur.lcp)),
+        prev: formatVital("lcp", n(prev.lcp)),
+      }),
+    },
+    {
+      key: "inp",
+      label: t("rum.overviewPage.releaseInp"),
+      prev: raw(formatVital("inp", n(prev.inp))),
+      cur: raw(formatVital("inp", n(cur.inp))),
+      tone: releaseTone(n(cur.inp), n(prev.inp), false, {
+        cur: formatVital("inp", n(cur.inp)),
+        prev: formatVital("inp", n(prev.inp)),
+      }),
+    },
+    {
+      key: "errorFree",
+      label: t("rum.overviewPage.releaseErrorFree"),
+      prev: raw(formatPercent(prev.errorFree)),
+      cur: raw(formatPercent(cur.errorFree)),
+      tone: releaseTone(cur.errorFree, prev.errorFree, true, {
+        cur: formatPercent(cur.errorFree),
+        prev: formatPercent(prev.errorFree),
+      }),
+    },
+    {
+      key: "sessions",
+      label: t("rum.overviewPage.releaseSessions"),
+      prev: raw(formatCount(prev.sessions)),
+      cur: raw(formatCount(cur.sessions)),
+      tone: "same",
+    },
+  ];
+});
+</script>
diff --git a/web/src/components/rum/performance/overview/SegmentPanel.spec.ts b/web/src/components/rum/performance/overview/SegmentPanel.spec.ts
new file mode 100644
index 0000000000..61c95e9a73
--- /dev/null
+++ b/web/src/components/rum/performance/overview/SegmentPanel.spec.ts
@@ -0,0 +1,143 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+import SegmentPanel from "./SegmentPanel.vue";
+
+const row = (label: string) => ({
+  label,
+  views: 50,
+  inp: 100e6,
+  lcp: null,
+  share: 10,
+  filter: "f",
+});
+
+const mountPanel = (
+  segments: Record<string, ReturnType<typeof row>[]> = {
+    browser: [row("A")],
+    device: [row("B")],
+    country: [row("C")],
+  },
+  difference: Record<string, unknown> | null = null,
+) =>
+  mount(SegmentPanel, {
+    props: {
+      segments,
+      difference,
+      sessionsLink: () => ({ name: "Sessions" }),
+    },
+    attachTo: document.body,
+    global: {
+      stubs: {
+        RouterLink: true,
+        OSegmentedBar: true,
+        OTabs: { template: "<div><slot /></div>" },
+        OTab: { props: ["name", "label"], template: '<button role="tab">{{ label }}</button>' },
+        OTabPanels: { template: "<div><slot /></div>" },
+        OTabPanel: { template: "<div><slot /></div>" },
+      },
+    },
+  });
+
+const press = async (w: ReturnType<typeof mountPanel>, key: string) => {
+  await w.find('[role="tab"]').trigger("keydown", { key });
+};
+
+const activeTab = (w: ReturnType<typeof mountPanel>) =>
+  (w.vm as unknown as { active: string }).active;
+
+describe("SegmentPanel biggest difference", () => {
+  it("names the dimension before the value", () => {
+    const w = mount(SegmentPanel, {
+      props: {
+        segments: { connection: [row("3g")] },
+        difference: {
+          dim: "connection",
+          label: "3g",
+          filter: "f",
+          views: 40,
+          inp: 3.6e8,
+          ratio: 1.5,
+        },
+        sessionsLink: () => ({ name: "Sessions" }),
+      },
+      global: {
+        stubs: {
+          RouterLink: true,
+          OSegmentedBar: true,
+          OTabs: true,
+          OTab: true,
+          OTabPanels: true,
+          OTabPanel: true,
+        },
+      },
+    });
+    expect(w.find('[data-test="rum-overview-difference-title"]').text()).toBe("Connection: 3g");
+  });
+});
+
+describe("SegmentPanel tabs", () => {
+  it("opens the tab the callout names, and a later click by the user still wins", async () => {
+    const segs = { browser: [row("A")], device: [row("iPhone")], country: [row("C")] };
+    const diff = { dim: "device", label: "iPhone", filter: "f", views: 50, inp: 4e8, ratio: 2 };
+    const w = mountPanel(segs, diff);
+    await flushPromises();
+    expect(activeTab(w)).toBe("device");
+    (w.vm as unknown as { active: string }).active = "country";
+    await w.setProps({ segments: { ...segs } });
+    expect(activeTab(w)).toBe("country");
+    await w.setProps({ difference: { ...diff, dim: "browser", label: "A" } });
+    expect(activeTab(w)).toBe("browser");
+    w.unmount();
+  });
+
+  it("orders OS after device and connection last, only for dimensions with data", () => {
+    const w = mountPanel({
+      connection: [row("4g")],
+      country: [row("C")],
+      os: [row("Mac OS X")],
+      browser: [row("A")],
+    });
+    expect(w.findAll('[role="tab"]').map((t) => t.text())).toEqual([
+      "Browser",
+      "OS",
+      "Country",
+      "Connection",
+    ]);
+    w.unmount();
+  });
+});
+
+describe("SegmentPanel keyboard model", () => {
+  it("selects the last tab on End and the first on Home", async () => {
+    const w = mountPanel();
+    await press(w, "End");
+    expect(activeTab(w)).toBe("country");
+    await press(w, "Home");
+    expect(activeTab(w)).toBe("browser");
+    w.unmount();
+  });
+
+  it("wraps with the arrow keys", async () => {
+    const w = mountPanel();
+    await press(w, "ArrowLeft");
+    expect(activeTab(w)).toBe("country");
+    await press(w, "ArrowRight");
+    expect(activeTab(w)).toBe("browser");
+    w.unmount();
+  });
+});
diff --git a/web/src/components/rum/performance/overview/SegmentPanel.vue b/web/src/components/rum/performance/overview/SegmentPanel.vue
new file mode 100644
index 0000000000..4ec403c46f
--- /dev/null
+++ b/web/src/components/rum/performance/overview/SegmentPanel.vue
@@ -0,0 +1,188 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div>
+    <h2 class="text-text-heading text-base font-bold">{{ t("rum.overviewPage.diffTitle") }}</h2>
+    <div
+      class="bg-surface-tint-neutral rounded-surface mt-3 p-3"
+      :class="difference ? 'border-border-default border' : ''"
+      data-test="rum-overview-difference"
+    >
+      <template v-if="difference">
+        <div class="text-text-heading text-sm font-bold" data-test="rum-overview-difference-title">
+          {{
+            t("rum.overviewPage.diffSegment", {
+              dim: t(LABEL[difference.dim]),
+              value: difference.label,
+            })
+          }}
+        </div>
+        <div class="text-text-body mt-1 text-sm">
+          {{
+            t("rum.overviewPage.diffBody", {
+              inp: formatVital("inp", difference.inp),
+              ratio: difference.ratio.toFixed(1),
+            })
+          }}
+        </div>
+        <router-link
+          :to="sessionsLink(difference.filter)"
+          class="text-text-link mt-2 inline-block text-sm font-bold"
+          data-test="rum-overview-difference-link"
+        >
+          {{ t("rum.overviewPage.diffLink") }} →
+        </router-link>
+      </template>
+      <p v-else class="text-text-secondary text-sm">{{ t("rum.overviewPage.diffNone") }}</p>
+    </div>
+
+    <div class="mt-4" @keydown="onKeydown">
+      <OTabs
+        v-model="active"
+        :aria-label="t('rum.overviewPage.segmentLabel')"
+        data-test="rum-overview-segment-tabs"
+      >
+        <OTab
+          v-for="d in dims"
+          :key="d"
+          :name="d"
+          :label="t(LABEL[d])"
+          :data-test="`rum-overview-segment-tab-${d}`"
+        />
+      </OTabs>
+    </div>
+    <OTabPanels v-model="active">
+      <OTabPanel v-for="d in dims" :key="d" :name="d">
+        <ul
+          class="m-0 mt-3 flex list-none flex-col gap-3 p-0"
+          :data-test="`rum-overview-segment-panel-${d}`"
+        >
+          <li v-for="(s, i) in segments[d] ?? []" :key="s.label + i">
+            <div class="flex justify-between text-sm">
+              <span class="text-text-body">{{ s.label }}</span>
+              <span class="font-bold" :class="BAND_TEXT[bandOf('inp', s.inp) ?? 'good']">
+                <MarkedValue
+                  :band="bandOf('inp', s.inp)"
+                  :text="t('rum.overviewPage.segInp', { v: formatVital('inp', s.inp) })"
+                />
+              </span>
+            </div>
+            <OSegmentedBar
+              class="mt-1"
+              :segments="[
+                {
+                  id: 'share',
+                  pct: s.share,
+                  variant: bandOf('inp', s.inp) === 'good' ? 'default' : 'warning',
+                },
+              ]"
+              :label="t('rum.overviewPage.segShare', { n: s.share })"
+            />
+          </li>
+          <li v-if="!(segments[d] ?? []).length" class="text-text-secondary text-sm">
+            {{ t("rum.overviewPage.segNone") }}
+          </li>
+        </ul>
+      </OTabPanel>
+    </OTabPanels>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, nextTick, ref, watch } from "vue";
+import type { RouteLocationRaw } from "vue-router";
+import OSegmentedBar from "@/lib/data/SegmentedBar/OSegmentedBar.vue";
+import OTab from "@/lib/navigation/Tabs/OTab.vue";
+import OTabPanel from "@/lib/navigation/Tabs/OTabPanel.vue";
+import OTabPanels from "@/lib/navigation/Tabs/OTabPanels.vue";
+import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
+import MarkedValue from "@/components/rum/performance/overview/MarkedValue.vue";
+import { useI18nTyped, type I18nKey } from "@/types/i18n";
+import {
+  bandOf,
+  formatVital,
+  type BiggestDifference,
+  type Band,
+  type SegmentDim,
+  type SegmentRow,
+} from "@/utils/rum/performanceOverview";
+
+const props = defineProps<{
+  segments: Partial<Record<SegmentDim, SegmentRow[]>>;
+  difference: BiggestDifference | null;
+  sessionsLink: (filter: string) => RouteLocationRaw;
+}>();
+const { t } = useI18nTyped();
+
+const LABEL: Record<SegmentDim, I18nKey> = {
+  browser: "rum.overviewPage.segBrowser",
+  device: "rum.overviewPage.segDevice",
+  os: "rum.overviewPage.segOs",
+  country: "rum.overviewPage.segCountry",
+  connection: "rum.overviewPage.segConnection",
+};
+const BAND_TEXT: Record<Band, string> = {
+  good: "text-text-body",
+  needs: "text-status-warning-text",
+  poor: "text-status-error-text",
+};
+
+const dims = computed(() =>
+  (Object.keys(LABEL) as SegmentDim[]).filter((d) => d in props.segments),
+);
+const active = ref<SegmentDim>(dims.value[0] ?? "browser");
+watch(dims, (list) => {
+  if (list.length && !list.includes(active.value)) active.value = list[0];
+});
+
+// The callout names a dimension, so its tab opens with it; a later click by the user still wins.
+watch(
+  () => props.difference?.dim,
+  (dim) => {
+    if (!dim || !dims.value.includes(dim)) return;
+    active.value = dim;
+    void nextTick(() =>
+      document
+        .querySelector(`[data-test="rum-overview-segment-tab-${dim}"]`)
+        ?.scrollIntoView?.({ block: "nearest", inline: "nearest" }),
+    );
+  },
+  { immediate: true },
+);
+
+const onKeydown = (e: KeyboardEvent) => {
+  const isTab = (e.target as HTMLElement | null)?.getAttribute("role") === "tab";
+  const list = dims.value;
+  if (!isTab || !list.length) return;
+  const i = list.indexOf(active.value);
+  const next =
+    e.key === "ArrowRight"
+      ? (i + 1) % list.length
+      : e.key === "ArrowLeft"
+        ? (i - 1 + list.length) % list.length
+        : e.key === "Home"
+          ? 0
+          : e.key === "End"
+            ? list.length - 1
+            : -1;
+  if (next < 0) return;
+  active.value = list[next];
+  const tabs = (e.currentTarget as HTMLElement).querySelectorAll<HTMLElement>("[role=tab]");
+  tabs[next]?.focus();
+  e.preventDefault();
+};
+</script>
diff --git a/web/src/components/rum/performance/overview/SessionsErrorsChart.spec.ts b/web/src/components/rum/performance/overview/SessionsErrorsChart.spec.ts
new file mode 100644
index 0000000000..369c3bdef7
--- /dev/null
+++ b/web/src/components/rum/performance/overview/SessionsErrorsChart.spec.ts
@@ -0,0 +1,171 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { mount } from "@vue/test-utils";
+import { toZonedTime } from "date-fns-tz";
+
+let timezone = "Asia/Tokyo";
+let mounts = 0;
+vi.mock("vuex", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("vuex")>()),
+  useStore: () => ({
+    state: {
+      get timezone() {
+        return timezone;
+      },
+    },
+  }),
+}));
+vi.mock("@/components/dashboards/PanelSchemaRenderer.vue", () => ({
+  default: {
+    name: "PanelSchemaRenderer",
+    props: ["panelSchema", "selectedTimeObj", "searchType", "searchResponse"],
+    setup() {
+      mounts += 1;
+    },
+    template: "<div />",
+  },
+}));
+
+import SessionsErrorsChart from "./SessionsErrorsChart.vue";
+
+const MARKER_US = Date.UTC(2026, 0, 15, 12, 0) * 1000;
+const HITS = [
+  { x_axis_1: "2026-01-15T12:00:00", y_axis_1: 4812, y_axis_2: 3 },
+  { x_axis_1: "2026-01-15T13:00:00", y_axis_1: 10, y_axis_2: 0 },
+];
+const RANGE = { startUs: MARKER_US - 3.6e9 * 12, endUs: MARKER_US + 3.6e9 * 12 };
+
+const mountChart = (over: Record<string, unknown> = {}) =>
+  mount(SessionsErrorsChart, {
+    props: {
+      sql: "SELECT 1",
+      interval: "1 hour",
+      range: RANGE,
+      points: [
+        { ts: MARKER_US, sessions: 4812, errors: 3 },
+        { ts: MARKER_US + 3.6e9, sessions: 10, errors: 0 },
+      ],
+      hits: HITS,
+      marker: { version: "2.0", ts: MARKER_US },
+      ...over,
+    },
+    global: {
+      stubs: {
+        OTable: {
+          props: ["data"],
+          template:
+            "<div data-test='tbl'><i v-for='r in data' :key='r.ts'>{{ r.time }}|{{ r.sessions }}</i></div>",
+        },
+        OSkeleton: true,
+        OButton: { template: "<button><slot /></button>" },
+      },
+    },
+  });
+
+describe("SessionsErrorsChart", () => {
+  beforeEach(() => {
+    timezone = "Asia/Tokyo";
+    mounts = 0;
+  });
+
+  it("renders the rows it is given instead of letting the renderer query", () => {
+    const chart = mountChart().findComponent({ name: "PanelSchemaRenderer" });
+    expect(chart.props("searchResponse")).toEqual({ hits: HITS });
+  });
+
+  it("keeps the renderer mounted when the release marker arrives late", async () => {
+    const w = mountChart({ marker: null });
+    expect(mounts).toBe(1);
+    await w.setProps({ marker: { version: "2.0", ts: MARKER_US } });
+    expect(mounts).toBe(1);
+    const schema = w.findComponent({ name: "PanelSchemaRenderer" }).props("panelSchema") as Record<
+      string,
+      any
+    >;
+    expect(schema.config.mark_line).toHaveLength(1);
+  });
+
+  it("remounts the renderer when new rows arrive, since it does not watch them", async () => {
+    const w = mountChart();
+    await w.setProps({ hits: [HITS[0]] });
+    expect(mounts).toBe(2);
+  });
+
+  it("names the bucket interval in the heading", () => {
+    expect(mountChart().find('[data-test="rum-overview-chart-interval"]').text()).toBe("per hour");
+    expect(
+      mountChart({ interval: "1 day" }).find('[data-test="rum-overview-chart-interval"]').text(),
+    ).toBe("per day");
+    expect(
+      mountChart({ interval: "6 hour" }).find('[data-test="rum-overview-chart-interval"]').text(),
+    ).toBe("per 6 hours");
+  });
+
+  it("hands the engine a time-series panel for the SQL with the range in microseconds", () => {
+    const chart = mountChart().findComponent({ name: "PanelSchemaRenderer" });
+    const schema = chart.props("panelSchema") as Record<string, any>;
+    expect(schema.type).toBe("line");
+    expect(schema.queries[0].query).toBe("SELECT 1");
+    expect(chart.props("searchType")).toBe("RUM");
+    expect((chart.props("selectedTimeObj") as { start_time: Date }).start_time.getTime()).toBe(
+      RANGE.startUs,
+    );
+  });
+
+  it("zone-shifts the release marker to the store timezone, like the engine does for the x values", () => {
+    const schema = mountChart()
+      .findComponent({ name: "PanelSchemaRenderer" })
+      .props("panelSchema") as Record<string, any>;
+    const line = schema.config.mark_line[0];
+    expect(line.type).toBe("xAxis");
+    expect(line.value.getTime()).toBe(
+      toZonedTime(new Date(MARKER_US / 1000), "Asia/Tokyo").getTime(),
+    );
+    expect(line.value.getTime()).not.toBe(MARKER_US / 1000);
+  });
+
+  it("draws no mark line without a release marker", () => {
+    const schema = mountChart({ marker: null })
+      .findComponent({ name: "PanelSchemaRenderer" })
+      .props("panelSchema") as Record<string, any>;
+    expect(schema.config.mark_line).toEqual([]);
+    expect(
+      mountChart({ marker: null }).find('[data-test="rum-overview-chart-release"]').exists(),
+    ).toBe(false);
+  });
+
+  it("formats the caption and the table times in the store timezone", async () => {
+    const caption = mountChart().find('[data-test="rum-overview-chart-release"]').text();
+    expect(caption).toContain("2.0");
+    expect(caption).toContain("9:00");
+    const w = mountChart();
+    await w.find('[data-test="rum-overview-chart-table-toggle"]').trigger("click");
+    expect(w.find('[data-test="rum-overview-chart-table"] i').text()).toContain("9:00");
+  });
+
+  it("toggles the accessible data table", async () => {
+    const w = mountChart();
+    expect(w.find('[data-test="rum-overview-chart-table"]').exists()).toBe(false);
+    const toggle = w.find('[data-test="rum-overview-chart-table-toggle"]');
+    expect(toggle.attributes("aria-expanded")).toBe("false");
+    await toggle.trigger("click");
+    expect(toggle.attributes("aria-expanded")).toBe("true");
+    expect(w.find('[data-test="rum-overview-chart-table"]').text()).toContain(
+      (4812).toLocaleString(),
+    );
+  });
+});
diff --git a/web/src/components/rum/performance/overview/SessionsErrorsChart.vue b/web/src/components/rum/performance/overview/SessionsErrorsChart.vue
new file mode 100644
index 0000000000..45bcac3f56
--- /dev/null
+++ b/web/src/components/rum/performance/overview/SessionsErrorsChart.vue
@@ -0,0 +1,190 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div>
+    <div class="flex flex-wrap items-baseline justify-between gap-2">
+      <h2 class="text-text-heading text-base font-bold">
+        {{ t("rum.overviewPage.chartTitle") }}
+        <span
+          class="text-text-secondary text-sm font-normal"
+          data-test="rum-overview-chart-interval"
+        >
+          {{ t(INTERVAL_KEYS[interval] ?? "rum.overviewPage.chartIntervalOther") }}
+        </span>
+      </h2>
+      <p v-if="marker" class="text-text-secondary text-sm" data-test="rum-overview-chart-release">
+        {{
+          t("rum.overviewPage.releaseMarker", { version: raw(marker.version), time: markerTime })
+        }}
+      </p>
+    </div>
+
+    <div class="mt-3 h-72" data-test="rum-overview-chart-plot">
+      <OSkeleton v-if="chartLoading" class="h-full w-full" />
+      <PanelSchemaRenderer
+        v-show="!chartLoading"
+        :key="rendererKey"
+        class="h-full w-full"
+        :panelSchema="panelSchema"
+        :selectedTimeObj="selectedTimeObj"
+        :variablesData="{}"
+        :forceLoad="true"
+        :searchResponse="searchResponse"
+        searchType="RUM"
+        :allowAnnotationsAPI="false"
+        @loading-state-change="chartLoading = $event"
+      />
+    </div>
+
+    <div class="mt-2">
+      <OButton
+        variant="ghost"
+        size="sm"
+        :aria-expanded="showTable"
+        data-test="rum-overview-chart-table-toggle"
+        @click="showTable = !showTable"
+      >
+        {{
+          showTable ? t("rum.overviewPage.chartTableHide") : t("rum.overviewPage.chartTableToggle")
+        }}
+      </OButton>
+    </div>
+    <div v-if="showTable" role="region" :aria-label="t('rum.overviewPage.chartTableCaption')">
+      <OTable
+        :data="tableRows"
+        :columns="columns"
+        :default-columns="false"
+        row-key="ts"
+        pagination="none"
+        sorting="none"
+        :show-global-filter="false"
+        :frame="false"
+        data-test="rum-overview-chart-table"
+      />
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { useStore } from "vuex";
+import PanelSchemaRenderer from "@/components/dashboards/PanelSchemaRenderer.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
+import { formatCount, formatInZone } from "@/utils/rum/performanceOverview";
+import { buildOverviewChartPanel } from "@/utils/rum/performanceOverviewPanel";
+
+interface Point {
+  ts: number;
+  sessions: number;
+  errors: number;
+}
+
+const props = defineProps<{
+  sql: string;
+  interval: string;
+  range: { startUs: number; endUs: number };
+  points: Point[];
+  hits: Record<string, unknown>[];
+  marker: { version: string; ts: number } | null;
+}>();
+const { t } = useI18nTyped();
+const store = useStore();
+const timezone = computed<string>(() => store.state.timezone);
+
+const INTERVAL_KEYS: Record<string, I18nKey> = {
+  "5 minute": "rum.overviewPage.chartPerFiveMinutes",
+  "30 minute": "rum.overviewPage.chartPerThirtyMinutes",
+  "1 hour": "rum.overviewPage.chartPerHour",
+  "6 hour": "rum.overviewPage.chartPerSixHours",
+  "1 day": "rum.overviewPage.chartPerDay",
+};
+
+const showTable = ref(false);
+const chartLoading = ref(true);
+
+const timeLabel = (ts: number): I18nText => raw(formatInZone(ts / 1000, timezone.value));
+const markerTime = computed(() => (props.marker ? timeLabel(props.marker.ts) : raw("")));
+
+const panelSchema = computed(() =>
+  buildOverviewChartPanel(
+    props.sql,
+    {
+      title: t("rum.overviewPage.chartTitle"),
+      time: t("rum.overviewPage.chartTime"),
+      sessions: t("rum.overviewPage.legendSessions"),
+      errors: t("rum.overviewPage.legendErrors"),
+    },
+    props.marker ? { version: props.marker.version, ms: props.marker.ts / 1000 } : null,
+    timezone.value,
+  ),
+);
+
+// usePanelDataLoader reads getTime() off these Dates as microseconds.
+const selectedTimeObj = computed(() => ({
+  start_time: new Date(props.range.startUs),
+  end_time: new Date(props.range.endUs),
+}));
+
+// Prefetched rows make the renderer skip its own query.
+const searchResponse = computed(() => ({ hits: props.hits }));
+
+// The renderer does not watch prefetched rows, so they key the remount; the marker only restyles.
+const rendererKey = computed(() =>
+  JSON.stringify([props.range, props.sql, timezone.value, props.hits]),
+);
+watch(rendererKey, () => {
+  chartLoading.value = true;
+});
+
+interface TableRow {
+  ts: number;
+  time: I18nText;
+  sessions: I18nText;
+  errors: I18nText;
+}
+
+const tableRows = computed<TableRow[]>(() =>
+  props.points.map((p) => ({
+    ts: p.ts,
+    time: timeLabel(p.ts),
+    sessions: raw(formatCount(p.sessions)),
+    errors: raw(formatCount(p.errors)),
+  })),
+);
+
+const columns = computed<OTableColumnDef<TableRow>[]>(() => [
+  { id: "time", header: t("rum.overviewPage.chartTime"), accessorKey: "time", size: 200 },
+  {
+    id: "sessions",
+    header: t("rum.overviewPage.legendSessions"),
+    accessorKey: "sessions",
+    size: 120,
+    meta: { align: "right" },
+  },
+  {
+    id: "errors",
+    header: t("rum.overviewPage.legendErrors"),
+    accessorKey: "errors",
+    size: 120,
+    meta: { align: "right" },
+  },
+]);
+</script>
diff --git a/web/src/components/rum/performance/overview/VerdictCard.spec.ts b/web/src/components/rum/performance/overview/VerdictCard.spec.ts
new file mode 100644
index 0000000000..856a7e6310
--- /dev/null
+++ b/web/src/components/rum/performance/overview/VerdictCard.spec.ts
@@ -0,0 +1,170 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import { mount } from "@vue/test-utils";
+import en from "@/locales/languages/en-US.json";
+
+vi.mock("@/types/i18n", () => ({
+  raw: (v: unknown) => String(v ?? ""),
+  useI18nTyped: () => ({
+    t: (key: string, a?: Record<string, unknown> | number, b?: number) => {
+      const params = typeof a === "object" ? a : {};
+      const n = typeof a === "number" ? a : b;
+      const msg = String(
+        key.split(".").reduce<unknown>((o, k) => (o as Record<string, unknown>)?.[k], en) ?? key,
+      );
+      const forms = msg.split(" | ");
+      const chosen = forms.length > 1 ? (n === 1 ? forms[0] : forms[1]) : msg;
+      return chosen.replace(/\{(\w+)\}/g, (_, k) => String(params[k] ?? ""));
+    },
+  }),
+}));
+
+import VerdictCard from "./VerdictCard.vue";
+
+const bands = (good: number, needs: number, poor: number) => ({ good, needs, poor });
+const pct = (p75: number | null) => ({ p50: p75, p75, p95: p75 });
+
+const vitals = (inp: number | null, cls = 0.05) => ({
+  views: 1000,
+  lcp: pct(2e9),
+  inp: pct(inp),
+  cls: pct(cls),
+  lcpBands: bands(840, 110, 50),
+  inpBands: bands(710, 150, 140),
+  clsBands: bands(910, 60, 30),
+});
+
+const mountCard = (props: Record<string, unknown>) =>
+  mount(VerdictCard, {
+    props: {
+      prev: null,
+      percentile: "p75",
+      hideVerdict: false,
+      sessions: 4812,
+      sessionsLink: () => "/",
+      ...props,
+    } as never,
+    global: {
+      stubs: {
+        RouterLink: { template: "<a><slot /></a>" },
+        OBadge: { template: "<span><slot /></span>" },
+        OCard: { template: "<div><slot /></div>" },
+        OSegmentedBar: true,
+        OToggleGroup: { name: "OToggleGroup", template: "<div><slot /></div>" },
+        OToggleGroupItem: { template: "<button><slot /></button>" },
+      },
+    },
+  });
+
+const lead = (w: ReturnType<typeof mountCard>) =>
+  w.find('[data-test="rum-overview-verdict-lead"]').text();
+
+describe("VerdictCard sentences", () => {
+  it("names the failing metric, its threshold and the share of views as separate sentences", () => {
+    const text = lead(mountCard({ vitals: vitals(240e6) }));
+    expect(text).toContain("INP is over the 200 ms good threshold for 29% of page views.");
+    expect(text).toContain(`${(4812).toLocaleString()} sessions in the range.`);
+    expect(text).not.toContain("Compared with the previous period.");
+  });
+
+  it("mentions the previous period only when there is one to compare with", () => {
+    const v = vitals(240e6);
+    expect(lead(mountCard({ vitals: v, prev: v }))).toContain("Compared with the previous period.");
+  });
+
+  it("names every failing metric with its own sentence", () => {
+    const text = lead(mountCard({ vitals: vitals(240e6, 0.3) }));
+    expect(text).toContain("INP is over the 200 ms good threshold");
+    expect(text).toContain("CLS is over the 0.10 good threshold");
+  });
+
+  it("says all three pass when nothing fails", () => {
+    expect(lead(mountCard({ vitals: vitals(100e6) }))).toContain(
+      "All three Core Web Vitals pass at p75.",
+    );
+  });
+
+  it("explains that the verdict uses p75 in the failing and, off p75, the passing case", () => {
+    expect(lead(mountCard({ vitals: vitals(240e6) }))).toContain("The verdict always uses p75");
+    expect(lead(mountCard({ vitals: vitals(100e6) }))).not.toContain("always uses p75");
+    expect(lead(mountCard({ vitals: vitals(100e6), percentile: "p95" }))).toContain(
+      "The verdict always uses p75",
+    );
+  });
+
+  it("omits the session count until it has loaded", () => {
+    const text = lead(mountCard({ vitals: vitals(240e6), sessions: null }));
+    expect(text).not.toContain("sessions in the range");
+    expect(text).toContain("INP is over");
+  });
+
+  it("uses the singular for exactly one session", () => {
+    expect(lead(mountCard({ vitals: vitals(100e6), sessions: 1 }))).toContain(
+      "1 session in the range.",
+    );
+  });
+});
+
+describe("VerdictCard states", () => {
+  it("uses a neutral heading, no chip and no repeated sentence for low data", () => {
+    const w = mountCard({ vitals: vitals(240e6), hideVerdict: true });
+    expect(w.find('[data-test="rum-overview-verdict-title"]').text()).toBe("Core Web Vitals");
+    expect(w.find('[data-test="rum-overview-verdict-chip"]').exists()).toBe(false);
+    expect(lead(w)).toBe("");
+  });
+
+  it("says there is no verdict when no vital has a value", () => {
+    const empty = {
+      views: 500,
+      lcp: pct(null),
+      inp: pct(null),
+      cls: pct(null),
+      lcpBands: bands(0, 0, 0),
+      inpBands: bands(0, 0, 0),
+      clsBands: bands(0, 0, 0),
+    };
+    const w = mountCard({ vitals: empty });
+    expect(w.find('[data-test="rum-overview-verdict-title"]').text()).toBe(
+      "No Core Web Vitals data",
+    );
+    expect(w.find('[data-test="rum-overview-verdict-chip"]').exists()).toBe(false);
+    expect(lead(w)).toContain("None of the 500 page views");
+  });
+
+  it("emits the chosen percentile from the toggle", () => {
+    const w = mountCard({ vitals: vitals(240e6) });
+    w.findComponent({ name: "OToggleGroup" }).vm.$emit("update:modelValue", "p95");
+    expect(w.emitted("update:percentile")).toEqual([["p95"]]);
+  });
+
+  it("labels the band as p75 when another percentile is shown", () => {
+    const w = mountCard({ vitals: vitals(240e6), percentile: "p95" });
+    expect(w.find('[data-test="rum-overview-vital-inp"]').text()).toContain("p75: Needs work");
+  });
+
+  it("gives the vital link an accessible name with value, band and delta", () => {
+    const w = mountCard({ vitals: vitals(240e6), prev: vitals(202e6) });
+    expect(w.find('[data-test="rum-overview-vital-inp-link"]').attributes("aria-label")).toBe(
+      "INP p75 240 ms, Needs work, 38 ms slower. Open sessions.",
+    );
+  });
+
+  it("describes a CLS change as lower or higher, not faster or slower", () => {
+    const w = mountCard({ vitals: vitals(100e6, 0.05), prev: vitals(100e6, 0.1) });
+    expect(w.find('[data-test="rum-overview-vital-cls-delta"]').text()).toBe("0.05 lower");
+  });
+});
diff --git a/web/src/components/rum/performance/overview/VerdictCard.vue b/web/src/components/rum/performance/overview/VerdictCard.vue
new file mode 100644
index 0000000000..4f273cf738
--- /dev/null
+++ b/web/src/components/rum/performance/overview/VerdictCard.vue
@@ -0,0 +1,300 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div>
+    <div class="flex flex-wrap items-start justify-between gap-3">
+      <div class="min-w-0 flex-1 basis-80">
+        <div class="flex flex-wrap items-center gap-2">
+          <h2 class="text-text-heading text-xl font-bold" data-test="rum-overview-verdict-title">
+            {{ heading }}
+          </h2>
+          <OBadge
+            v-if="!hideVerdict && verdict.assessed > 0"
+            :variant="verdict.pass ? 'success-soft' : 'warning-soft'"
+            data-test="rum-overview-verdict-chip"
+          >
+            {{
+              verdict.pass
+                ? t("rum.overviewPage.verdictAllPass")
+                : t(
+                    "rum.overviewPage.verdictNeedWork",
+                    { count: verdict.failing.length, total: verdict.assessed },
+                    verdict.failing.length,
+                  )
+            }}
+          </OBadge>
+        </div>
+        <p class="text-text-secondary mt-1 text-sm" data-test="rum-overview-verdict-lead">
+          <span v-for="sentence in sentences" :key="sentence.key" class="me-1">
+            {{ sentence.text }}
+          </span>
+        </p>
+      </div>
+      <OToggleGroup
+        :model-value="percentile"
+        :label="t('rum.overviewPage.percentileLabel')"
+        data-test="rum-overview-percentile"
+        @update:model-value="emit('update:percentile', $event as Percentile)"
+      >
+        <OToggleGroupItem
+          v-for="p in PERCENTILES"
+          :key="p"
+          :value="p"
+          size="sm"
+          :data-test="`rum-overview-percentile-${p}`"
+        >
+          {{ p }}
+        </OToggleGroupItem>
+      </OToggleGroup>
+    </div>
+
+    <ul class="mt-4 grid list-none grid-cols-[repeat(auto-fit,minmax(15rem,1fr))] gap-4 p-0">
+      <li v-for="card in cards" :key="card.key" :data-test="`rum-overview-vital-${card.key}`">
+        <OCard variant="outlined" class="p-4">
+          <router-link
+            :to="sessionsLink(card.filter)"
+            class="text-text-heading block no-underline hover:underline focus-visible:underline"
+            :aria-label="card.linkLabel"
+            :data-test="`rum-overview-vital-${card.key}-link`"
+          >
+            <div class="flex items-baseline justify-between gap-2">
+              <span class="text-text-secondary text-sm">
+                <b class="text-text-heading">{{ card.code }}</b> {{ percentile }} · {{ card.name }}
+              </span>
+              <OBadge v-if="card.band" :variant="BAND_BADGE[card.band]" size="sm">
+                {{ card.bandText }}
+              </OBadge>
+            </div>
+            <div class="mt-2 flex flex-wrap items-baseline gap-x-2">
+              <span class="text-text-heading text-3xl font-bold whitespace-nowrap">
+                {{ card.value }}
+              </span>
+              <span
+                class="text-text-secondary text-sm whitespace-nowrap"
+                :data-test="`rum-overview-vital-${card.key}-delta`"
+              >
+                {{ card.deltaText }}
+              </span>
+            </div>
+          </router-link>
+          <OSegmentedBar
+            class="mt-3"
+            :segments="card.segments"
+            :label="card.aria"
+            :data-test="`rum-overview-vital-${card.key}-bar`"
+          />
+          <div class="text-text-secondary mt-2 flex flex-wrap justify-between gap-x-2 text-xs">
+            <span>{{ t("rum.overviewPage.bandGoodPct", { n: card.pct.good }) }}</span>
+            <span>{{ t("rum.overviewPage.bandNeedsPct", { n: card.pct.needs }) }}</span>
+            <span>{{ t("rum.overviewPage.bandPoorPct", { n: card.pct.poor }) }}</span>
+          </div>
+        </OCard>
+      </li>
+    </ul>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import type { RouteLocationRaw } from "vue-router";
+import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OCard from "@/lib/core/Card/OCard.vue";
+import OSegmentedBar from "@/lib/data/SegmentedBar/OSegmentedBar.vue";
+import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
+import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
+import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
+import type { VitalsSummary } from "@/utils/rum/performanceOverview";
+import {
+  PERCENTILES,
+  VITAL_KEYS,
+  VITAL_THRESHOLDS,
+  bandOf,
+  bandPercents,
+  formatCount,
+  formatVital,
+  overThresholdPct,
+  verdictOf,
+  vitalDelta,
+  type Band,
+  type Percentile,
+  type VitalKey,
+} from "@/utils/rum/performanceOverview";
+
+const props = defineProps<{
+  vitals: VitalsSummary;
+  prev: VitalsSummary | null;
+  percentile: Percentile;
+  hideVerdict: boolean;
+  sessions: number | null;
+  sessionsLink: (filter: string) => RouteLocationRaw;
+}>();
+const emit = defineEmits<{ (e: "update:percentile", value: Percentile): void }>();
+const { t } = useI18nTyped();
+
+const BAND_BADGE: Record<Band, "success-soft" | "warning-soft" | "error-soft"> = {
+  good: "success-soft",
+  needs: "warning-soft",
+  poor: "error-soft",
+};
+
+const NAMES: Record<VitalKey, I18nKey> = {
+  lcp: "rum.overviewPage.vitalLcp",
+  inp: "rum.overviewPage.vitalInp",
+  cls: "rum.overviewPage.vitalCls",
+};
+
+const DELTA_KEYS: Record<string, I18nKey> = {
+  faster: "rum.overviewPage.deltaFaster",
+  slower: "rum.overviewPage.deltaSlower",
+  lower: "rum.overviewPage.deltaLower",
+  higher: "rum.overviewPage.deltaHigher",
+};
+
+const bandLabel = (b: Band) =>
+  t(
+    b === "good"
+      ? "rum.overviewPage.bandGood"
+      : b === "needs"
+        ? "rum.overviewPage.bandNeeds"
+        : "rum.overviewPage.bandPoor",
+  );
+
+// The verdict and bands always read p75, whichever percentile is displayed.
+const verdict = computed(() =>
+  verdictOf({ lcp: props.vitals.lcp.p75, inp: props.vitals.inp.p75, cls: props.vitals.cls.p75 }),
+);
+
+// A session count is stated only once it has loaded; page views are not sessions.
+const sessionsSentence = computed(() =>
+  props.sessions === null
+    ? []
+    : [
+        {
+          key: "sessions",
+          text: t(
+            "rum.overviewPage.verdictSessions",
+            { count: formatCount(props.sessions) },
+            props.sessions,
+          ),
+        },
+      ],
+);
+
+const sentences = computed<{ key: string; text: I18nText }[]>(() => {
+  if (verdict.value.assessed === 0) {
+    return [
+      {
+        key: "nodata",
+        text: t(
+          "rum.overviewPage.verdictNoDataLead",
+          { count: formatCount(props.vitals.views) },
+          props.vitals.views,
+        ),
+      },
+    ];
+  }
+  if (props.hideVerdict) return [];
+  if (verdict.value.pass) {
+    const note =
+      props.percentile === "p75"
+        ? []
+        : [{ key: "note", text: t("rum.overviewPage.verdictP75Note") }];
+    return [
+      {
+        key: "pass",
+        text:
+          verdict.value.assessed === 3
+            ? t("rum.overviewPage.verdictAllThree")
+            : t("rum.overviewPage.verdictAllSome", { n: verdict.value.assessed }),
+      },
+      ...sessionsSentence.value,
+      ...note,
+    ];
+  }
+  return [
+    ...verdict.value.failing.map((k) => ({
+      key: k,
+      text: t("rum.overviewPage.verdictOver", {
+        vital: k.toUpperCase(),
+        threshold: formatVital(k, VITAL_THRESHOLDS[k].good),
+        pct: overThresholdPct(props.vitals[`${k}Bands`]),
+      }),
+    })),
+    ...sessionsSentence.value,
+    ...(props.prev ? [{ key: "compare", text: t("rum.overviewPage.verdictCompare") }] : []),
+    { key: "note", text: t("rum.overviewPage.verdictP75Note") },
+  ];
+});
+
+const heading = computed(() =>
+  verdict.value.assessed === 0
+    ? t("rum.overviewPage.verdictNoData")
+    : props.hideVerdict
+      ? t("rum.overviewPage.verdictNeutral")
+      : verdict.value.pass
+        ? t("rum.overviewPage.verdictPass")
+        : t("rum.overviewPage.verdictFail"),
+);
+
+// The band always comes from p75, so any other displayed percentile says so.
+const bandText = (b: Band) =>
+  props.percentile === "p75"
+    ? bandLabel(b)
+    : t("rum.overviewPage.bandAtP75", { band: bandLabel(b) });
+
+const deltaText = (key: VitalKey): I18nText => {
+  if (!props.prev) return t("rum.overviewPage.deltaNoPrev");
+  const d = vitalDelta(key, props.vitals[key][props.percentile], props.prev[key][props.percentile]);
+  if (!d) return t("rum.overviewPage.deltaNoPrev");
+  if (d.kind === "none") return t("rum.overviewPage.deltaNone");
+  return t(DELTA_KEYS[d.kind], { v: raw(d.text) });
+};
+
+const cards = computed(() =>
+  VITAL_KEYS.filter(
+    (k) => props.vitals[k].p75 !== null || props.vitals[k][props.percentile] !== null,
+  ).map((key) => {
+    const pct = bandPercents(props.vitals[`${key}Bands`]);
+    const band = bandOf(key, props.vitals[key].p75);
+    const value = raw(formatVital(key, props.vitals[key][props.percentile]));
+    return {
+      key,
+      code: key.toUpperCase(),
+      name: t(NAMES[key]),
+      value,
+      band,
+      bandText: band ? bandText(band) : raw(""),
+      deltaText: deltaText(key),
+      linkLabel: t("rum.overviewPage.vitalLinkFull", {
+        vital: key.toUpperCase(),
+        percentile: props.percentile,
+        value,
+        band: band ? bandText(band) : raw(""),
+        delta: deltaText(key),
+      }),
+      pct,
+      aria: t("rum.overviewPage.bandAria", { good: pct.good, needs: pct.needs, poor: pct.poor }),
+      segments: [
+        { id: "good", pct: pct.good, variant: "success" as const },
+        { id: "needs", pct: pct.needs, variant: "warning" as const },
+        { id: "poor", pct: pct.poor, variant: "danger" as const },
+      ],
+      filter: `${VITAL_THRESHOLDS[key].column} > ${VITAL_THRESHOLDS[key].good}`,
+    };
+  }),
+);
+</script>
diff --git a/web/src/components/settings/CorrelationSettings.spec.ts b/web/src/components/settings/CorrelationSettings.spec.ts
index 15214d2468..fb34f25297 100644
--- a/web/src/components/settings/CorrelationSettings.spec.ts
+++ b/web/src/components/settings/CorrelationSettings.spec.ts
@@ -38,15 +38,6 @@ vi.mock("@/services/service_streams", () => ({
   },
 }));
 
-vi.mock("@/components/alerts/OrganizationDeduplicationSettings.vue", () => ({
-  default: {
-    name: "OrganizationDeduplicationSettings",
-    template: '<div data-test="org-deduplication-settings" />',
-    props: ["orgId", "config"],
-    emits: ["saved"],
-  },
-}));
-
 vi.mock("@/components/settings/DiscoveredServices.vue", () => ({
   default: {
     name: "DiscoveredServices",
@@ -84,9 +75,6 @@ const mockStore = createStore({
   state: {
     selectedOrganization: { identifier: "test-org" },
     theme: "light",
-    organizationSettings: {
-      deduplication_config: { enabled: true },
-    },
   },
 });
 
@@ -100,7 +88,6 @@ const mockI18n = createI18n({
           subtitle: "Configure service correlation",
           discoveredServicesTab: "Discovered Services",
           serviceDiscoveryTab: "Service Discovery",
-          alertCorrelationTab: "Alert Correlation",
           fieldAliasesTab: "Field Aliases",
         },
       },
@@ -165,11 +152,6 @@ describe("CorrelationSettings", () => {
       expect(wrapper.find('[data-name="discovery"]').exists()).toBe(true);
     });
 
-    it("should render Alert Correlation tab", () => {
-      wrapper = mountComponent();
-      expect(wrapper.find('[data-name="alert-correlation"]').exists()).toBe(true);
-    });
-
     it("should render Field Aliases tab", () => {
       wrapper = mountComponent();
       expect(wrapper.find('[data-name="field-aliases"]').exists()).toBe(true);
@@ -192,13 +174,6 @@ describe("CorrelationSettings", () => {
       expect(wrapper.find('[data-test="discovered-services"]').isVisible()).toBe(false);
     });
 
-    it("should show OrganizationDeduplicationSettings when activeTab=alert-correlation", async () => {
-      wrapper = mountComponent();
-      wrapper.vm.activeTab = "alert-correlation";
-      await wrapper.vm.$nextTick();
-      expect(wrapper.find('[data-test="org-deduplication-settings"]').exists()).toBe(true);
-    });
-
     it("should show SemanticFieldGroupsConfig when activeTab=field-aliases", async () => {
       wrapper = mountComponent();
       wrapper.vm.activeTab = "field-aliases";
@@ -214,12 +189,6 @@ describe("CorrelationSettings", () => {
       expect(wrapper.vm.activeTab).toBe("discovery");
     });
 
-    it("should switch to alert-correlation tab", () => {
-      wrapper = mountComponent();
-      wrapper.vm.onTabChange("alert-correlation");
-      expect(wrapper.vm.activeTab).toBe("alert-correlation");
-    });
-
     it("should switch back to services tab", () => {
       wrapper = mountComponent();
       wrapper.vm.onTabChange("discovery");
@@ -228,17 +197,10 @@ describe("CorrelationSettings", () => {
     });
   });
 
-  describe("onCorrelationSettingsSaved", () => {
-    it("should handle saved event without throwing", () => {
-      wrapper = mountComponent();
-      expect(() => wrapper.vm.onCorrelationSettingsSaved()).not.toThrow();
-    });
-  });
-
   describe("tabs computed", () => {
-    it("should have 4 tab entries", () => {
+    it("should have 3 tab entries", () => {
       wrapper = mountComponent();
-      expect(wrapper.vm.tabs).toHaveLength(4);
+      expect(wrapper.vm.tabs).toHaveLength(3);
     });
 
     it("should have correct tab values", () => {
@@ -246,7 +208,7 @@ describe("CorrelationSettings", () => {
       const values = wrapper.vm.tabs.map((t: any) => t.value);
       expect(values).toContain("services");
       expect(values).toContain("discovery");
-      expect(values).toContain("alert-correlation");
+      expect(values).not.toContain("alert-correlation");
       expect(values).toContain("field-aliases");
     });
   });
diff --git a/web/src/components/settings/CorrelationSettings.vue b/web/src/components/settings/CorrelationSettings.vue
index 909c6b3ab4..d305521d16 100644
--- a/web/src/components/settings/CorrelationSettings.vue
+++ b/web/src/components/settings/CorrelationSettings.vue
@@ -39,7 +39,6 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       >
         <OTab name="services" :label="t('settings.correlation.discoveredServicesTab')" />
         <OTab name="discovery" :label="t('settings.correlation.serviceDiscoveryTab')" />
-        <OTab name="alert-correlation" :label="t('settings.correlation.alertCorrelationTab')" />
         <OTab
           name="field-aliases"
           data-test="correlation-settings-field-aliases-tab"
@@ -63,14 +62,6 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         />
       </div>
 
-      <div v-show="activeTab === 'alert-correlation'" class="px-page-edge h-full overflow-y-auto">
-        <OrganizationDeduplicationSettings
-          :org-id="store.state.selectedOrganization.identifier"
-          :config="store.state.organizationSettings?.deduplication_config"
-          @saved="onCorrelationSettingsSaved"
-        />
-      </div>
-
       <div v-show="activeTab === 'field-aliases'" class="px-page-edge h-full overflow-y-auto py-4">
         <SemanticFieldGroupsConfig
           :key="`field-aliases-${fieldAliasesEditorKey}`"
@@ -102,7 +93,6 @@ import { defineComponent, ref, computed, onMounted, watch } from "vue";
 import { useStore } from "vuex";
 import { useI18nTyped } from "@/types/i18n";
 import { useRouter, useRoute, onBeforeRouteLeave } from "vue-router";
-import OrganizationDeduplicationSettings from "@/components/alerts/OrganizationDeduplicationSettings.vue";
 import DiscoveredServices from "@/components/settings/DiscoveredServices.vue";
 import ServiceIdentitySetup from "@/components/settings/ServiceIdentitySetup.vue";
 import SemanticFieldGroupsConfig from "@/components/alerts/SemanticFieldGroupsConfig.vue";
@@ -118,7 +108,6 @@ import { confirmForcedSignOutDiscard, draftSignOutForced } from "@/utils/drafts/
 export default defineComponent({
   name: "CorrelationSettings",
   components: {
-    OrganizationDeduplicationSettings,
     DiscoveredServices,
     ServiceIdentitySetup,
     SemanticFieldGroupsConfig,
@@ -138,13 +127,11 @@ export default defineComponent({
     const slugToTab: Record<string, string> = {
       "service-discovery": "discovery",
       services: "services",
-      "alert-correlation": "alert-correlation",
       "field-aliases": "field-aliases",
     };
     const tabToSlug: Record<string, string> = {
       discovery: "service-discovery",
       services: "services",
-      "alert-correlation": "alert-correlation",
       "field-aliases": "field-aliases",
     };
 
@@ -235,11 +222,6 @@ export default defineComponent({
         value: "discovery",
         icon: "manage-search",
       },
-      {
-        label: t("settings.correlation.alertCorrelationTab"),
-        value: "alert-correlation",
-        icon: "notifications",
-      },
       {
         label: t("settings.correlation.fieldAliasesTab"),
         value: "field-aliases",
@@ -312,11 +294,6 @@ export default defineComponent({
       fieldAliasesEditorKey.value += 1;
     };
 
-    const onCorrelationSettingsSaved = () => {
-      // Child components handle their own notifications and data refresh
-      // No global store update needed as settings are managed via settings v2 API
-    };
-
     onBeforeRouteLeave(async () => {
       if (!isFieldAliasesDirty.value) return true;
       if (draftSignOutForced.value) return confirmForcedSignOutDiscard(confirm, t);
@@ -329,7 +306,6 @@ export default defineComponent({
       aliasScrollToGroup,
       tabs,
       onTabChange,
-      onCorrelationSettingsSaved,
       onNavigateToAliases,
       onDraftSemanticGroupsChange,
       saveSemanticGroups,
diff --git a/web/src/components/settings/DomainOrgMappingDialog.vue b/web/src/components/settings/DomainOrgMappingDialog.vue
deleted file mode 100644
index 5ddaab446b..0000000000
--- a/web/src/components/settings/DomainOrgMappingDialog.vue
+++ /dev/null
@@ -1,193 +0,0 @@
-<!-- Copyright 2026 OpenObserve Inc.
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
--->
-
-<template>
-  <ODialog
-    data-test="settings-domain-org-mapping-dialog"
-    v-model:open="dialogOpen"
-    persistent
-    size="md"
-    :form-id="FORM_ID"
-    :title="
-      isEditing
-        ? t('settings.domainOrgMappings.editMapping')
-        : t('settings.domainOrgMappings.addMapping')
-    "
-    :secondary-button-label="t('common.cancel')"
-    :primary-button-label="isEditing ? t('common.save') : t('common.add')"
-    @click:secondary="onCancel"
-  >
-    <OForm :id="FORM_ID" :form="form" class="flex flex-col gap-5">
-      <OFormInput
-        data-test="settings-domain-org-mapping-domain-input"
-        name="domain"
-        :label="t('settings.domainOrgMappings.domain')"
-        required
-        :placeholder="t('settings.domainPlaceholder', { example: raw('example.com') })"
-        :help-text="t('settings.domainOrgMappings.domainHelp', { at_sign: '@' })"
-      />
-
-      <OFormInput
-        data-test="settings-domain-org-mapping-org-input"
-        name="org_id"
-        :label="t('settings.domainOrgMappings.organization')"
-        required
-        :placeholder="t('settings.domainOrgMappings.organizationPlaceholder')"
-        :help-text="t('settings.domainOrgMappings.organizationHelp')"
-      />
-
-      <OFormSelect
-        data-test="settings-domain-org-mapping-role-select"
-        name="base_role"
-        :label="t('settings.domainOrgMappings.baseRole')"
-        :options="roleOptions"
-        :searchable="false"
-        required
-        :help-text="t('settings.domainOrgMappings.baseRoleHelp')"
-      />
-
-      <OFormInput
-        data-test="settings-domain-org-mapping-role-claim-input"
-        name="role_claim_name"
-        :label="t('settings.domainOrgMappings.roleClaimName')"
-        :placeholder="t('settings.domainOrgMappings.roleClaimNamePlaceholder')"
-        :help-text="t('settings.domainOrgMappings.roleClaimNameHelp')"
-      />
-
-      <OFormSwitch
-        v-if="hasRoleClaim"
-        data-test="settings-domain-org-mapping-create-missing-roles-switch"
-        name="create_missing_roles"
-        :label="t('settings.domainOrgMappings.createMissingRoles')"
-      />
-    </OForm>
-  </ODialog>
-</template>
-
-<script setup lang="ts">
-import { computed, watch } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
-import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
-import OForm from "@/lib/forms/Form/OForm.vue";
-import OFormInput from "@/lib/forms/Input/OFormInput.vue";
-import OFormSelect from "@/lib/forms/Select/OFormSelect.vue";
-import OFormSwitch from "@/lib/forms/Switch/OFormSwitch.vue";
-import { useOForm } from "@/lib/forms/Form/useOForm";
-import { toast } from "@/lib/feedback/Toast/useToast";
-import {
-  DOMAIN_ORG_BASE_ROLES,
-  domainOrgMappingDefaults,
-  makeDomainOrgMappingSchema,
-  type DomainOrgMapping,
-  type DomainOrgMappingForm,
-} from "./DomainOrgMappings.schema";
-
-const FORM_ID = "domain-org-mapping-form";
-
-const props = withDefaults(
-  defineProps<{
-    open: boolean;
-    mapping?: DomainOrgMapping | null;
-    /** Domains already mapped, excluding the one being edited — blocks duplicates. */
-    takenDomains?: string[];
-  }>(),
-  { mapping: null, takenDomains: () => [] },
-);
-
-const emit = defineEmits<{
-  (_e: "update:open", _value: boolean): void;
-  (_e: "save", _value: DomainOrgMapping): void;
-}>();
-
-const { t } = useI18nTyped();
-
-// A dynamic `t()` key is untypable, so the role→label mapping is a literal map.
-// `allowed_user` is the OpenFGA relation for the User role, so it reuses that label.
-const ROLE_LABEL_KEYS = {
-  admin: "components.badge.userRole.admin",
-  editor: "components.badge.userRole.editor",
-  viewer: "components.badge.userRole.viewer",
-  allowed_user: "components.badge.userRole.user",
-} as const;
-
-const dialogOpen = computed({
-  get: () => props.open,
-  set: (value: boolean) => emit("update:open", value),
-});
-
-const isEditing = computed(() => !!props.mapping?.domain);
-
-const roleOptions = computed(() =>
-  DOMAIN_ORG_BASE_ROLES.map((role) => ({
-    label: t(ROLE_LABEL_KEYS[role]),
-    value: role,
-  })),
-);
-
-// Edit-prefill defaults → a typed computed, re-applied via form.reset on open.
-const mappingDefaults = computed((): DomainOrgMappingForm => {
-  const base = domainOrgMappingDefaults();
-  if (!props.mapping) return base;
-  return {
-    domain: props.mapping.domain ?? "",
-    org_id: props.mapping.org_id ?? "",
-    base_role: props.mapping.base_role ?? base.base_role,
-    role_claim_name: props.mapping.role_claim_name ?? "",
-    create_missing_roles: props.mapping.create_missing_roles ?? base.create_missing_roles,
-  };
-});
-
-const form = useOForm<DomainOrgMappingForm>({
-  defaultValues: mappingDefaults.value,
-  schema: makeDomainOrgMappingSchema(t),
-  onSubmit,
-});
-
-const hasRoleClaim = form.useStore((state) => !!state.values.role_claim_name?.trim());
-
-// The form is created here so it survives the dialog body's unmount, so it is
-// re-seeded from the current mapping on every open.
-watch(
-  () => props.open,
-  (visible) => {
-    if (visible) form.reset(mappingDefaults.value);
-  },
-);
-
-function onSubmit(value: DomainOrgMappingForm) {
-  const domain = value.domain.trim().toLowerCase();
-  if (props.takenDomains.includes(domain)) {
-    toast({ variant: "error", message: t("settings.domainOrgMappings.duplicateDomain") });
-    return;
-  }
-
-  const roleClaimName = value.role_claim_name?.trim() || undefined;
-  emit("save", {
-    domain,
-    org_id: value.org_id.trim(),
-    base_role: value.base_role,
-    // Omitted rather than "" so the payload matches the optional backend field.
-    role_claim_name: roleClaimName,
-    // Only meaningful with a claim, so a cleared claim also clears the flag.
-    create_missing_roles: !!roleClaimName && value.create_missing_roles,
-  });
-  emit("update:open", false);
-}
-
-function onCancel() {
-  emit("update:open", false);
-}
-</script>
diff --git a/web/src/components/settings/DomainOrgMappings.schema.ts b/web/src/components/settings/DomainOrgMappings.schema.ts
deleted file mode 100644
index fea2d1b49c..0000000000
--- a/web/src/components/settings/DomainOrgMappings.schema.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-// Copyright 2026 OpenObserve Inc.
-//
-// Validation schema for the add/edit dialog behind the Domain → organization
-// mappings section of OrganizationSettings.vue. Only the dialog is
-// OForm-validated; the rendered mapping list is display state merged into the
-// org-settings payload at submit (the same composite exception CrossLinkManager
-// takes). Validation TIMING is owned by OForm; this file describes WHAT is valid.
-
-import { z } from "zod";
-import { isValidDomain } from "./DomainManagement.schema";
-
-// The only values the backend accepts. `allowed_user` is the OpenFGA relation
-// name for the User role, not a separate role — see user_fga_role() in core.
-export const DOMAIN_ORG_BASE_ROLES = ["admin", "editor", "viewer", "allowed_user"] as const;
-
-export type DomainOrgBaseRole = (typeof DOMAIN_ORG_BASE_ROLES)[number];
-
-export interface DomainOrgMapping {
-  domain: string;
-  org_id: string;
-  base_role: DomainOrgBaseRole;
-  role_claim_name?: string;
-  create_missing_roles?: boolean;
-}
-
-export const makeDomainOrgMappingSchema = (t: (_key: string) => string) =>
-  z.object({
-    // NO .trim(): OForm validates with the schema but saves the raw value, so a
-    // trim here would let " acme.com" pass and persist the space.
-    domain: z
-      .string()
-      .min(1, t("settings.domainRequired"))
-      .refine((v) => isValidDomain(v), { message: t("settings.invalidDomain") }),
-    org_id: z.string().min(1, t("settings.domainOrgMappings.organizationRequired")),
-    base_role: z.enum(DOMAIN_ORG_BASE_ROLES),
-    // "" is the cleared state of the input; normalized away at submit.
-    role_claim_name: z.string().optional(),
-    create_missing_roles: z.boolean(),
-  });
-
-export type DomainOrgMappingForm = z.infer<ReturnType<typeof makeDomainOrgMappingSchema>>;
-
-export const domainOrgMappingDefaults = (): DomainOrgMappingForm => ({
-  domain: "",
-  org_id: "",
-  base_role: "admin",
-  role_claim_name: "",
-  create_missing_roles: false,
-});
diff --git a/web/src/components/settings/DomainOrgMappings.spec.ts b/web/src/components/settings/DomainOrgMappings.spec.ts
deleted file mode 100644
index f923c2066b..0000000000
--- a/web/src/components/settings/DomainOrgMappings.spec.ts
+++ /dev/null
@@ -1,79 +0,0 @@
-// Copyright 2026 OpenObserve Inc.
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import { describe, expect, it } from "vitest";
-import { flushPromises, mount } from "@vue/test-utils";
-import DomainOrgMappings from "./DomainOrgMappings.vue";
-import i18n from "@/locales";
-import type { DomainOrgMapping } from "./DomainOrgMappings.schema";
-
-const MAPPINGS: DomainOrgMapping[] = [
-  { domain: "acme.com", org_id: "acme", base_role: "admin" },
-  { domain: "beta.io", org_id: "beta", base_role: "viewer" },
-];
-
-const mountList = () =>
-  mount(DomainOrgMappings, {
-    props: { modelValue: MAPPINGS },
-    global: {
-      plugins: [i18n],
-      stubs: {
-        DomainOrgMappingDialog: true,
-        ConfirmDialog: {
-          name: "ConfirmDialog",
-          props: ["modelValue", "messageKeypath", "messageName", "okVariant"],
-          template: "<div />",
-        },
-      },
-    },
-  });
-
-describe("DomainOrgMappings — remove confirm", () => {
-  it("names the mapping's domain behind a destructive button", async () => {
-    const wrapper = mountList();
-    await wrapper.find('[data-test="settings-domain-org-mappings-delete-1"]').trigger("click");
-    const dialog = wrapper.findComponent({ name: "ConfirmDialog" });
-
-    expect(dialog.props("modelValue")).toBe(true);
-    expect(dialog.props("messageKeypath")).toBe("settings.domainOrgMappings.confirmRemove");
-    expect(dialog.props("messageName")).toBe("beta.io");
-    expect(dialog.props("okVariant")).toBe("destructive");
-  });
-
-  it("keeps the removed domain in the real ConfirmDialog while it fades out", async () => {
-    // Renders its body while closed, as the real dialog does during its fade.
-    const FadingDialog = {
-      name: "ODialog",
-      props: ["open"],
-      emits: ["click:primary", "click:secondary", "update:open"],
-      template: `<div :data-open="String(open)"><slot />
-        <button data-test="confirm" @click="$emit('click:primary')">ok</button></div>`,
-    };
-    const wrapper = mount(DomainOrgMappings, {
-      props: { modelValue: MAPPINGS },
-      global: {
-        plugins: [i18n],
-        stubs: { DomainOrgMappingDialog: true, ODialog: FadingDialog },
-      },
-    });
-    await wrapper.find('[data-test="settings-domain-org-mappings-delete-0"]').trigger("click");
-    await wrapper.find('[data-test="confirm"]').trigger("click");
-    await flushPromises();
-
-    expect(wrapper.emitted("update:modelValue")?.[0]).toEqual([[MAPPINGS[1]]]);
-    expect(wrapper.find("[data-open]").attributes("data-open")).toBe("false");
-    expect(wrapper.find('[data-test="confirm-dialog-name"]').text()).toBe("acme.com");
-  });
-});
diff --git a/web/src/components/settings/DomainOrgMappings.vue b/web/src/components/settings/DomainOrgMappings.vue
deleted file mode 100644
index 17c110e6cd..0000000000
--- a/web/src/components/settings/DomainOrgMappings.vue
+++ /dev/null
@@ -1,207 +0,0 @@
-<!-- Copyright 2026 OpenObserve Inc.
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU Affero General Public License as published by
-the Free Software Foundation, either version 3 of the License, or
-(at your option) any later version.
-
-This program is distributed in the hope that it will be useful
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU Affero General Public License for more details.
-
-You should have received a copy of the GNU Affero General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
--->
-
-<template>
-  <div class="domain-org-mappings">
-    <div class="mb-3 flex items-center justify-between gap-2">
-      <div class="min-w-0">
-        <div class="text-base font-bold">{{ t("settings.domainOrgMappings.title") }}</div>
-        <div class="text-text-muted text-xs">
-          {{ t("settings.domainOrgMappings.subtitle") }}
-        </div>
-      </div>
-      <OButton
-        data-test="settings-domain-org-mappings-add-btn"
-        variant="outline"
-        size="sm-action"
-        icon-left="add"
-        class="shrink-0"
-        @click="openAdd"
-      >
-        {{ t("settings.domainOrgMappings.addMapping") }}
-      </OButton>
-    </div>
-
-    <div v-if="mappings.length > 0" data-test="settings-domain-org-mappings-list">
-      <div
-        v-for="(mapping, index) in mappings"
-        :key="index"
-        :data-test="`settings-domain-org-mappings-item-${index}`"
-        class="border-card-glass-border rounded-default mb-1 border p-2"
-      >
-        <div class="flex items-start justify-between">
-          <div class="min-w-0 flex-1">
-            <div class="flex min-w-0 items-center gap-1 text-sm">
-              <OTruncatedText
-                class="text-text-heading font-bold"
-                :data-test="`settings-domain-org-mappings-item-domain-${index}`"
-                >{{ atSign }}{{ mapping.domain }}</OTruncatedText
-              >
-              <OIcon name="arrow-forward" size="xs" class="text-text-muted shrink-0" />
-              <OTruncatedText
-                class="text-text-body"
-                :data-test="`settings-domain-org-mappings-item-org-${index}`"
-                >{{ mapping.org_id }}</OTruncatedText
-              >
-            </div>
-            <div class="mt-1 flex flex-wrap items-center gap-1">
-              <OTag type="userRole" :value="badgeRole(mapping.base_role)" />
-              <OTag
-                v-if="mapping.role_claim_name"
-                type="fieldTag"
-                class="max-w-full min-w-0"
-                :data-test="`settings-domain-org-mappings-item-role-claim-${index}`"
-              >
-                <OTruncatedText class="text-xs">{{ mapping.role_claim_name }}</OTruncatedText>
-              </OTag>
-            </div>
-          </div>
-          <div class="ms-2 flex shrink-0 items-center gap-1">
-            <OButton
-              :data-test="`settings-domain-org-mappings-edit-${index}`"
-              variant="ghost"
-              size="icon-sm"
-              icon-left="edit"
-              :title="t('common.edit')"
-              @click="openEdit(index)"
-            />
-            <OButton
-              :data-test="`settings-domain-org-mappings-delete-${index}`"
-              variant="ghost-destructive"
-              size="icon-sm"
-              icon-left="delete"
-              :title="t('common.delete')"
-              @click="confirmRemove(index)"
-            />
-          </div>
-        </div>
-      </div>
-    </div>
-    <div
-      v-else
-      data-test="settings-domain-org-mappings-empty"
-      class="text-text-muted py-4 text-center text-sm"
-    >
-      {{
-        t("settings.domainOrgMappings.empty", {
-          addLabel: t("settings.domainOrgMappings.addMapping"),
-        })
-      }}
-    </div>
-
-    <DomainOrgMappingDialog
-      v-model:open="dialogOpen"
-      :mapping="editingMapping"
-      :taken-domains="takenDomains"
-      @save="onSaveMapping"
-    />
-
-    <ConfirmDialog
-      v-model="confirmRemoveOpen"
-      :title="t('settings.domainOrgMappings.deleteTitle')"
-      message-keypath="settings.domainOrgMappings.confirmRemove"
-      :message-name="pendingRemoveIndex !== null ? mappings[pendingRemoveIndex]?.domain : ''"
-      ok-variant="destructive"
-      @update:ok="doRemove"
-      @update:cancel="pendingRemoveIndex = null"
-    />
-  </div>
-</template>
-
-<script setup lang="ts">
-import { computed, ref } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
-import OButton from "@/lib/core/Button/OButton.vue";
-import OIcon from "@/lib/core/Icon/OIcon.vue";
-import OTag from "@/lib/core/Badge/OTag.vue";
-import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
-import ConfirmDialog from "@/components/ConfirmDialog.vue";
-import DomainOrgMappingDialog from "./DomainOrgMappingDialog.vue";
-import type { DomainOrgMapping } from "./DomainOrgMappings.schema";
-
-const props = withDefaults(defineProps<{ modelValue?: DomainOrgMapping[] }>(), {
-  modelValue: () => [],
-});
-
-const emit = defineEmits<{
-  (_e: "update:modelValue", _value: DomainOrgMapping[]): void;
-  (_e: "change"): void;
-}>();
-
-const { t } = useI18nTyped();
-
-const atSign = raw("@");
-
-const mappings = computed(() => props.modelValue);
-
-// The badge registry keys the User role as `user`; `allowed_user` is its OpenFGA relation name.
-const badgeRole = (role: string) => (role === "allowed_user" ? "user" : role);
-
-const dialogOpen = ref(false);
-const editingIndex = ref<number | null>(null);
-const editingMapping = ref<DomainOrgMapping | null>(null);
-
-// The edited row's own domain must stay available to it, so it is excluded.
-const takenDomains = computed(() =>
-  mappings.value
-    .filter((_, index) => index !== editingIndex.value)
-    .map((mapping) => mapping.domain.toLowerCase()),
-);
-
-const confirmRemoveOpen = ref(false);
-const pendingRemoveIndex = ref<number | null>(null);
-
-function openAdd() {
-  editingIndex.value = null;
-  editingMapping.value = null;
-  dialogOpen.value = true;
-}
-
-function openEdit(index: number) {
-  editingIndex.value = index;
-  editingMapping.value = { ...mappings.value[index] };
-  dialogOpen.value = true;
-}
-
-function commit(next: DomainOrgMapping[]) {
-  emit("update:modelValue", next);
-  emit("change");
-}
-
-function onSaveMapping(mapping: DomainOrgMapping) {
-  const next = [...mappings.value];
-  if (editingIndex.value !== null) {
-    next[editingIndex.value] = mapping;
-  } else {
-    next.push(mapping);
-  }
-  commit(next);
-  editingIndex.value = null;
-  editingMapping.value = null;
-}
-
-function confirmRemove(index: number) {
-  pendingRemoveIndex.value = index;
-  confirmRemoveOpen.value = true;
-}
-
-function doRemove() {
-  const index = pendingRemoveIndex.value;
-  if (index === null) return;
-  commit(mappings.value.filter((_, i) => i !== index));
-  pendingRemoveIndex.value = null;
-}
-</script>
diff --git a/web/src/components/settings/OrgDomainBlocklistDialog.vue b/web/src/components/settings/OrgDomainBlocklistDialog.vue
new file mode 100644
index 0000000000..2a3b360157
--- /dev/null
+++ b/web/src/components/settings/OrgDomainBlocklistDialog.vue
@@ -0,0 +1,131 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <ODialog
+    data-test="settings-org-domain-blocklist-dialog"
+    v-model:open="dialogOpen"
+    persistent
+    size="md"
+    :form-id="FORM_ID"
+    :title="
+      isEditing
+        ? t('settings.orgDomainMapping.editBlockedUsers')
+        : t('settings.orgDomainMapping.blockUsers')
+    "
+    :secondary-button-label="t('common.cancel')"
+    :primary-button-label="isEditing ? t('common.save') : t('settings.orgDomainMapping.block')"
+    @click:secondary="dialogOpen = false"
+  >
+    <OForm :id="FORM_ID" :form="form" class="flex flex-col gap-5">
+      <OFormSelect
+        data-test="settings-org-domain-blocklist-domain-select"
+        name="domain"
+        :label="t('settings.orgDomainMapping.domain')"
+        :options="domainOptions"
+        :disabled="isEditing"
+        required
+        :help-text="t('settings.orgDomainMapping.blocklistDomainHelp')"
+      />
+
+      <div class="flex flex-col gap-1">
+        <span class="text-sm font-medium">{{ t("settings.orgDomainMapping.blockedEmails") }}</span>
+        <OFormTagInput
+          data-test="settings-org-domain-blocklist-emails"
+          name="blockedEmails"
+          :placeholder="t('settings.blockedEmailPlaceholder', { domain: atDomain })"
+        />
+        <span class="text-text-secondary text-xs">
+          {{ t("settings.orgDomainMapping.blocklistEmailsHelp") }}
+        </span>
+      </div>
+    </OForm>
+  </ODialog>
+</template>
+
+<script setup lang="ts">
+import { computed, watch } from "vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
+import OForm from "@/lib/forms/Form/OForm.vue";
+import OFormSelect from "@/lib/forms/Select/OFormSelect.vue";
+import OFormTagInput from "@/lib/forms/TagInput/OFormTagInput.vue";
+import { useOForm } from "@/lib/forms/Form/useOForm";
+import type { SelectOption } from "@/lib/forms/Select/OSelect.types";
+import type { DomainBlocklist } from "./orgDomainRestrictions";
+import {
+  domainBlocklistDefaults,
+  makeDomainBlocklistSchema,
+  type DomainBlocklistForm,
+} from "./OrgDomainMapping.schema";
+
+const FORM_ID = "org-domain-blocklist-form";
+
+const props = defineProps<{
+  open: boolean;
+  /** The blocklist being edited; null adds a new one. */
+  blocklist: DomainBlocklist | null;
+  /** Verified domains of this org that have no blocklist yet. */
+  domainOptions: SelectOption[];
+  /** Resolves true once the blocklist is saved; the dialog stays open on false. */
+  submit: (_blocklist: DomainBlocklist) => Promise<boolean>;
+}>();
+
+const emit = defineEmits<{
+  (_e: "update:open", _value: boolean): void;
+}>();
+
+const { t } = useI18nTyped();
+
+const dialogOpen = computed({
+  get: () => props.open,
+  set: (value: boolean) => emit("update:open", value),
+});
+
+const isEditing = computed(() => props.blocklist !== null);
+
+const initialValues = (): DomainBlocklistForm =>
+  props.blocklist
+    ? { domain: props.blocklist.name, blockedEmails: [...props.blocklist.blockedEmails] }
+    : domainBlocklistDefaults(String(props.domainOptions[0]?.value ?? ""));
+
+const form = useOForm<DomainBlocklistForm>({
+  defaultValues: initialValues(),
+  schema: makeDomainBlocklistSchema(t),
+  onSubmit,
+});
+
+const domain = form.useStore((s) => s.values.domain);
+const atDomain = computed(() => raw(`@${domain.value || "…"}`));
+
+// The form outlives the dialog body, so it is re-seeded on every open.
+watch(
+  () => props.open,
+  (visible) => {
+    if (visible) form.reset(initialValues());
+  },
+);
+
+async function onSubmit(value: DomainBlocklistForm) {
+  const saved = await props.submit({
+    name: value.domain.trim().toLowerCase(),
+    blockedEmails: [
+      ...new Set(value.blockedEmails.map((email) => email.trim().toLowerCase()).filter(Boolean)),
+    ],
+  });
+  if (saved) emit("update:open", false);
+}
+</script>
diff --git a/web/src/components/settings/OrgDomainDetailsDialog.spec.ts b/web/src/components/settings/OrgDomainDetailsDialog.spec.ts
new file mode 100644
index 0000000000..cbd793ee21
--- /dev/null
+++ b/web/src/components/settings/OrgDomainDetailsDialog.spec.ts
@@ -0,0 +1,113 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { mount } from "@vue/test-utils";
+import { describe, expect, it } from "vitest";
+import { defineComponent } from "vue";
+import i18n from "@/locales";
+import { raw } from "@/types/i18n";
+import OrgDomainDetailsDialog from "./OrgDomainDetailsDialog.vue";
+
+const DialogStub = defineComponent({
+  name: "ODialog",
+  props: ["open", "title", "primaryButtonLabel", "secondaryButtonLabel", "primaryButtonLoading"],
+  template: "<div><slot /></div>",
+});
+
+const link = (state: 0 | 1 | 2, metaMapped = false) => ({
+  id: "l1",
+  org_id: "acme",
+  domain: "acme.com",
+  verification_token: "o2v_token",
+  verification_state: state,
+  verification_failure_reason: state === 2 ? (2 as const) : null,
+  verified_at: null,
+  last_checked_at: null,
+  created_at: 0,
+  updated_at: 0,
+  meta_mapped: metaMapped,
+});
+
+const request = (status: 0 | 1 | 2) => ({
+  id: "r1",
+  org_id: "acme",
+  domain: "acme.com",
+  created_at: 1_700_000_000_000_000,
+  updated_at: 1_700_000_100_000_000,
+  requested_by: "owner@acme.com",
+  answered_by: status === 0 ? null : "staff@o2.test",
+  status,
+  reason: status === 0 ? null : "checked by email",
+});
+
+const mountDialog = (props: Record<string, unknown>) =>
+  mount(OrgDomainDetailsDialog, {
+    props: { open: true, domain: "acme.com", failureReason: null, verifying: false, ...props },
+    global: {
+      plugins: [i18n],
+      stubs: { ODialog: DialogStub, OrgDomainVerification: true, OTimeCell: true },
+    },
+  });
+
+const dialogProp = (wrapper: ReturnType<typeof mountDialog>, name: string) =>
+  wrapper.findComponent(DialogStub).props(name);
+
+describe("OrgDomainDetailsDialog", () => {
+  it("shows the record and Verify now for a DNS link that failed", () => {
+    const wrapper = mountDialog({
+      link: link(2),
+      request: null,
+      failureReason: raw("DNS resolution failed"),
+    });
+
+    expect(dialogProp(wrapper, "title")).toBe("Verify acme.com");
+    expect(dialogProp(wrapper, "primaryButtonLabel")).toBe("Verify now");
+    expect(wrapper.text()).toContain("Last check failed: DNS resolution failed");
+    expect(wrapper.findComponent({ name: "OrgDomainVerification" }).exists()).toBe(true);
+  });
+
+  it("shows the record without Verify now for a verified DNS link", () => {
+    const wrapper = mountDialog({ link: link(1), request: null });
+
+    expect(dialogProp(wrapper, "title")).toBe("DNS record for acme.com");
+    expect(dialogProp(wrapper, "primaryButtonLabel")).toBeUndefined();
+  });
+
+  it("explains an approved link and who approved it, without a DNS record", () => {
+    const wrapper = mountDialog({ link: link(1, true), request: request(1) });
+
+    expect(dialogProp(wrapper, "title")).toBe("Link details for acme.com");
+    expect(dialogProp(wrapper, "primaryButtonLabel")).toBeUndefined();
+    expect(wrapper.text()).toContain("No DNS record is needed");
+    expect(wrapper.text()).toContain("owner@acme.com");
+    expect(wrapper.text()).toContain("staff@o2.test");
+    expect(wrapper.text()).toContain("checked by email");
+    expect(wrapper.findComponent({ name: "OrgDomainVerification" }).exists()).toBe(false);
+  });
+
+  it("says a pending request is under review and hides the answer fields", () => {
+    const wrapper = mountDialog({ link: null, request: request(0) });
+
+    expect(wrapper.text()).toContain("OpenObserve is reviewing this request");
+    expect(wrapper.text()).not.toContain("Answered by");
+  });
+
+  it("shows why a request was rejected", () => {
+    const wrapper = mountDialog({ link: null, request: request(2) });
+
+    expect(wrapper.text()).toContain("OpenObserve rejected this request");
+    expect(wrapper.text()).toContain("checked by email");
+  });
+});
diff --git a/web/src/components/settings/OrgDomainDetailsDialog.vue b/web/src/components/settings/OrgDomainDetailsDialog.vue
new file mode 100644
index 0000000000..fb3e1216dd
--- /dev/null
+++ b/web/src/components/settings/OrgDomainDetailsDialog.vue
@@ -0,0 +1,135 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <ODialog
+    data-test="settings-org-domain-details-dialog"
+    v-model:open="dialogOpen"
+    size="md"
+    :title="title"
+    :secondary-button-label="t('common.close')"
+    :primary-button-label="canVerify ? t('settings.orgDomainMapping.verifyNow') : undefined"
+    :primary-button-loading="verifying"
+    @click:secondary="dialogOpen = false"
+    @click:primary="emit('verify')"
+  >
+    <div class="flex flex-col gap-4">
+      <template v-if="isDnsLink && link">
+        <span
+          v-if="failureReason"
+          class="text-status-error-text text-sm"
+          data-test="settings-org-domain-details-failure"
+        >
+          {{ t("settings.orgDomainMapping.lastCheckFailed", { reason: failureReason }) }}
+        </span>
+        <OrgDomainVerification :domain="link" />
+      </template>
+
+      <template v-else>
+        <p class="text-text-body text-sm" data-test="settings-org-domain-details-summary">
+          {{ summary }}
+        </p>
+        <dl
+          v-if="request || verifiedAt"
+          class="grid grid-cols-[auto_1fr] gap-x-4 gap-y-2 text-sm"
+          data-test="settings-org-domain-details-facts"
+        >
+          <template v-if="request">
+            <dt class="text-text-secondary">{{ t("settings.orgDomainMapping.requestedBy") }}</dt>
+            <dd class="text-text-body min-w-0 break-all">{{ raw(request.requested_by) }}</dd>
+            <dt class="text-text-secondary">{{ t("settings.orgDomainMapping.requestedAt") }}</dt>
+            <dd class="text-text-body"><OTimeCell :value="request.created_at" unit="us" /></dd>
+          </template>
+          <template v-if="request && request.status !== 0">
+            <dt class="text-text-secondary">{{ t("settings.orgDomainMapping.answeredBy") }}</dt>
+            <dd class="text-text-body min-w-0 break-all">
+              {{ raw(request.answered_by || "—") }}
+            </dd>
+            <dt class="text-text-secondary">{{ t("settings.orgDomainMapping.reason") }}</dt>
+            <dd class="text-text-body min-w-0 break-words">{{ raw(request.reason || "—") }}</dd>
+          </template>
+          <template v-if="verifiedAt">
+            <dt class="text-text-secondary">{{ t("settings.orgDomainMapping.verifiedAt") }}</dt>
+            <dd class="text-text-body" data-test="settings-org-domain-details-verified-at">
+              <OTimeCell :value="verifiedAt" unit="us" />
+            </dd>
+          </template>
+        </dl>
+      </template>
+    </div>
+  </ODialog>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
+import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import type { OrgDomainOwnership, OrgDomainRequest } from "@/services/organizations";
+import OrgDomainVerification from "./OrgDomainVerification.vue";
+
+const props = defineProps<{
+  open: boolean;
+  domain: string;
+  /** The ownership row; null for a request that never became a link. */
+  link: OrgDomainOwnership | null;
+  /** The request behind an approved link, or the open or rejected request itself. */
+  request: OrgDomainRequest | null;
+  /** Why the last DNS check failed, already translated; null when it did not fail. */
+  failureReason: I18nText | null;
+  verifying: boolean;
+}>();
+
+const emit = defineEmits<{
+  (_e: "update:open", _value: boolean): void;
+  (_e: "verify"): void;
+}>();
+
+const { t } = useI18nTyped();
+
+const dialogOpen = computed({
+  get: () => props.open,
+  set: (value: boolean) => emit("update:open", value),
+});
+
+const isDnsLink = computed(() => !!props.link && !props.link.meta_mapped);
+const canVerify = computed(() => isDnsLink.value && props.link?.verification_state !== 1);
+
+const title = computed(() => {
+  if (!isDnsLink.value) {
+    return t("settings.orgDomainMapping.detailsDialogTitle", { domain: props.domain });
+  }
+  return canVerify.value
+    ? t("settings.orgDomainMapping.verifyDialogTitle", { domain: props.domain })
+    : t("settings.orgDomainMapping.recordDialogTitle", { domain: props.domain });
+});
+
+// Links approved from a request carry no `verified_at`, so the approval time stands in for it.
+const verifiedAt = computed<number | null>(() => {
+  const link = props.link;
+  if (!link || link.verification_state !== 1) return null;
+  if (link.verified_at) return link.verified_at;
+  if (props.request?.status === 1) return props.request.updated_at;
+  return link.last_checked_at ?? link.updated_at;
+});
+
+const summary = computed(() => {
+  if (props.link) return t("settings.orgDomainMapping.approvedLinkInfo");
+  return props.request?.status === 2
+    ? t("settings.orgDomainMapping.rejectedRequestInfo")
+    : t("settings.orgDomainMapping.pendingRequestInfo");
+});
+</script>
diff --git a/web/src/components/settings/OrgDomainManagement.vue b/web/src/components/settings/OrgDomainManagement.vue
new file mode 100644
index 0000000000..dd2e73f0c0
--- /dev/null
+++ b/web/src/components/settings/OrgDomainManagement.vue
@@ -0,0 +1,164 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <OPageLayout
+    icon="domain"
+    :title="t('settings.orgDomainMapping.tabLabel')"
+    :subtitle="t('settings.orgDomainMapping.pageSubtitle')"
+    data-test="settings-org-domain-management"
+    tabs-below
+    bleed
+  >
+    <template #header-tabs>
+      <OTabs
+        :model-value="activeTab"
+        dense
+        align="left"
+        data-test="settings-org-domain-management-tabs"
+        @update:model-value="setTab"
+      >
+        <OTab
+          name="linked"
+          :label="t('settings.orgDomainMapping.linkedTab')"
+          data-test="settings-org-domain-management-linked-tab"
+        />
+        <OTab
+          name="mappings"
+          :label="t('settings.orgDomainMapping.mappingsTab')"
+          data-test="settings-org-domain-management-mappings-tab"
+        />
+        <OTab
+          name="access"
+          :label="t('settings.orgDomainMapping.accessTab')"
+          data-test="settings-org-domain-management-access-tab"
+        />
+        <OTab
+          v-if="isMetaOrg"
+          name="requests"
+          :label="t('settings.orgDomainMapping.requestsTab')"
+          data-test="settings-org-domain-management-requests-tab"
+        />
+      </OTabs>
+    </template>
+
+    <template #actions>
+      <OButton
+        v-if="activeTab === 'linked'"
+        variant="primary"
+        size="sm"
+        data-test="settings-org-domain-management-link-btn"
+        @click="linkedDomains?.openLink()"
+      >
+        {{ t("settings.orgDomainMapping.linkDomain") }}
+      </OButton>
+      <OButton
+        v-else-if="activeTab === 'mappings'"
+        variant="primary"
+        size="sm"
+        :disabled="settings.isPending.value || settings.isError.value"
+        data-test="settings-org-domain-management-add-mapping-btn"
+        @click="mappings?.openAdd()"
+      >
+        {{ t("settings.orgDomainMapping.addMapping") }}
+      </OButton>
+    </template>
+
+    <div class="min-h-0 flex-1 overflow-hidden">
+      <OrgLinkedDomains
+        v-if="activeTab === 'linked'"
+        ref="linkedDomains"
+        :key="`linked-${orgId}`"
+        :org-id="orgId"
+        :mappings="settingsData.domain_org_mappings ?? []"
+        :settings-ready="settings.isSuccess.value"
+      />
+      <template v-else-if="activeTab === 'requests' && isMetaOrg">
+        <OrgDomainRequests :key="`requests-${orgId}`" :org-id="orgId" />
+      </template>
+      <div v-else-if="settings.isPending.value" class="flex justify-center py-8">
+        <OSpinner />
+      </div>
+      <OEmptyState
+        v-else-if="settings.isError.value"
+        preset="load-error"
+        data-test="settings-org-domain-management-load-error"
+        @action="settings.refetch()"
+      />
+      <OrgDomainMappings
+        v-else-if="activeTab === 'mappings'"
+        ref="mappings"
+        :key="`mappings-${orgId}`"
+        :org-id="orgId"
+        :mappings="settingsData.domain_org_mappings ?? []"
+        :enforce-allowed-orgs-only="!!settingsData.enforce_allowed_orgs_only"
+        @go-to-linked="setTab('linked')"
+      />
+      <div v-else class="px-page-edge h-full overflow-y-auto py-4">
+        <OrgDomainRestrictions
+          :key="`access-${orgId}`"
+          :org-id="orgId"
+          :config="settingsData.domain_management_config"
+        />
+      </div>
+    </div>
+  </OPageLayout>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { useQuery } from "@tanstack/vue-query";
+import { useI18nTyped } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
+import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
+import OTab from "@/lib/navigation/Tabs/OTab.vue";
+import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
+import { useOrgId } from "@/composables/query";
+import useIsMetaOrg from "@/composables/useIsMetaOrg";
+import { orgSettingsQuery } from "@/services/organizations.queries";
+import OrgDomainMappings from "./OrgDomainMappings.vue";
+import OrgDomainRequests from "./OrgDomainRequests.vue";
+import OrgDomainRestrictions from "./OrgDomainRestrictions.vue";
+import OrgLinkedDomains from "./OrgLinkedDomains.vue";
+
+type DomainTab = "linked" | "mappings" | "access" | "requests";
+const TABS: readonly DomainTab[] = ["linked", "mappings", "access", "requests"];
+
+const { t } = useI18nTyped();
+const route = useRoute();
+const router = useRouter();
+const orgId = useOrgId();
+const { isMetaOrg } = useIsMetaOrg();
+
+const linkedDomains = ref<InstanceType<typeof OrgLinkedDomains> | null>(null);
+const mappings = ref<InstanceType<typeof OrgDomainMappings> | null>(null);
+
+const settings = useQuery(() => orgSettingsQuery(orgId.value));
+const settingsData = computed<Record<string, any>>(() => settings.data.value?.data ?? {});
+
+const activeTab = computed<DomainTab>(() => {
+  const tab = route.query.tab as DomainTab;
+  if (!TABS.includes(tab)) return "linked";
+  return tab === "requests" && !isMetaOrg.value ? "linked" : tab;
+});
+
+function setTab(tab: string | number) {
+  router.replace({ query: { ...route.query, tab: String(tab) } });
+}
+</script>
diff --git a/web/src/components/settings/OrgDomainMapping.schema.spec.ts b/web/src/components/settings/OrgDomainMapping.schema.spec.ts
new file mode 100644
index 0000000000..7191530f16
--- /dev/null
+++ b/web/src/components/settings/OrgDomainMapping.schema.spec.ts
@@ -0,0 +1,41 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { domainBlocklistDefaults, makeDomainBlocklistSchema } from "./OrgDomainMapping.schema";
+
+const schema = makeDomainBlocklistSchema((key) => key);
+const errorsFor = (value: unknown) => {
+  const result = schema.safeParse(value);
+  return result.success ? [] : result.error.issues.map((i) => `${i.path.join(".")}:${i.message}`);
+};
+
+describe("domain blocklist schema", () => {
+  it("accepts emails from the chosen domain", () => {
+    expect(errorsFor({ domain: "acme.com", blockedEmails: ["bob@acme.com"] })).toEqual([]);
+  });
+
+  it("needs at least one email", () => {
+    expect(errorsFor(domainBlocklistDefaults("acme.com"))).toEqual([
+      "blockedEmails:settings.orgDomainMapping.ruleBlockedRequired",
+    ]);
+  });
+
+  it("rejects an email from another domain", () => {
+    expect(errorsFor({ domain: "acme.com", blockedEmails: ["amy@other.com"] })).toEqual([
+      "blockedEmails:settings.invalidEmail",
+    ]);
+  });
+});
diff --git a/web/src/components/settings/OrgDomainMapping.schema.ts b/web/src/components/settings/OrgDomainMapping.schema.ts
new file mode 100644
index 0000000000..53038abae0
--- /dev/null
+++ b/web/src/components/settings/OrgDomainMapping.schema.ts
@@ -0,0 +1,103 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { z } from "zod";
+import { isValidDomain, isValidEmail } from "./DomainManagement.schema";
+
+// The backend accepts only these; `allowed_user` is the OpenFGA name of the User role.
+export const BASE_ROLES = ["admin", "editor", "viewer", "allowed_user"] as const;
+export type BaseRole = (typeof BASE_ROLES)[number];
+
+export const LINK_METHODS = ["dns", "request"] as const;
+export type LinkMethod = (typeof LINK_METHODS)[number];
+
+type Translate = (_key: string) => string;
+
+export const makeOrgDomainMappingSchema = (t: Translate) =>
+  z.object({
+    domain: z.string().min(1, t("settings.orgDomainMapping.domainRequired")),
+    org_id: z.string().min(1, t("settings.orgDomainMapping.organizationRequired")),
+    base_role: z.enum(BASE_ROLES),
+    role_claim_name: z.string(),
+    create_missing_roles: z.boolean(),
+  });
+
+export type OrgDomainMappingForm = z.infer<ReturnType<typeof makeOrgDomainMappingSchema>>;
+
+export const orgDomainMappingDefaults = (orgId = "", domain = ""): OrgDomainMappingForm => ({
+  domain,
+  org_id: orgId,
+  base_role: "allowed_user",
+  role_claim_name: "",
+  create_missing_roles: false,
+});
+
+export const makeLinkDomainSchema = (t: Translate) =>
+  z.object({
+    // No .trim(): OForm saves the raw value, so the submit handler normalizes it.
+    domain: z
+      .string()
+      .min(1, t("settings.domainRequired"))
+      .refine((v) => isValidDomain(v), { message: t("settings.invalidDomain") }),
+    method: z.enum(LINK_METHODS),
+  });
+
+export type LinkDomainForm = z.infer<ReturnType<typeof makeLinkDomainSchema>>;
+
+export const linkDomainDefaults = (): LinkDomainForm => ({ domain: "", method: "dns" });
+
+// Read lazily: one form serves both approve (reason optional) and reject (reason required).
+export const makeRequestDecisionSchema = (t: Translate, isReasonRequired: () => boolean) =>
+  z.object({ reason: z.string() }).superRefine((value, ctx) => {
+    if (isReasonRequired() && value.reason.trim() === "") {
+      ctx.addIssue({
+        code: "custom",
+        path: ["reason"],
+        message: t("settings.orgDomainMapping.reasonRequired"),
+      });
+    }
+  });
+
+export type RequestDecisionForm = z.infer<ReturnType<typeof makeRequestDecisionSchema>>;
+
+export const makeDomainBlocklistSchema = (t: Translate) =>
+  z
+    .object({
+      domain: z.string().min(1, t("settings.domainRequired")),
+      blockedEmails: z.array(z.string()),
+    })
+    .superRefine((value, ctx) => {
+      if (value.blockedEmails.length === 0) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["blockedEmails"],
+          message: t("settings.orgDomainMapping.ruleBlockedRequired"),
+        });
+      }
+      if (value.blockedEmails.some((email) => !isValidEmail(email.trim(), value.domain))) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["blockedEmails"],
+          message: t("settings.invalidEmail"),
+        });
+      }
+    });
+
+export type DomainBlocklistForm = z.infer<ReturnType<typeof makeDomainBlocklistSchema>>;
+
+export const domainBlocklistDefaults = (domain = ""): DomainBlocklistForm => ({
+  domain,
+  blockedEmails: [],
+});
diff --git a/web/src/components/settings/OrgDomainMappingDialog.vue b/web/src/components/settings/OrgDomainMappingDialog.vue
new file mode 100644
index 0000000000..74f8a87d7f
--- /dev/null
+++ b/web/src/components/settings/OrgDomainMappingDialog.vue
@@ -0,0 +1,188 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <ODialog
+    data-test="settings-org-domain-mapping-dialog"
+    v-model:open="dialogOpen"
+    persistent
+    size="md"
+    :form-id="FORM_ID"
+    :title="
+      isEditing
+        ? t('settings.orgDomainMapping.editMapping')
+        : t('settings.orgDomainMapping.addMapping')
+    "
+    :secondary-button-label="t('common.cancel')"
+    :primary-button-label="isEditing ? t('common.save') : t('common.add')"
+    @click:secondary="dialogOpen = false"
+  >
+    <OForm :id="FORM_ID" :form="form" class="flex flex-col gap-5">
+      <OFormSelect
+        data-test="settings-org-domain-mapping-domain-select"
+        name="domain"
+        :label="t('settings.orgDomainMapping.domain')"
+        :options="domainOptions"
+        required
+        :help-text="t('settings.orgDomainMapping.mappingDomainHelp')"
+      />
+
+      <OFormSelect
+        data-test="settings-org-domain-mapping-org-select"
+        name="org_id"
+        :label="t('settings.orgDomainMapping.organization')"
+        :options="orgOptions"
+        required
+        :help-text="t('settings.orgDomainMapping.organizationHelp')"
+      />
+
+      <OFormSelect
+        data-test="settings-org-domain-mapping-role-select"
+        name="base_role"
+        :label="t('settings.orgDomainMapping.baseRole')"
+        :options="roleOptions"
+        required
+        :help-text="t('settings.orgDomainMapping.baseRoleHelp')"
+      />
+
+      <OFormInput
+        data-test="settings-org-domain-mapping-claim-input"
+        name="role_claim_name"
+        :label="t('settings.orgDomainMapping.roleClaimName')"
+        :placeholder="t('settings.orgDomainMapping.roleClaimNamePlaceholder')"
+        :help-text="t('settings.orgDomainMapping.roleClaimNameHelp')"
+      />
+
+      <OFormSwitch
+        data-test="settings-org-domain-mapping-create-roles-switch"
+        name="create_missing_roles"
+        :label="t('settings.orgDomainMapping.createMissingRoles')"
+        :disabled="!hasClaim"
+      />
+    </OForm>
+  </ODialog>
+</template>
+
+<script setup lang="ts">
+import { computed, watch } from "vue";
+import { useI18nTyped } from "@/types/i18n";
+import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
+import OForm from "@/lib/forms/Form/OForm.vue";
+import OFormInput from "@/lib/forms/Input/OFormInput.vue";
+import OFormSelect from "@/lib/forms/Select/OFormSelect.vue";
+import OFormSwitch from "@/lib/forms/Switch/OFormSwitch.vue";
+import { useOForm } from "@/lib/forms/Form/useOForm";
+import type { SelectOption } from "@/lib/forms/Select/OSelect.types";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import type { OrgDomainMapping } from "@/services/organizations";
+import {
+  BASE_ROLES,
+  makeOrgDomainMappingSchema,
+  orgDomainMappingDefaults,
+  type BaseRole,
+  type OrgDomainMappingForm,
+} from "./OrgDomainMapping.schema";
+
+const FORM_ID = "org-domain-mapping-form";
+
+const props = withDefaults(
+  defineProps<{
+    open: boolean;
+    mode: "add" | "edit";
+    mapping?: OrgDomainMapping | null;
+    /** Verified domains only; the backend rejects a mapping for any other. */
+    domainOptions: SelectOption[];
+    orgOptions: SelectOption[];
+    defaultOrgId: string;
+    /** `domain|org_id` of the other mappings, so one pair is mapped once. */
+    takenKeys?: string[];
+    /** Resolves true once the mapping is persisted; the dialog stays open on false. */
+    submit: (_mapping: OrgDomainMapping) => Promise<boolean>;
+  }>(),
+  { mapping: null, takenKeys: () => [] },
+);
+
+const emit = defineEmits<{
+  (_e: "update:open", _value: boolean): void;
+}>();
+
+const { t } = useI18nTyped();
+
+const ROLE_LABEL_KEYS = {
+  admin: "components.badge.userRole.admin",
+  editor: "components.badge.userRole.editor",
+  viewer: "components.badge.userRole.viewer",
+  allowed_user: "components.badge.userRole.user",
+} as const;
+
+const roleOptions = computed<SelectOption[]>(() =>
+  BASE_ROLES.map((role) => ({ label: t(ROLE_LABEL_KEYS[role]), value: role })),
+);
+
+const dialogOpen = computed({
+  get: () => props.open,
+  set: (value: boolean) => emit("update:open", value),
+});
+
+const isEditing = computed(() => props.mode === "edit");
+
+const mappingDefaults = computed((): OrgDomainMappingForm => {
+  const firstDomain = String(props.domainOptions[0]?.value ?? "");
+  const base = orgDomainMappingDefaults(props.defaultOrgId, firstDomain);
+  if (!props.mapping) return base;
+  const role = props.mapping.base_role as BaseRole;
+  return {
+    domain: props.mapping.domain,
+    org_id: props.mapping.org_id,
+    base_role: BASE_ROLES.includes(role) ? role : base.base_role,
+    role_claim_name: props.mapping.role_claim_name ?? "",
+    create_missing_roles: props.mapping.create_missing_roles,
+  };
+});
+
+const form = useOForm<OrgDomainMappingForm>({
+  defaultValues: mappingDefaults.value,
+  schema: makeOrgDomainMappingSchema(t),
+  onSubmit,
+});
+
+const hasClaim = form.useStore((s) => s.values.role_claim_name.trim() !== "");
+
+// The form outlives the dialog body, so it is re-seeded on every open.
+watch(
+  () => props.open,
+  (visible) => {
+    if (visible) form.reset(mappingDefaults.value);
+  },
+);
+
+async function onSubmit(value: OrgDomainMappingForm) {
+  const domain = value.domain.trim().toLowerCase();
+  if (props.takenKeys.includes(`${domain}|${value.org_id}`)) {
+    toast({ variant: "error", message: t("settings.orgDomainMapping.duplicateMapping") });
+    return;
+  }
+  const claim = value.role_claim_name.trim();
+  const saved = await props.submit({
+    domain,
+    org_id: value.org_id,
+    base_role: value.base_role,
+    role_claim_name: claim || null,
+    create_missing_roles: !!claim && value.create_missing_roles,
+  });
+  if (saved) emit("update:open", false);
+}
+</script>
diff --git a/web/src/components/settings/OrgDomainMappings.spec.ts b/web/src/components/settings/OrgDomainMappings.spec.ts
new file mode 100644
index 0000000000..7fc9b0c330
--- /dev/null
+++ b/web/src/components/settings/OrgDomainMappings.spec.ts
@@ -0,0 +1,305 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { flushPromises, mount } from "@vue/test-utils";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { defineComponent } from "vue";
+import i18n from "@/locales";
+import { withQueryClient } from "@/test/unit/helpers/queryClient";
+import type { OrgDomainMapping } from "@/services/organizations";
+import OrgDomainMappings from "./OrgDomainMappings.vue";
+
+const { mockToast, mockConfirm } = vi.hoisted(() => ({
+  mockToast: vi.fn(),
+  mockConfirm: vi.fn(),
+}));
+
+vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: mockToast }));
+vi.mock("@/composables/useConfirmDialog", () => ({
+  useConfirmDialog: () => ({ confirm: mockConfirm }),
+}));
+vi.mock("vuex", () => ({
+  useStore: () => ({ state: { selectedOrganization: { identifier: "acme", label: "Acme" } } }),
+}));
+vi.mock("@/services/billings", () => ({
+  default: {
+    list_billing_group_members: vi
+      .fn()
+      .mockResolvedValue({ data: [{ member_org_id: "child", member_org_name: "Child" }] }),
+  },
+}));
+vi.mock("@/services/organizations", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: {
+      list_org_domains: vi.fn(),
+      post_organization_settings: vi.fn(),
+    },
+  });
+});
+
+import organizations from "@/services/organizations";
+const api = organizations as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const DialogStub = defineComponent({
+  name: "OrgDomainMappingDialog",
+  props: [
+    "open",
+    "mode",
+    "mapping",
+    "domainOptions",
+    "orgOptions",
+    "defaultOrgId",
+    "takenKeys",
+    "submit",
+  ],
+  template: "<div />",
+});
+
+const link = (domain: string, state = 1) => ({
+  id: domain,
+  org_id: "acme",
+  domain,
+  verification_token: "o2v_token",
+  verification_state: state,
+  verification_failure_reason: null,
+  verified_at: null,
+  last_checked_at: null,
+  created_at: 0,
+  updated_at: 0,
+  meta_mapped: false,
+});
+
+const existing: OrgDomainMapping = {
+  domain: "acme.com",
+  org_id: "acme",
+  base_role: "allowed_user",
+  role_claim_name: null,
+  create_missing_roles: false,
+};
+const childMapping: OrgDomainMapping = {
+  domain: "acme.com",
+  org_id: "child",
+  base_role: "viewer",
+  role_claim_name: "groups",
+  create_missing_roles: true,
+};
+
+// Covers OTable's 50ms skeleton hold, which otherwise hides rows that already landed.
+const settle = async () => {
+  for (let i = 0; i < 8; i++) {
+    await new Promise((r) => setTimeout(r, 10));
+    await flushPromises();
+  }
+};
+
+const mountList = async (mappings: OrgDomainMapping[], enforce = false) => {
+  const wrapper = mount(OrgDomainMappings, {
+    props: { orgId: "acme", mappings, enforceAllowedOrgsOnly: enforce },
+    global: {
+      plugins: [i18n, withQueryClient()],
+      stubs: { OrgDomainMappingDialog: DialogStub, OTooltip: true },
+    },
+  });
+  await settle();
+  return wrapper;
+};
+
+type ListWrapper = Awaited<ReturnType<typeof mountList>>;
+
+const dialog = (wrapper: ListWrapper) => wrapper.findComponent(DialogStub);
+const submitFrom = (wrapper: ListWrapper) =>
+  dialog(wrapper).props("submit") as (_m: OrgDomainMapping) => Promise<boolean>;
+
+describe("OrgDomainMappings", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    api.list_org_domains.mockResolvedValue({
+      data: [link("acme.com"), link("pending.com", 0)],
+    });
+    api.post_organization_settings.mockResolvedValue({ data: {} });
+    mockConfirm.mockResolvedValue(true);
+  });
+
+  it("offers only verified domains and this org plus its billing group", async () => {
+    const wrapper = await mountList([existing]);
+
+    expect(
+      dialog(wrapper)
+        .props("domainOptions")
+        .map((o: any) => o.value),
+    ).toEqual(["acme.com"]);
+    expect(
+      dialog(wrapper)
+        .props("orgOptions")
+        .map((o: any) => o.value),
+    ).toEqual(["acme", "child"]);
+  });
+
+  it("appends a new mapping", async () => {
+    const wrapper = await mountList([existing]);
+    (wrapper.vm as any).openAdd();
+
+    await expect(submitFrom(wrapper)(childMapping)).resolves.toBe(true);
+
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      domain_org_mappings: [existing, childMapping],
+    });
+  });
+
+  it("allows one domain to map to several organizations", async () => {
+    const wrapper = await mountList([existing, childMapping]);
+    (wrapper.vm as any).openAdd();
+    await flushPromises();
+
+    expect(dialog(wrapper).props("takenKeys")).toEqual(["acme.com|acme", "acme.com|child"]);
+  });
+
+  it("saves an edited mapping in place and frees its own key", async () => {
+    const wrapper = await mountList([existing, childMapping]);
+    await wrapper
+      .find('[data-test="settings-org-domain-mappings-edit-acme.com|child"]')
+      .trigger("click");
+    await flushPromises();
+    expect(dialog(wrapper).props("takenKeys")).toEqual(["acme.com|acme"]);
+
+    const edited = { ...childMapping, base_role: "admin" };
+    await expect(submitFrom(wrapper)(edited)).resolves.toBe(true);
+
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      domain_org_mappings: [existing, edited],
+    });
+  });
+
+  it("keeps the dialog open when saving fails", async () => {
+    api.post_organization_settings.mockRejectedValue({
+      response: { data: { message: "not verified" } },
+    });
+    const wrapper = await mountList([existing]);
+
+    await expect(submitFrom(wrapper)(childMapping)).resolves.toBe(false);
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({ variant: "error", message: "not verified" }),
+    );
+  });
+
+  it("removes only the confirmed mapping", async () => {
+    const wrapper = await mountList([existing, childMapping]);
+
+    await wrapper
+      .find('[data-test="settings-org-domain-mappings-delete-acme.com|acme"]')
+      .trigger("click");
+    await flushPromises();
+
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      domain_org_mappings: [childMapping],
+    });
+  });
+
+  it("builds a second removal on the list the first one left", async () => {
+    let finishFirst: (_v: unknown) => void = () => {};
+    api.post_organization_settings.mockReturnValueOnce(
+      new Promise((resolve) => (finishFirst = resolve)),
+    );
+    const wrapper = await mountList([existing, childMapping]);
+
+    await wrapper
+      .find('[data-test="settings-org-domain-mappings-delete-acme.com|acme"]')
+      .trigger("click");
+    await wrapper
+      .find('[data-test="settings-org-domain-mappings-delete-acme.com|child"]')
+      .trigger("click");
+    await flushPromises();
+    expect(api.post_organization_settings).toHaveBeenCalledTimes(1);
+
+    await wrapper.setProps({ mappings: [childMapping] });
+    finishFirst({ data: {} });
+    await settle();
+
+    expect(api.post_organization_settings).toHaveBeenLastCalledWith("acme", {
+      domain_org_mappings: [],
+    });
+  });
+
+  it("does nothing when the removal is not confirmed", async () => {
+    mockConfirm.mockResolvedValue(false);
+    const wrapper = await mountList([existing]);
+
+    await wrapper
+      .find('[data-test="settings-org-domain-mappings-delete-acme.com|acme"]')
+      .trigger("click");
+    await flushPromises();
+
+    expect(api.post_organization_settings).not.toHaveBeenCalled();
+  });
+
+  it("flags a mapping whose domain is no longer verified", async () => {
+    const stale = { ...existing, domain: "pending.com" };
+    const wrapper = await mountList([existing, stale]);
+
+    expect(
+      wrapper.find('[data-test="settings-org-domain-mappings-unverified-pending.com"]').exists(),
+    ).toBe(true);
+    expect(
+      wrapper.find('[data-test="settings-org-domain-mappings-unverified-acme.com"]').exists(),
+    ).toBe(false);
+  });
+
+  it("asks before turning on removal from other organizations", async () => {
+    const wrapper = await mountList([existing]);
+
+    await wrapper.findComponent({ name: "OSwitch" }).vm.$emit("update:modelValue", true);
+    await flushPromises();
+
+    expect(mockConfirm).toHaveBeenCalled();
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      enforce_allowed_orgs_only: true,
+    });
+  });
+
+  it("leaves the setting off when the confirmation is declined", async () => {
+    mockConfirm.mockResolvedValue(false);
+    const wrapper = await mountList([existing]);
+
+    await wrapper.findComponent({ name: "OSwitch" }).vm.$emit("update:modelValue", true);
+    await flushPromises();
+
+    expect(api.post_organization_settings).not.toHaveBeenCalled();
+  });
+
+  it("turns the setting off without asking", async () => {
+    const wrapper = await mountList([existing], true);
+
+    await wrapper.findComponent({ name: "OSwitch" }).vm.$emit("update:modelValue", false);
+    await flushPromises();
+
+    expect(mockConfirm).not.toHaveBeenCalled();
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      enforce_allowed_orgs_only: false,
+    });
+  });
+
+  it("flips the switch back when turning it on is declined", async () => {
+    mockConfirm.mockResolvedValue(false);
+    const wrapper = await mountList([existing]);
+    const switchEl = () => wrapper.find('[role="switch"]');
+
+    await switchEl().trigger("click");
+    await flushPromises();
+
+    expect(switchEl().attributes("aria-checked")).toBe("false");
+    expect(api.post_organization_settings).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/components/settings/OrgDomainMappings.vue b/web/src/components/settings/OrgDomainMappings.vue
new file mode 100644
index 0000000000..f14b53616c
--- /dev/null
+++ b/web/src/components/settings/OrgDomainMappings.vue
@@ -0,0 +1,489 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex h-full min-h-0 flex-col" data-test="settings-org-domain-mappings">
+    <div class="px-page-edge shrink-0 py-3">
+      <div
+        class="rounded-default bg-surface-overlay border-border-default flex items-center gap-4 border p-4"
+        data-test="settings-org-domain-mappings-enforce"
+      >
+        <div
+          class="rounded-default bg-surface-subtle border-border-default text-text-secondary flex h-9 w-9 shrink-0 items-center justify-center border"
+        >
+          <OIcon name="layers" size="sm" />
+        </div>
+        <div class="flex min-w-0 flex-1 flex-col gap-0.5">
+          <span class="text-text-heading text-sm font-semibold">
+            {{ t("settings.orgDomainMapping.enforceTitle") }}
+          </span>
+          <span class="text-text-secondary max-w-2xl text-sm">
+            {{ t("settings.orgDomainMapping.enforceDesc") }}
+          </span>
+        </div>
+        <OSwitch
+          :model-value="enforceValue"
+          :disabled="savingEnforce"
+          label-position="left"
+          data-test="settings-org-domain-mappings-enforce-switch"
+          @update:model-value="setEnforce(!!$event)"
+        >
+          <template #label>
+            <span class="sr-only">{{ t("settings.orgDomainMapping.enforceTitle") }}</span>
+            <span class="text-text-secondary font-normal">
+              {{
+                enforceValue
+                  ? t("components.badge.booleanState.on")
+                  : t("components.badge.booleanState.off")
+              }}
+            </span>
+          </template>
+        </OSwitch>
+      </div>
+    </div>
+
+    <div class="bg-card-glass-bg min-h-0 flex-1 overflow-hidden">
+      <OTable
+        :frame="false"
+        data-test="settings-org-domain-mappings-table"
+        :data="visibleRows"
+        :columns="columns"
+        row-key="id"
+        pagination="client"
+        sorting="client"
+        :show-global-filter="false"
+        :loading="domains.isPending.value"
+      >
+        <template #toolbar>
+          <OSearchInput
+            v-model="filterQuery"
+            class="min-w-0 flex-1 max-md:min-w-40"
+            :placeholder="t('settings.orgDomainMapping.searchMappings')"
+            data-test="settings-org-domain-mappings-search"
+          />
+        </template>
+        <template #toolbar-trailing>
+          <ORefreshButton
+            layout="inline"
+            variant="outline"
+            :last-run-at="domains.dataUpdatedAt.value || null"
+            :loading="domains.isFetching.value || members.isFetching.value"
+            data-test="settings-org-domain-mappings-refresh-btn"
+            @click="refresh"
+          />
+        </template>
+        <template #empty>
+          <OEmptyState
+            v-if="!domains.isPending.value"
+            size="hero"
+            preset="no-domain-mappings"
+            :filtered="filterQuery !== ''"
+            :description="
+              verifiedDomains.length === 0
+                ? t('settings.orgDomainMapping.noVerifiedDomains')
+                : undefined
+            "
+            :actions="verifiedDomains.length === 0 ? GO_TO_LINKED_ACTIONS : undefined"
+            @action="onEmptyAction"
+          />
+        </template>
+
+        <template #cell-domain="{ row }">
+          <div class="flex min-w-0 items-center gap-2">
+            <OTruncatedText>{{ atSign }}{{ row.mapping.domain }}</OTruncatedText>
+            <OBadge
+              v-if="!row.verified"
+              variant="warning-outline"
+              size="sm"
+              class="shrink-0"
+              :data-test="`settings-org-domain-mappings-unverified-${row.mapping.domain}`"
+            >
+              {{ t("settings.orgDomainMapping.domainNotVerified") }}
+            </OBadge>
+          </div>
+        </template>
+        <template #cell-org="{ row }">
+          {{ orgLabel(row.mapping.org_id) }}
+        </template>
+        <template #cell-base_role="{ row }">
+          <OTag type="userRole" :value="badgeRole(row.mapping.base_role)" />
+        </template>
+        <template #cell-role_claim_name="{ row }">
+          <OCodeCell v-if="row.mapping.role_claim_name" :value="row.mapping.role_claim_name" />
+          <span v-else class="text-text-muted">{{ dash }}</span>
+        </template>
+        <template #cell-create_missing_roles="{ row }">
+          <span v-if="row.mapping.role_claim_name && row.mapping.create_missing_roles">
+            {{ t("common.yes") }}
+          </span>
+          <span v-else class="text-text-muted">{{ dash }}</span>
+        </template>
+        <template #cell-actions="{ row }">
+          <div class="flex items-center justify-center gap-1">
+            <OButton
+              variant="ghost"
+              size="icon-sm"
+              icon-left="edit"
+              class="max-md:hidden"
+              :title="t('common.edit')"
+              :data-test="`settings-org-domain-mappings-edit-${row.id}`"
+              @click.stop="openEdit(row)"
+            />
+            <OButton
+              variant="ghost-destructive"
+              size="icon-sm"
+              icon-left="delete"
+              class="max-md:hidden"
+              :title="t('common.delete')"
+              :data-test="`settings-org-domain-mappings-delete-${row.id}`"
+              @click.stop="remove(row)"
+            />
+            <ODropdown side="bottom" align="end">
+              <template #trigger>
+                <OButton
+                  icon-left="more-vert"
+                  variant="ghost"
+                  size="icon-xs-sq"
+                  class="md:hidden"
+                  :data-test="`settings-org-domain-mappings-more-${row.id}`"
+                  @click.stop
+                />
+              </template>
+              <ODropdownItem
+                icon-left="edit"
+                class="md:hidden"
+                :data-test="`settings-org-domain-mappings-edit-${row.id}-menu`"
+                @select="openEdit(row)"
+              >
+                <span>{{ t("common.edit") }}</span>
+              </ODropdownItem>
+              <ODropdownItem
+                icon-left="delete"
+                variant="destructive"
+                class="md:hidden"
+                :data-test="`settings-org-domain-mappings-delete-${row.id}-menu`"
+                @select="remove(row)"
+              >
+                <span>{{ t("common.delete") }}</span>
+              </ODropdownItem>
+            </ODropdown>
+          </div>
+        </template>
+      </OTable>
+    </div>
+
+    <OrgDomainMappingDialog
+      v-model:open="dialogOpen"
+      :mode="editingKey === null ? 'add' : 'edit'"
+      :mapping="dialogMapping"
+      :domain-options="domainOptions"
+      :org-options="orgOptions"
+      :default-org-id="orgId"
+      :taken-keys="takenKeys"
+      :submit="submitMapping"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { useMutation, useQuery } from "@tanstack/vue-query";
+import { useStore } from "vuex";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import type { EmptyStateAction } from "@/lib/core/EmptyState/presets";
+import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import OCodeCell from "@/lib/core/Table/cells/OCodeCell.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
+import type { SelectOption } from "@/lib/forms/Select/OSelect.types";
+import OSwitch from "@/lib/forms/Switch/OSwitch.vue";
+import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
+import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import { useConfirmDialog } from "@/composables/useConfirmDialog";
+import type { OrgDomainMapping } from "@/services/organizations";
+import {
+  billingGroupMembersQuery,
+  orgDomainsQuery,
+  updateOrgSettingsMutation,
+} from "@/services/organizations.queries";
+import OrgDomainMappingDialog from "./OrgDomainMappingDialog.vue";
+import { createSaveQueue } from "./saveQueue";
+
+interface MappingRow {
+  id: string;
+  mapping: OrgDomainMapping;
+  verified: boolean;
+}
+
+const props = defineProps<{
+  orgId: string;
+  mappings: OrgDomainMapping[];
+  enforceAllowedOrgsOnly: boolean;
+}>();
+
+const emit = defineEmits<{
+  (_e: "go-to-linked"): void;
+}>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+const { confirm } = useConfirmDialog();
+
+const atSign = raw("@");
+const dash = raw("—");
+
+const GO_TO_LINKED_ACTIONS: EmptyStateAction[] = [
+  {
+    id: "go-to-linked",
+    icon: "link",
+    titleKey: "settings.orgDomainMapping.goToLinked",
+    descriptionKey: "settings.orgDomainMapping.goToLinkedDesc",
+  },
+];
+
+const domains = useQuery(() => orgDomainsQuery(props.orgId));
+const members = useQuery(() => billingGroupMembersQuery(props.orgId));
+const updateSettings = useMutation(() => updateOrgSettingsMutation(props.orgId));
+
+const verifiedDomains = computed(() =>
+  (domains.data.value ?? []).filter((d) => d.verification_state === 1).map((d) => d.domain),
+);
+
+const domainOptions = computed<SelectOption[]>(() =>
+  verifiedDomains.value.map((domain) => ({ label: raw(domain), value: domain })),
+);
+
+// Billing-group names first, then the user's own orgs; the id is the last resort.
+const orgNames = computed(() => {
+  const names = new Map<string, string>();
+  for (const org of store.state.organizations ?? []) {
+    if (org?.identifier && org?.name) names.set(org.identifier, org.name);
+  }
+  if (store.state.selectedOrganization?.label) {
+    names.set(props.orgId, store.state.selectedOrganization.label);
+  }
+  for (const member of members.data.value ?? []) {
+    if (member.member_org_name) names.set(member.member_org_id, member.member_org_name);
+  }
+  return names;
+});
+
+const orgLabel = (orgId: string) => raw(orgNames.value.get(orgId) || orgId);
+
+const orgOptions = computed<SelectOption[]>(() => {
+  const ids = [props.orgId];
+  for (const member of members.data.value ?? []) {
+    if (!ids.includes(member.member_org_id)) ids.push(member.member_org_id);
+  }
+  // An edited mapping keeps its org selectable even before the member list loads.
+  const editingOrg = dialogMapping.value?.org_id;
+  if (editingOrg && !ids.includes(editingOrg)) ids.push(editingOrg);
+  return ids.map((id) => ({ label: orgLabel(id), value: id }));
+});
+
+// The badge registry keys the User role as `user`; `allowed_user` is its OpenFGA relation name.
+const badgeRole = (role: string) => (role === "allowed_user" ? "user" : role);
+
+const mappingKey = (m: Pick<OrgDomainMapping, "domain" | "org_id">) =>
+  `${m.domain.toLowerCase()}|${m.org_id}`;
+
+const rows = computed<MappingRow[]>(() => {
+  const verified = new Set(verifiedDomains.value);
+  return props.mappings.map((mapping) => ({
+    id: mappingKey(mapping),
+    mapping,
+    verified: verified.has(mapping.domain.toLowerCase()),
+  }));
+});
+
+const filterQuery = ref("");
+const visibleRows = computed(() => {
+  const query = filterQuery.value.trim().toLowerCase();
+  if (!query) return rows.value;
+  return rows.value.filter(
+    (row) =>
+      row.mapping.domain.toLowerCase().includes(query) ||
+      String(orgLabel(row.mapping.org_id)).toLowerCase().includes(query),
+  );
+});
+
+const columns: OTableColumnDef<MappingRow>[] = [
+  {
+    id: "domain",
+    header: t("settings.orgDomainMapping.domain"),
+    accessorFn: (row) => row.mapping.domain,
+    sortable: true,
+    size: 300,
+    meta: { isName: true, flex: true },
+  },
+  {
+    id: "org",
+    header: t("settings.orgDomainMapping.organization"),
+    accessorFn: (row) => orgLabel(row.mapping.org_id),
+    sortable: true,
+    size: 220,
+  },
+  {
+    id: "base_role",
+    header: t("settings.orgDomainMapping.baseRole"),
+    accessorFn: (row) => row.mapping.base_role,
+    sortable: true,
+    size: 140,
+  },
+  {
+    id: "role_claim_name",
+    header: t("settings.orgDomainMapping.roleClaimName"),
+    accessorFn: (row) => row.mapping.role_claim_name ?? "",
+    size: 180,
+  },
+  {
+    id: "create_missing_roles",
+    header: t("settings.orgDomainMapping.createsRoles"),
+    accessorFn: (row) => row.mapping.create_missing_roles,
+    size: 150,
+    meta: { headerTooltip: t("settings.orgDomainMapping.createMissingRoles") },
+  },
+  {
+    id: "actions",
+    header: t("common.actions"),
+    isAction: true,
+    pinned: "right",
+    meta: { align: "center", actionCount: 2 },
+  },
+];
+
+const errorMessage = (err: any) => raw(err?.response?.data?.message || err?.message);
+
+function refresh() {
+  domains.refetch();
+  members.refetch();
+}
+
+const dialogOpen = ref(false);
+const dialogMapping = ref<OrgDomainMapping | null>(null);
+const editingKey = ref<string | null>(null);
+const queueSave = createSaveQueue();
+
+const takenKeys = computed(() =>
+  props.mappings.map((mapping) => mappingKey(mapping)).filter((key) => key !== editingKey.value),
+);
+
+function openAdd() {
+  editingKey.value = null;
+  dialogMapping.value = null;
+  dialogOpen.value = true;
+}
+
+function openEdit(row: MappingRow) {
+  editingKey.value = row.id;
+  dialogMapping.value = { ...row.mapping };
+  dialogOpen.value = true;
+}
+
+function onEmptyAction(id?: string) {
+  if (id === "clear-filters") filterQuery.value = "";
+  else if (id === "go-to-linked") emit("go-to-linked");
+  else openAdd();
+}
+
+async function saveMappings(next: OrgDomainMapping[], successMessage: I18nText): Promise<boolean> {
+  try {
+    await updateSettings.mutateAsync({ domain_org_mappings: next });
+  } catch (err) {
+    toast({
+      variant: "error",
+      message: errorMessage(err) || t("settings.orgDomainMapping.saveFailed"),
+    });
+    return false;
+  }
+  toast({ variant: "success", message: successMessage });
+  return true;
+}
+
+function submitMapping(mapping: OrgDomainMapping): Promise<boolean> {
+  const key = editingKey.value;
+  return queueSave(() =>
+    saveMappings(
+      key === null
+        ? [...props.mappings, mapping]
+        : props.mappings.map((m) => (mappingKey(m) === key ? mapping : m)),
+      t("settings.orgDomainMapping.saved"),
+    ),
+  );
+}
+
+async function remove(row: MappingRow) {
+  const ok = await confirm({
+    title: t("settings.orgDomainMapping.deleteTitle"),
+    message: t("settings.orgDomainMapping.deleteMappingBody", {
+      domain: row.mapping.domain,
+      org: orgLabel(row.mapping.org_id),
+    }),
+    confirmLabel: t("common.delete"),
+  });
+  if (!ok) return;
+  await queueSave(() =>
+    saveMappings(
+      props.mappings.filter((m) => mappingKey(m) !== row.id),
+      t("settings.orgDomainMapping.deleted"),
+    ),
+  );
+}
+
+const savingEnforce = ref(false);
+const pendingEnforce = ref<boolean | null>(null);
+const enforceValue = computed(() => pendingEnforce.value ?? props.enforceAllowedOrgsOnly);
+
+async function setEnforce(value: boolean) {
+  // Hold the new value while asking, so a declined confirm changes the prop back
+  // and the switch (which keeps its own state) flips back with it.
+  pendingEnforce.value = value;
+  if (value) {
+    const ok = await confirm({
+      title: t("settings.orgDomainMapping.enforceConfirmTitle"),
+      message: t("settings.orgDomainMapping.enforceConfirmBody"),
+      confirmLabel: t("settings.orgDomainMapping.enforceConfirmAction"),
+    });
+    if (!ok) {
+      pendingEnforce.value = null;
+      return;
+    }
+  }
+  savingEnforce.value = true;
+  try {
+    await updateSettings.mutateAsync({ enforce_allowed_orgs_only: value });
+    toast({ variant: "success", message: t("settings.orgDomainMapping.enforceSaved") });
+  } catch (err) {
+    toast({
+      variant: "error",
+      message: errorMessage(err) || t("settings.orgDomainMapping.saveFailed"),
+    });
+  } finally {
+    pendingEnforce.value = null;
+    savingEnforce.value = false;
+  }
+}
+
+defineExpose({ openAdd });
+</script>
diff --git a/web/src/components/settings/OrgDomainRequestDecisionDialog.vue b/web/src/components/settings/OrgDomainRequestDecisionDialog.vue
new file mode 100644
index 0000000000..f926bf669e
--- /dev/null
+++ b/web/src/components/settings/OrgDomainRequestDecisionDialog.vue
@@ -0,0 +1,110 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <ODialog
+    data-test="settings-org-domain-request-decision-dialog"
+    v-model:open="dialogOpen"
+    persistent
+    size="sm"
+    :form-id="FORM_ID"
+    :title="
+      approve
+        ? t('settings.orgDomainMapping.approveTitle')
+        : t('settings.orgDomainMapping.rejectTitle')
+    "
+    :secondary-button-label="t('common.cancel')"
+    :primary-button-label="
+      approve ? t('settings.orgDomainMapping.approve') : t('settings.orgDomainMapping.reject')
+    "
+    @click:secondary="dialogOpen = false"
+  >
+    <OForm :id="FORM_ID" :form="form" class="flex flex-col gap-5">
+      <p v-if="request" class="text-text-body text-sm">
+        {{
+          approve
+            ? t("settings.orgDomainMapping.approveBody", {
+                domain: request.domain,
+                org: orgName,
+              })
+            : t("settings.orgDomainMapping.rejectBody", {
+                domain: request.domain,
+                org: orgName,
+              })
+        }}
+      </p>
+      <OFormTextarea
+        data-test="settings-org-domain-request-decision-reason"
+        name="reason"
+        :label="t('settings.orgDomainMapping.reason')"
+        :required="!approve"
+        :help-text="t('settings.orgDomainMapping.reasonHelp')"
+      />
+    </OForm>
+  </ODialog>
+</template>
+
+<script setup lang="ts">
+import { computed, watch } from "vue";
+import { useI18nTyped } from "@/types/i18n";
+import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
+import OForm from "@/lib/forms/Form/OForm.vue";
+import OFormTextarea from "@/lib/forms/Input/OFormTextarea.vue";
+import { useOForm } from "@/lib/forms/Form/useOForm";
+import type { OrgDomainRequest } from "@/services/organizations";
+import { makeRequestDecisionSchema, type RequestDecisionForm } from "./OrgDomainMapping.schema";
+
+const FORM_ID = "org-domain-request-decision-form";
+
+const props = defineProps<{
+  open: boolean;
+  request: OrgDomainRequest | null;
+  approve: boolean;
+  orgName: string;
+  /** Resolves true once the decision is saved; the dialog stays open on false. */
+  submit: (_reason: string) => Promise<boolean>;
+}>();
+
+const emit = defineEmits<{
+  (_e: "update:open", _value: boolean): void;
+}>();
+
+const { t } = useI18nTyped();
+
+const dialogOpen = computed({
+  get: () => props.open,
+  set: (value: boolean) => emit("update:open", value),
+});
+
+const form = useOForm<RequestDecisionForm>({
+  defaultValues: { reason: "" },
+  schema: makeRequestDecisionSchema(t, () => !props.approve),
+  onSubmit,
+});
+
+// The form outlives the dialog body, so it is re-seeded on every open.
+watch(
+  () => props.open,
+  (visible) => {
+    if (visible) form.reset({ reason: "" });
+  },
+);
+
+async function onSubmit(value: RequestDecisionForm) {
+  const saved = await props.submit(value.reason.trim());
+  if (saved) emit("update:open", false);
+}
+</script>
diff --git a/web/src/components/settings/OrgDomainRequests.spec.ts b/web/src/components/settings/OrgDomainRequests.spec.ts
new file mode 100644
index 0000000000..832e0e7002
--- /dev/null
+++ b/web/src/components/settings/OrgDomainRequests.spec.ts
@@ -0,0 +1,134 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { flushPromises, mount } from "@vue/test-utils";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { defineComponent } from "vue";
+import i18n from "@/locales";
+import { withQueryClient } from "@/test/unit/helpers/queryClient";
+import OrgDomainRequests from "./OrgDomainRequests.vue";
+
+const { mockToast } = vi.hoisted(() => ({ mockToast: vi.fn() }));
+
+vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: mockToast }));
+vi.mock("@/services/organizations", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: {
+      list_org_domain_requests: vi.fn(),
+      approve_org_domain_request: vi.fn(),
+      reject_org_domain_request: vi.fn(),
+    },
+  });
+});
+
+import organizations from "@/services/organizations";
+const api = organizations as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const DialogStub = defineComponent({
+  name: "OrgDomainRequestDecisionDialog",
+  props: ["open", "request", "approve", "submit"],
+  template: "<div />",
+});
+
+const request = (id: string, status: number) => ({
+  id,
+  org_id: "acme",
+  domain: `${id}.com`,
+  created_at: 0,
+  updated_at: 0,
+  requested_by: "a@acme.com",
+  answered_by: null,
+  status,
+  reason: null,
+});
+
+// Covers OTable's 50ms skeleton hold, which otherwise hides rows that already landed.
+const settle = async () => {
+  for (let i = 0; i < 8; i++) {
+    await new Promise((r) => setTimeout(r, 10));
+    await flushPromises();
+  }
+};
+
+const mountList = async () => {
+  const wrapper = mount(OrgDomainRequests, {
+    props: { orgId: "_meta" },
+    global: {
+      plugins: [i18n, withQueryClient()],
+      stubs: { OrgDomainRequestDecisionDialog: DialogStub, OTooltip: true },
+    },
+  });
+  await settle();
+  return wrapper;
+};
+
+describe("OrgDomainRequests", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    api.list_org_domain_requests.mockResolvedValue({
+      data: [request("open", 0), request("done", 1), request("no", 2)],
+    });
+    api.approve_org_domain_request.mockResolvedValue({ data: {} });
+    api.reject_org_domain_request.mockResolvedValue({ data: {} });
+  });
+
+  it("shows only pending requests by default", async () => {
+    const wrapper = await mountList();
+
+    expect(wrapper.find('[data-test="settings-org-domain-requests-approve-open"]').exists()).toBe(
+      true,
+    );
+    expect(wrapper.text()).not.toContain("done.com");
+    expect(wrapper.text()).not.toContain("no.com");
+  });
+
+  it("approves with the given reason", async () => {
+    const wrapper = await mountList();
+
+    await wrapper.find('[data-test="settings-org-domain-requests-approve-open"]').trigger("click");
+    const dialog = wrapper.findComponent(DialogStub);
+    expect(dialog.props("approve")).toBe(true);
+
+    await expect(dialog.props("submit")("owns it")).resolves.toBe(true);
+    expect(api.approve_org_domain_request).toHaveBeenCalledWith("_meta", "open", "owns it");
+    expect(api.reject_org_domain_request).not.toHaveBeenCalled();
+  });
+
+  it("rejects through the reject endpoint", async () => {
+    const wrapper = await mountList();
+
+    await wrapper.find('[data-test="settings-org-domain-requests-reject-open"]').trigger("click");
+    const dialog = wrapper.findComponent(DialogStub);
+    expect(dialog.props("approve")).toBe(false);
+
+    await expect(dialog.props("submit")("not theirs")).resolves.toBe(true);
+    expect(api.reject_org_domain_request).toHaveBeenCalledWith("_meta", "open", "not theirs");
+  });
+
+  it("keeps the dialog open when the decision fails", async () => {
+    api.approve_org_domain_request.mockRejectedValue({
+      response: { data: { message: "already linked" } },
+    });
+    const wrapper = await mountList();
+
+    await wrapper.find('[data-test="settings-org-domain-requests-approve-open"]').trigger("click");
+
+    await expect(wrapper.findComponent(DialogStub).props("submit")("")).resolves.toBe(false);
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({ variant: "error", message: "already linked" }),
+    );
+  });
+});
diff --git a/web/src/components/settings/OrgDomainRequests.vue b/web/src/components/settings/OrgDomainRequests.vue
new file mode 100644
index 0000000000..7f8a8c5936
--- /dev/null
+++ b/web/src/components/settings/OrgDomainRequests.vue
@@ -0,0 +1,338 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div
+    class="bg-card-glass-bg h-full min-h-0 overflow-hidden"
+    data-test="settings-org-domain-requests"
+  >
+    <OTable
+      :frame="false"
+      data-test="settings-org-domain-requests-table"
+      :data="visibleRows"
+      :columns="columns"
+      row-key="id"
+      pagination="client"
+      sorting="client"
+      :show-global-filter="false"
+      :loading="requests.isPending.value"
+      :error="loadError"
+      :column-visibility="{ answered_by: false }"
+    >
+      <template #toolbar>
+        <div class="flex w-full min-w-0 items-center gap-2 max-md:contents">
+          <OToggleGroup
+            mobile-dropdown
+            :model-value="statusFilter"
+            data-test="settings-org-domain-requests-filter"
+            @update:model-value="statusFilter = $event as StatusFilter"
+          >
+            <OToggleGroupItem
+              value="pending"
+              size="sm"
+              data-test="settings-org-domain-requests-filter-pending"
+            >
+              {{ t("settings.orgDomainMapping.filterPending") }}
+            </OToggleGroupItem>
+            <OToggleGroupItem
+              value="all"
+              size="sm"
+              data-test="settings-org-domain-requests-filter-all"
+            >
+              {{ t("settings.orgDomainMapping.filterAll") }}
+            </OToggleGroupItem>
+          </OToggleGroup>
+          <OSearchInput
+            v-model="filterQuery"
+            class="min-w-0 flex-1 max-md:min-w-40"
+            :placeholder="t('settings.orgDomainMapping.searchRequests')"
+            data-test="settings-org-domain-requests-search"
+          />
+        </div>
+      </template>
+      <template #toolbar-trailing>
+        <ORefreshButton
+          layout="inline"
+          variant="outline"
+          :last-run-at="requests.dataUpdatedAt.value || null"
+          :loading="requests.isFetching.value"
+          data-test="settings-org-domain-requests-refresh-btn"
+          @click="refresh"
+        />
+      </template>
+      <template #empty>
+        <OEmptyState
+          v-if="!requests.isPending.value"
+          size="hero"
+          preset="no-domain-requests"
+          :filtered="filterQuery !== ''"
+          @action="filterQuery = ''"
+        />
+      </template>
+      <template #error="{ message }">
+        <OEmptyState preset="load-error" :description="raw(message)" @action="requests.refetch()" />
+      </template>
+
+      <template #cell-requested_by="{ row }">
+        <OUserCell :value="row.requested_by" />
+      </template>
+      <template #cell-created_at="{ row }">
+        <OTimeCell :value="row.created_at" unit="us" />
+      </template>
+      <template #cell-status="{ row }">
+        <OBadge :variant="STATUS_BADGES[row.status].variant" size="sm">
+          {{ t(STATUS_BADGES[row.status].labelKey) }}
+        </OBadge>
+      </template>
+      <template #cell-answered_by="{ row }">
+        <OUserCell :value="row.answered_by ?? ''" />
+      </template>
+      <template #cell-reason="{ row }">
+        <span v-if="row.reason">{{ row.reason }}</span>
+        <span v-else class="text-text-muted">{{ dash }}</span>
+      </template>
+      <template #cell-actions="{ row }">
+        <div v-if="row.status === 0" class="flex items-center justify-center gap-1">
+          <OButton
+            variant="ghost"
+            size="icon-sm"
+            icon-left="check-circle"
+            class="max-md:hidden"
+            :title="t('settings.orgDomainMapping.approve')"
+            :data-test="`settings-org-domain-requests-approve-${row.id}`"
+            @click.stop="openDecision(row, true)"
+          />
+          <OButton
+            variant="ghost-destructive"
+            size="icon-sm"
+            icon-left="cancel"
+            class="max-md:hidden"
+            :title="t('settings.orgDomainMapping.reject')"
+            :data-test="`settings-org-domain-requests-reject-${row.id}`"
+            @click.stop="openDecision(row, false)"
+          />
+          <ODropdown side="bottom" align="end">
+            <template #trigger>
+              <OButton
+                icon-left="more-vert"
+                variant="ghost"
+                size="icon-xs-sq"
+                class="md:hidden"
+                :data-test="`settings-org-domain-requests-more-${row.id}`"
+                @click.stop
+              />
+            </template>
+            <ODropdownItem
+              icon-left="check-circle"
+              class="md:hidden"
+              :data-test="`settings-org-domain-requests-approve-${row.id}-menu`"
+              @select="openDecision(row, true)"
+            >
+              <span>{{ t("settings.orgDomainMapping.approve") }}</span>
+            </ODropdownItem>
+            <ODropdownItem
+              icon-left="cancel"
+              variant="destructive"
+              class="md:hidden"
+              :data-test="`settings-org-domain-requests-reject-${row.id}-menu`"
+              @select="openDecision(row, false)"
+            >
+              <span>{{ t("settings.orgDomainMapping.reject") }}</span>
+            </ODropdownItem>
+          </ODropdown>
+        </div>
+      </template>
+    </OTable>
+
+    <OrgDomainRequestDecisionDialog
+      v-model:open="decisionOpen"
+      :request="decisionRequest"
+      :approve="decisionApprove"
+      :org-name="decisionRequest ? orgLabel(decisionRequest.org_id) : ''"
+      :submit="submitDecision"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { useMutation, useQuery } from "@tanstack/vue-query";
+import { raw, useI18nTyped, type I18nKey } from "@/types/i18n";
+import OBadge from "@/lib/core/Badge/OBadge.vue";
+import type { BadgeVariant } from "@/lib/core/Badge/OBadge.types";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import OUserCell from "@/lib/core/Table/cells/OUserCell.vue";
+import { COL, type OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
+import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
+import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
+import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
+import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import type { OrgDomainRequest } from "@/services/organizations";
+import {
+  adminOrgsQuery,
+  decideOrgDomainRequestMutation,
+  orgDomainRequestsQuery,
+} from "@/services/organizations.queries";
+import OrgDomainRequestDecisionDialog from "./OrgDomainRequestDecisionDialog.vue";
+
+type StatusFilter = "pending" | "all";
+
+const props = defineProps<{ orgId: string }>();
+
+const { t } = useI18nTyped();
+
+const dash = raw("—");
+
+const STATUS_BADGES: Record<number, { variant: BadgeVariant; labelKey: I18nKey }> = {
+  0: { variant: "warning-outline", labelKey: "settings.orgDomainMapping.state.requested" },
+  1: { variant: "success-outline", labelKey: "settings.orgDomainMapping.state.approved" },
+  2: { variant: "error-outline", labelKey: "settings.orgDomainMapping.state.rejected" },
+};
+
+const requests = useQuery(() => orgDomainRequestsQuery(props.orgId));
+const orgs = useQuery(() => adminOrgsQuery(props.orgId));
+const decide = useMutation(() => decideOrgDomainRequestMutation(props.orgId));
+
+const loadError = computed(() => {
+  const err: any = requests.error.value;
+  if (!err) return null;
+  return err?.response?.data?.message || err?.message || t("settings.orgDomainMapping.loadFailed");
+});
+
+const orgNames = computed(
+  () => new Map((orgs.data.value ?? []).map((org) => [org.identifier, org.name])),
+);
+const orgLabel = (orgId: string) => raw(orgNames.value.get(orgId) || orgId);
+
+function refresh() {
+  requests.refetch();
+  orgs.refetch();
+}
+
+const statusFilter = ref<StatusFilter>("pending");
+const filterQuery = ref("");
+
+const visibleRows = computed(() => {
+  const query = filterQuery.value.trim().toLowerCase();
+  return (requests.data.value ?? []).filter((req) => {
+    if (statusFilter.value === "pending" && req.status !== 0) return false;
+    if (!query) return true;
+    return [req.domain, req.org_id, orgLabel(req.org_id), req.requested_by].some((v) =>
+      v.toLowerCase().includes(query),
+    );
+  });
+});
+
+const columns: OTableColumnDef<OrgDomainRequest>[] = [
+  {
+    id: "domain",
+    header: t("settings.orgDomainMapping.domain"),
+    accessorKey: "domain",
+    sortable: true,
+    size: 260,
+    meta: { isName: true, flex: true },
+  },
+  {
+    id: "org_id",
+    header: t("settings.orgDomainMapping.organization"),
+    accessorFn: (row) => orgLabel(row.org_id),
+    sortable: true,
+    size: 220,
+  },
+  {
+    id: "requested_by",
+    header: t("settings.orgDomainMapping.requestedBy"),
+    accessorKey: "requested_by",
+    sortable: true,
+    size: COL.email,
+  },
+  {
+    id: "created_at",
+    header: t("settings.orgDomainMapping.requestedAt"),
+    accessorKey: "created_at",
+    sortable: true,
+    size: COL.createdAt,
+  },
+  {
+    id: "status",
+    header: t("settings.orgDomainMapping.status"),
+    accessorKey: "status",
+    sortable: true,
+    size: 140,
+  },
+  {
+    id: "answered_by",
+    header: t("settings.orgDomainMapping.answeredBy"),
+    accessorKey: "answered_by",
+    hideable: true,
+    size: COL.email,
+  },
+  {
+    id: "reason",
+    header: t("settings.orgDomainMapping.reason"),
+    accessorKey: "reason",
+    hideable: true,
+    size: 260,
+  },
+  {
+    id: "actions",
+    header: t("common.actions"),
+    isAction: true,
+    pinned: "right",
+    meta: { align: "center", actionCount: 2 },
+  },
+];
+
+const decisionOpen = ref(false);
+const decisionRequest = ref<OrgDomainRequest | null>(null);
+const decisionApprove = ref(true);
+
+function openDecision(request: OrgDomainRequest, approve: boolean) {
+  decisionRequest.value = request;
+  decisionApprove.value = approve;
+  decisionOpen.value = true;
+}
+
+async function submitDecision(reason: string): Promise<boolean> {
+  const request = decisionRequest.value;
+  if (!request) return false;
+  const approve = decisionApprove.value;
+  try {
+    await decide.mutateAsync({ id: request.id, approve, reason });
+  } catch (err: any) {
+    toast({
+      variant: "error",
+      message:
+        raw(err?.response?.data?.message || err?.message) ||
+        t("settings.orgDomainMapping.decisionFailed"),
+    });
+    return false;
+  }
+  toast({
+    variant: "success",
+    message: approve
+      ? t("settings.orgDomainMapping.requestApproved", { domain: request.domain })
+      : t("settings.orgDomainMapping.requestRejected", { domain: request.domain }),
+  });
+  return true;
+}
+</script>
diff --git a/web/src/components/settings/OrgDomainRestrictions.rules.spec.ts b/web/src/components/settings/OrgDomainRestrictions.rules.spec.ts
new file mode 100644
index 0000000000..3f9721559f
--- /dev/null
+++ b/web/src/components/settings/OrgDomainRestrictions.rules.spec.ts
@@ -0,0 +1,214 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { flushPromises, mount } from "@vue/test-utils";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { defineComponent } from "vue";
+import i18n from "@/locales";
+import { withQueryClient } from "@/test/unit/helpers/queryClient";
+import OrgDomainRestrictions from "./OrgDomainRestrictions.vue";
+
+const { mockToast, mockConfirm } = vi.hoisted(() => ({
+  mockToast: vi.fn(),
+  mockConfirm: vi.fn(),
+}));
+
+vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: mockToast }));
+vi.mock("@/composables/useConfirmDialog", () => ({
+  useConfirmDialog: () => ({ confirm: mockConfirm }),
+}));
+vi.mock("@/services/organizations", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: { post_organization_settings: vi.fn(), list_org_domains: vi.fn() },
+  });
+});
+
+import organizations from "@/services/organizations";
+const api = organizations as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const BlocklistDialogStub = defineComponent({
+  name: "OrgDomainBlocklistDialog",
+  props: ["open", "blocklist", "domainOptions", "submit"],
+  template: "<div />",
+});
+
+const link = (domain: string, state = 1) => ({
+  id: domain,
+  org_id: "acme",
+  domain,
+  verification_token: "o2v_token",
+  verification_state: state,
+  verification_failure_reason: null,
+  verified_at: null,
+  last_checked_at: null,
+  created_at: 0,
+  updated_at: 0,
+  meta_mapped: false,
+});
+
+const apiRule = { domain: "acme.com", allow_all_users: true, allowed_emails: [] };
+
+const config = {
+  domains: [apiRule],
+  enabled: true,
+  blocked_emails: ["bob@acme.com"],
+  blocked_domains: ["spam.net"],
+  updated_at: 0,
+};
+
+// Covers OTable's 50ms skeleton hold, which otherwise hides rows that already landed.
+const settle = async () => {
+  for (let i = 0; i < 8; i++) {
+    await new Promise((r) => setTimeout(r, 10));
+    await flushPromises();
+  }
+};
+
+const mountRules = async () => {
+  const wrapper = mount(OrgDomainRestrictions, {
+    props: { orgId: "acme", config },
+    global: {
+      plugins: [i18n, withQueryClient()],
+      stubs: { OrgDomainBlocklistDialog: BlocklistDialogStub, OTooltip: true },
+    },
+  });
+  await settle();
+  return wrapper;
+};
+
+type RulesWrapper = Awaited<ReturnType<typeof mountRules>>;
+
+const dialog = (wrapper: RulesWrapper) => wrapper.findComponent(BlocklistDialogStub);
+
+describe("OrgDomainRestrictions: blocked users table", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockConfirm.mockResolvedValue(true);
+    api.post_organization_settings.mockResolvedValue({ data: {} });
+    api.list_org_domains.mockResolvedValue({
+      data: [link("acme.com"), link("acme.io"), link("pending.com", 0)],
+    });
+  });
+
+  it("lists one row per domain with its blocked email count", async () => {
+    const wrapper = await mountRules();
+
+    expect(
+      wrapper.find('[data-test="settings-org-domain-restrictions-emails-acme.com"]').text(),
+    ).toContain("1 blocked");
+    expect(
+      wrapper.find('[data-test="settings-org-domain-restrictions-emails-spam.net"]').exists(),
+    ).toBe(false);
+  });
+
+  it("offers only verified domains that have no blocked users yet", async () => {
+    const wrapper = await mountRules();
+
+    await wrapper.find('[data-test="settings-org-domain-restrictions-add-btn"]').trigger("click");
+    expect(dialog(wrapper).props("open")).toBe(true);
+    expect(dialog(wrapper).props("blocklist")).toBeNull();
+    expect(
+      dialog(wrapper)
+        .props("domainOptions")
+        .map((o: { value: string }) => o.value),
+    ).toEqual(["acme.io"]);
+  });
+
+  it("saves new blocked users and keeps the API-only rules", async () => {
+    const wrapper = await mountRules();
+
+    const saved = await dialog(wrapper).props("submit")({
+      name: "acme.io",
+      blockedEmails: ["eve@acme.io"],
+    });
+
+    expect(saved).toBe(true);
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      domain_management_config: expect.objectContaining({
+        domains: [apiRule],
+        blocked_domains: ["spam.net"],
+        blocked_emails: ["bob@acme.com", "eve@acme.io"],
+      }),
+    });
+    expect(mockToast).toHaveBeenCalledWith(expect.objectContaining({ variant: "success" }));
+  });
+
+  it("replaces a domain's blocked users on edit", async () => {
+    const wrapper = await mountRules();
+
+    await wrapper
+      .find('[data-test="settings-org-domain-restrictions-edit-acme.com"]')
+      .trigger("click");
+    expect(dialog(wrapper).props("blocklist").name).toBe("acme.com");
+    expect(
+      dialog(wrapper)
+        .props("domainOptions")
+        .map((o: { value: string }) => o.value),
+    ).toEqual(["acme.com"]);
+
+    await dialog(wrapper).props("submit")({ name: "acme.com", blockedEmails: ["amy@acme.com"] });
+
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      domain_management_config: expect.objectContaining({
+        domains: [apiRule],
+        blocked_emails: ["amy@acme.com"],
+      }),
+    });
+  });
+
+  it("keeps the dialog open when the save fails", async () => {
+    api.post_organization_settings.mockRejectedValue(new Error("boom"));
+    const wrapper = await mountRules();
+
+    const saved = await dialog(wrapper).props("submit")({
+      name: "acme.io",
+      blockedEmails: ["eve@acme.io"],
+    });
+
+    expect(saved).toBe(false);
+    expect(mockToast).toHaveBeenCalledWith(expect.objectContaining({ variant: "error" }));
+  });
+
+  it("unblocks the domain's users after confirming", async () => {
+    const wrapper = await mountRules();
+
+    await wrapper
+      .find('[data-test="settings-org-domain-restrictions-remove-acme.com"]')
+      .trigger("click");
+    await settle();
+
+    expect(mockConfirm).toHaveBeenCalledTimes(1);
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      domain_management_config: expect.objectContaining({
+        blocked_emails: [],
+        domains: [apiRule],
+        blocked_domains: ["spam.net"],
+      }),
+    });
+  });
+
+  it("does not save when the unblock is declined", async () => {
+    mockConfirm.mockResolvedValue(false);
+    const wrapper = await mountRules();
+
+    await wrapper
+      .find('[data-test="settings-org-domain-restrictions-remove-acme.com"]')
+      .trigger("click");
+    await settle();
+
+    expect(api.post_organization_settings).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/components/settings/OrgDomainRestrictions.vue b/web/src/components/settings/OrgDomainRestrictions.vue
new file mode 100644
index 0000000000..9b5b96eceb
--- /dev/null
+++ b/web/src/components/settings/OrgDomainRestrictions.vue
@@ -0,0 +1,275 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex flex-col gap-4" data-test="settings-org-domain-restrictions">
+    <OFormSection
+      :title="t('settings.orgDomainMapping.blocklistSection')"
+      data-test="settings-org-domain-restrictions-blocklists"
+    >
+      <template #actions>
+        <OButton
+          variant="outline"
+          size="sm"
+          :disabled="addableDomains.length === 0"
+          :title="
+            addableDomains.length === 0
+              ? t('settings.orgDomainMapping.noDomainForBlocklist')
+              : undefined
+          "
+          data-test="settings-org-domain-restrictions-add-btn"
+          @click="openAdd"
+        >
+          {{ t("settings.orgDomainMapping.blockUsers") }}
+        </OButton>
+      </template>
+
+      <div class="py-1">
+        <OTable
+          data-test="settings-org-domain-restrictions-table"
+          :data="blocklists"
+          :columns="columns"
+          row-key="name"
+          show-index
+          pagination="none"
+          sorting="client"
+          :fill-height="false"
+          :show-global-filter="false"
+        >
+          <template #empty>
+            <OEmptyState
+              preset="no-blocked-users"
+              :actions="addableDomains.length === 0 ? [] : undefined"
+              @action="openAdd"
+            />
+          </template>
+          <template #cell-emails="{ row }">
+            <span
+              class="relative inline-flex"
+              :data-test="`settings-org-domain-restrictions-emails-${row.name}`"
+            >
+              {{
+                t(
+                  "settings.orgDomainMapping.blockedCount",
+                  { count: row.blockedEmails.length },
+                  row.blockedEmails.length,
+                )
+              }}
+              <OTooltip :max-width="'25rem'" :content="raw(row.blockedEmails.join(', '))" />
+            </span>
+          </template>
+          <template #cell-actions="{ row }">
+            <div class="flex items-center justify-center gap-1">
+              <OButton
+                variant="ghost"
+                size="icon-sm"
+                icon-left="edit"
+                class="max-md:hidden"
+                :title="t('common.edit')"
+                :data-test="`settings-org-domain-restrictions-edit-${row.name}`"
+                @click.stop="openEdit(row)"
+              />
+              <OButton
+                variant="ghost-destructive"
+                size="icon-sm"
+                icon-left="delete"
+                class="max-md:hidden"
+                :title="t('settings.orgDomainMapping.unblockAll')"
+                :data-test="`settings-org-domain-restrictions-remove-${row.name}`"
+                @click.stop="removeBlocklist(row)"
+              />
+              <ODropdown side="bottom" align="end">
+                <template #trigger>
+                  <OButton
+                    icon-left="more-vert"
+                    variant="ghost"
+                    size="icon-xs-sq"
+                    class="md:hidden"
+                    :data-test="`settings-org-domain-restrictions-more-${row.name}`"
+                    @click.stop
+                  />
+                </template>
+                <ODropdownItem
+                  icon-left="edit"
+                  class="md:hidden"
+                  :data-test="`settings-org-domain-restrictions-edit-${row.name}-menu`"
+                  @select="openEdit(row)"
+                >
+                  <span>{{ t("common.edit") }}</span>
+                </ODropdownItem>
+                <ODropdownItem
+                  icon-left="delete"
+                  variant="destructive"
+                  class="md:hidden"
+                  :data-test="`settings-org-domain-restrictions-remove-${row.name}-menu`"
+                  @select="removeBlocklist(row)"
+                >
+                  <span>{{ t("settings.orgDomainMapping.unblockAll") }}</span>
+                </ODropdownItem>
+              </ODropdown>
+            </div>
+          </template>
+        </OTable>
+      </div>
+    </OFormSection>
+
+    <OrgDomainBlocklistDialog
+      v-model:open="dialogOpen"
+      :blocklist="editing"
+      :domain-options="dialogDomainOptions"
+      :submit="submitBlocklist"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { useMutation, useQuery } from "@tanstack/vue-query";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OFormSection from "@/lib/core/FormSection/OFormSection.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import type { SelectOption } from "@/lib/forms/Select/OSelect.types";
+import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
+import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import { useConfirmDialog } from "@/composables/useConfirmDialog";
+import { orgDomainsQuery, updateOrgSettingsMutation } from "@/services/organizations.queries";
+import {
+  configToBlocklists,
+  setDomainBlocklist,
+  type DomainBlocklist,
+  type DomainManagementConfig,
+} from "./orgDomainRestrictions";
+import OrgDomainBlocklistDialog from "./OrgDomainBlocklistDialog.vue";
+import { createSaveQueue } from "./saveQueue";
+
+const props = defineProps<{
+  orgId: string;
+  config?: Partial<DomainManagementConfig>;
+}>();
+
+const { t } = useI18nTyped();
+const { confirm } = useConfirmDialog();
+
+const updateSettings = useMutation(() => updateOrgSettingsMutation(props.orgId));
+const domains = useQuery(() => orgDomainsQuery(props.orgId));
+
+const blocklists = computed(() => configToBlocklists(props.config));
+
+const columns: OTableColumnDef<DomainBlocklist>[] = [
+  {
+    id: "name",
+    header: t("settings.orgDomainMapping.domain"),
+    accessorKey: "name",
+    sortable: true,
+    size: 280,
+    meta: { isName: true, flex: true },
+  },
+  {
+    id: "emails",
+    header: t("settings.orgDomainMapping.blockedEmails"),
+    accessorFn: (row) => row.blockedEmails.length,
+    sortable: true,
+    size: 200,
+  },
+  {
+    id: "actions",
+    header: t("common.actions"),
+    isAction: true,
+    pinned: "right",
+    meta: { align: "center", actionCount: 2 },
+  },
+];
+
+// The backend checks blocks only for users of domains this org owns, so new blocklists pick from its verified domains.
+const verifiedDomains = computed(() =>
+  (domains.data.value ?? []).filter((d) => d.verification_state === 1).map((d) => d.domain),
+);
+const addableDomains = computed(() =>
+  [...new Set(verifiedDomains.value)].filter((d) => !blocklists.value.some((b) => b.name === d)),
+);
+
+const queueSave = createSaveQueue();
+
+const dialogOpen = ref(false);
+const editing = ref<DomainBlocklist | null>(null);
+const dialogDomainOptions = computed<SelectOption[]>(() => {
+  const names = editing.value ? [editing.value.name] : addableDomains.value;
+  return names.map((name) => ({ label: raw(name), value: name }));
+});
+
+function openAdd() {
+  editing.value = null;
+  dialogOpen.value = true;
+}
+
+function openEdit(blocklist: DomainBlocklist) {
+  editing.value = blocklist;
+  dialogOpen.value = true;
+}
+
+async function saveBlocklist(
+  domain: string,
+  emails: string[],
+  successMessage: I18nText,
+): Promise<boolean> {
+  return queueSave(() => writeBlocklist(domain, emails, successMessage));
+}
+
+async function writeBlocklist(
+  domain: string,
+  emails: string[],
+  successMessage: I18nText,
+): Promise<boolean> {
+  try {
+    await updateSettings.mutateAsync({
+      domain_management_config: setDomainBlocklist(props.config, domain, emails),
+    });
+  } catch (err: any) {
+    toast({
+      variant: "error",
+      message:
+        raw(err?.response?.data?.message || err?.message) ||
+        t("settings.orgDomainMapping.saveFailed"),
+    });
+    return false;
+  }
+  toast({ variant: "success", message: successMessage });
+  return true;
+}
+
+function submitBlocklist(blocklist: DomainBlocklist): Promise<boolean> {
+  return saveBlocklist(
+    blocklist.name,
+    blocklist.blockedEmails,
+    t("settings.orgDomainMapping.blocklistSaved"),
+  );
+}
+
+async function removeBlocklist(blocklist: DomainBlocklist) {
+  const ok = await confirm({
+    title: t("settings.orgDomainMapping.unblockAllTitle"),
+    message: t("settings.orgDomainMapping.unblockAllBody", { domain: blocklist.name }),
+    confirmLabel: t("settings.orgDomainMapping.unblockAll"),
+  });
+  if (!ok) return;
+  await saveBlocklist(blocklist.name, [], t("settings.orgDomainMapping.blocklistDeleted"));
+}
+</script>
diff --git a/web/src/components/settings/OrgDomainVerification.vue b/web/src/components/settings/OrgDomainVerification.vue
new file mode 100644
index 0000000000..592e28e57e
--- /dev/null
+++ b/web/src/components/settings/OrgDomainVerification.vue
@@ -0,0 +1,92 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex flex-col gap-2" :data-test="`settings-org-domain-verification-${domain.domain}`">
+    <span class="text-text-heading text-sm font-medium">
+      {{ t("settings.orgDomainMapping.recordInstructions") }}
+    </span>
+    <div class="flex flex-col gap-1">
+      <span class="text-text-label text-2xs font-medium">
+        {{ t("settings.orgDomainMapping.txtNameLabel") }}
+      </span>
+      <div class="flex min-w-0 items-center gap-1">
+        <OCode truncate class="min-w-0">{{ raw(txtName) }}</OCode>
+        <OButton
+          variant="ghost"
+          size="icon-xs"
+          icon-left="content-copy"
+          :data-test="`settings-org-domain-copy-txt-name-${domain.domain}`"
+          @click="copy(txtName, t('settings.orgDomainMapping.txtNameCopied'))"
+        >
+          <OTooltip side="bottom" :content="t('settings.orgDomainMapping.copyTxtName')" />
+        </OButton>
+      </div>
+    </div>
+    <div class="flex flex-col gap-1">
+      <span class="text-text-label text-2xs font-medium">
+        {{ t("settings.orgDomainMapping.txtValueLabel") }}
+      </span>
+      <div class="flex min-w-0 items-center gap-1">
+        <OCode truncate class="min-w-0">{{ raw(domain.verification_token) }}</OCode>
+        <OButton
+          variant="ghost"
+          size="icon-xs"
+          icon-left="content-copy"
+          :data-test="`settings-org-domain-copy-txt-value-${domain.domain}`"
+          @click="copy(domain.verification_token, t('settings.orgDomainMapping.txtValueCopied'))"
+        >
+          <OTooltip side="bottom" :content="t('settings.orgDomainMapping.copyTxtValue')" />
+        </OButton>
+      </div>
+    </div>
+    <span class="text-text-secondary text-xs">
+      {{
+        domain.verification_state === 1
+          ? t("settings.orgDomainMapping.keepRecordHint", {
+              minutes: VERIFY_INTERVAL_MINUTES,
+              grace: FAILURE_GRACE_MINUTES,
+            })
+          : t("settings.orgDomainMapping.verifyHint", { minutes: VERIFY_INTERVAL_MINUTES })
+      }}
+    </span>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OCode from "@/lib/core/Code/OCode.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { copyToClipboard } from "@/utils/clipboard";
+import type { OrgDomainOwnership } from "@/services/organizations";
+
+const props = defineProps<{ domain: OrgDomainOwnership }>();
+
+const { t } = useI18nTyped();
+
+// Mirrors ORG_DOMAIN_OWNERSHIP_CHECK_INTERVAL in the cloud jobs; no endpoint exposes it.
+const VERIFY_INTERVAL_MINUTES = 5;
+// Mirrors DOMAIN_EXPIRY_BUFFER_SEC in core/org_domain_ownership.rs.
+const FAILURE_GRACE_MINUTES = 30;
+
+const txtName = computed(() => `_o2-verify.${props.domain.domain}`);
+
+function copy(value: string, successMessage: I18nText) {
+  copyToClipboard(value, t, { successMessage });
+}
+</script>
diff --git a/web/src/components/settings/OrgLinkDomainDialog.vue b/web/src/components/settings/OrgLinkDomainDialog.vue
new file mode 100644
index 0000000000..3d6cd40985
--- /dev/null
+++ b/web/src/components/settings/OrgLinkDomainDialog.vue
@@ -0,0 +1,144 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <ODialog
+    data-test="settings-org-link-domain-dialog"
+    v-model:open="dialogOpen"
+    persistent
+    size="md"
+    :form-id="FORM_ID"
+    :title="t('settings.orgDomainMapping.linkDomain')"
+    :secondary-button-label="t('common.cancel')"
+    :primary-button-label="
+      method === 'request'
+        ? t('settings.orgDomainMapping.sendRequest')
+        : t('settings.orgDomainMapping.linkDomain')
+    "
+    @click:secondary="dialogOpen = false"
+  >
+    <OForm :id="FORM_ID" :form="form" class="flex flex-col gap-5">
+      <OFormInput
+        data-test="settings-org-link-domain-input"
+        name="domain"
+        :label="t('settings.orgDomainMapping.domain')"
+        required
+        :placeholder="t('settings.domainPlaceholder', { example: raw('example.com') })"
+        :help-text="
+          method === 'request'
+            ? t('settings.orgDomainMapping.domainHelpRequest', { at_sign: '@' })
+            : t('settings.orgDomainMapping.domainHelp', { at_sign: '@' })
+        "
+      />
+
+      <div class="flex flex-col gap-2">
+        <div class="text-sm font-medium">{{ t("settings.orgDomainMapping.linkMethod") }}</div>
+        <OFormRadioGroup
+          name="method"
+          class="grid grid-cols-1 gap-3"
+          :label="t('settings.orgDomainMapping.linkMethod')"
+          orientation="vertical"
+        >
+          <ORadio value="dns" variant="card" data-test="settings-org-link-domain-method-dns">
+            <template #label>
+              <span class="flex flex-col gap-1">
+                <span>{{ t("settings.orgDomainMapping.method.dnsTitle") }}</span>
+                <span class="text-text-secondary text-xs font-normal">
+                  {{ t("settings.orgDomainMapping.method.dnsDesc") }}
+                </span>
+              </span>
+            </template>
+          </ORadio>
+          <ORadio
+            value="request"
+            variant="card"
+            data-test="settings-org-link-domain-method-request"
+          >
+            <template #label>
+              <span class="flex flex-col gap-1">
+                <span>{{ t("settings.orgDomainMapping.method.requestTitle") }}</span>
+                <span class="text-text-secondary text-xs font-normal">
+                  {{ t("settings.orgDomainMapping.method.requestDesc") }}
+                </span>
+              </span>
+            </template>
+          </ORadio>
+        </OFormRadioGroup>
+      </div>
+    </OForm>
+  </ODialog>
+</template>
+
+<script setup lang="ts">
+import { computed, watch } from "vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
+import OForm from "@/lib/forms/Form/OForm.vue";
+import OFormInput from "@/lib/forms/Input/OFormInput.vue";
+import OFormRadioGroup from "@/lib/forms/Radio/OFormRadioGroup.vue";
+import ORadio from "@/lib/forms/Radio/ORadio.vue";
+import { useOForm } from "@/lib/forms/Form/useOForm";
+import {
+  linkDomainDefaults,
+  makeLinkDomainSchema,
+  type LinkDomainForm,
+  type LinkMethod,
+} from "./OrgDomainMapping.schema";
+
+const FORM_ID = "org-link-domain-form";
+
+const props = withDefaults(
+  defineProps<{
+    open: boolean;
+    initialMethod?: LinkMethod;
+    /** Resolves true once the link or request is saved; the dialog stays open on false. */
+    submit: (_domain: string, _method: LinkMethod) => Promise<boolean>;
+  }>(),
+  { initialMethod: "dns" },
+);
+
+const emit = defineEmits<{
+  (_e: "update:open", _value: boolean): void;
+}>();
+
+const { t } = useI18nTyped();
+
+const dialogOpen = computed({
+  get: () => props.open,
+  set: (value: boolean) => emit("update:open", value),
+});
+
+const form = useOForm<LinkDomainForm>({
+  defaultValues: linkDomainDefaults(),
+  schema: makeLinkDomainSchema(t),
+  onSubmit,
+});
+
+const method = form.useStore((s) => s.values.method);
+
+// The form outlives the dialog body, so it is re-seeded on every open.
+watch(
+  () => props.open,
+  (visible) => {
+    if (visible) form.reset({ ...linkDomainDefaults(), method: props.initialMethod });
+  },
+);
+
+async function onSubmit(value: LinkDomainForm) {
+  const saved = await props.submit(value.domain.trim().toLowerCase(), value.method);
+  if (saved) emit("update:open", false);
+}
+</script>
diff --git a/web/src/components/settings/OrgLinkedDomains.spec.ts b/web/src/components/settings/OrgLinkedDomains.spec.ts
new file mode 100644
index 0000000000..5526a18ed4
--- /dev/null
+++ b/web/src/components/settings/OrgLinkedDomains.spec.ts
@@ -0,0 +1,373 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { flushPromises, mount } from "@vue/test-utils";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { defineComponent } from "vue";
+import i18n from "@/locales";
+import { withQueryClient } from "@/test/unit/helpers/queryClient";
+import type { OrgDomainMapping } from "@/services/organizations";
+import OrgLinkedDomains from "./OrgLinkedDomains.vue";
+
+const { mockToast, mockConfirm } = vi.hoisted(() => ({
+  mockToast: vi.fn(),
+  mockConfirm: vi.fn(),
+}));
+
+vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: mockToast }));
+vi.mock("@/composables/useConfirmDialog", () => ({
+  useConfirmDialog: () => ({ confirm: mockConfirm }),
+}));
+vi.mock("@/services/organizations", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: {
+      list_org_domains: vi.fn(),
+      list_org_domain_requests: vi.fn(),
+      link_org_domain: vi.fn(),
+      raise_org_domain_request: vi.fn(),
+      unlink_org_domain: vi.fn(),
+      verify_org_domain: vi.fn(),
+      post_organization_settings: vi.fn(),
+    },
+  });
+});
+
+import organizations from "@/services/organizations";
+const api = organizations as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const DialogStub = defineComponent({
+  name: "OrgLinkDomainDialog",
+  props: ["open", "initialMethod", "submit"],
+  template: "<div />",
+});
+
+const DetailsDialogStub = defineComponent({
+  name: "OrgDomainDetailsDialog",
+  props: ["open", "domain", "link", "request", "failureReason", "verifying"],
+  emits: ["update:open", "verify"],
+  template: "<div />",
+});
+
+const link = (domain: string, state = 1, metaMapped = false) => ({
+  id: domain,
+  org_id: "acme",
+  domain,
+  verification_token: "o2v_token",
+  verification_state: state,
+  verification_failure_reason: null,
+  verified_at: null,
+  last_checked_at: null,
+  created_at: 0,
+  updated_at: 0,
+  meta_mapped: metaMapped,
+});
+
+const request = (domain: string, status: number, orgId = "acme") => ({
+  id: `req-${domain}`,
+  org_id: orgId,
+  domain,
+  created_at: 0,
+  updated_at: 0,
+  requested_by: "a@acme.com",
+  answered_by: null,
+  status,
+  reason: status === 2 ? "not yours" : null,
+});
+
+const mapping = (domain: string, orgId = "acme"): OrgDomainMapping => ({
+  domain,
+  org_id: orgId,
+  base_role: "allowed_user",
+  role_claim_name: null,
+  create_missing_roles: false,
+});
+
+// Covers OTable's 50ms skeleton hold, which otherwise hides rows that already landed.
+const settle = async () => {
+  for (let i = 0; i < 8; i++) {
+    await new Promise((r) => setTimeout(r, 10));
+    await flushPromises();
+  }
+};
+
+const mountList = async (mappings: OrgDomainMapping[] = [], settingsReady = true) => {
+  const wrapper = mount(OrgLinkedDomains, {
+    props: { orgId: "acme", mappings, settingsReady },
+    global: {
+      plugins: [i18n, withQueryClient()],
+      stubs: {
+        OrgLinkDomainDialog: DialogStub,
+        OrgDomainDetailsDialog: DetailsDialogStub,
+        OTooltip: true,
+      },
+    },
+  });
+  await settle();
+  return wrapper;
+};
+
+type ListWrapper = Awaited<ReturnType<typeof mountList>>;
+
+const submitFrom = (wrapper: ListWrapper) =>
+  wrapper.findComponent(DialogStub).props("submit") as (
+    _domain: string,
+    _method: "dns" | "request",
+  ) => Promise<boolean>;
+
+const exists = (wrapper: ListWrapper, dataTest: string) =>
+  wrapper.find(`[data-test="${dataTest}"]`).exists();
+
+describe("OrgLinkedDomains", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    api.list_org_domains.mockResolvedValue({
+      data: [link("acme.com"), link("pending.com", 0), link("granted.com", 1, true)],
+    });
+    api.list_org_domain_requests.mockResolvedValue({
+      data: [
+        request("asked.com", 0),
+        request("denied.com", 2),
+        request("granted.com", 1),
+        request("other.com", 0, "someone-else"),
+      ],
+    });
+    api.link_org_domain.mockResolvedValue({ data: {} });
+    api.raise_org_domain_request.mockResolvedValue({ data: {} });
+    api.unlink_org_domain.mockResolvedValue({ data: {} });
+    api.post_organization_settings.mockResolvedValue({ data: {} });
+    mockConfirm.mockResolvedValue(true);
+  });
+
+  it("lists links and this org's open or rejected requests", async () => {
+    const wrapper = await mountList();
+
+    for (const domain of ["acme.com", "pending.com", "granted.com", "asked.com", "denied.com"]) {
+      expect(exists(wrapper, `settings-org-linked-domains-state-${domain}`)).toBe(true);
+    }
+    expect(exists(wrapper, "settings-org-linked-domains-state-other.com")).toBe(false);
+    expect(
+      wrapper.findAll('[data-test="settings-org-linked-domains-state-granted.com"]'),
+    ).toHaveLength(1);
+  });
+
+  it("offers Details on every row and Remove on links only", async () => {
+    const wrapper = await mountList();
+
+    for (const domain of ["acme.com", "pending.com", "granted.com", "asked.com", "denied.com"]) {
+      expect(exists(wrapper, `settings-org-linked-domains-details-${domain}`)).toBe(true);
+    }
+    expect(exists(wrapper, "settings-org-linked-domains-remove-granted.com")).toBe(true);
+    expect(exists(wrapper, "settings-org-linked-domains-remove-asked.com")).toBe(false);
+  });
+
+  it("passes the approving request with an approved link, and the request itself for request rows", async () => {
+    const wrapper = await mountList();
+    const dialog = () => wrapper.findComponent(DetailsDialogStub);
+    const open = async (domain: string) =>
+      wrapper.find(`[data-test="settings-org-linked-domains-details-${domain}"]`).trigger("click");
+
+    await open("granted.com");
+    expect(dialog().props("link").domain).toBe("granted.com");
+    expect(dialog().props("request").id).toBe("req-granted.com");
+
+    await open("denied.com");
+    expect(dialog().props("link")).toBeNull();
+    expect(dialog().props("request").status).toBe(2);
+  });
+
+  it("opens the record dialog from the row and verifies from it", async () => {
+    api.verify_org_domain.mockResolvedValue({ data: { verification_state: 0 } });
+    const wrapper = await mountList();
+    const dialog = () => wrapper.findComponent(DetailsDialogStub);
+
+    expect(dialog().props("open")).toBe(false);
+    await wrapper
+      .find('[data-test="settings-org-linked-domains-details-pending.com"]')
+      .trigger("click");
+    expect(dialog().props("open")).toBe(true);
+    expect(dialog().props("link").domain).toBe("pending.com");
+
+    dialog().vm.$emit("verify");
+    await settle();
+    expect(api.verify_org_domain).toHaveBeenCalledWith("acme", "pending.com");
+    expect(dialog().props("open")).toBe(true);
+  });
+
+  it("opens the record dialog once a new DNS link arrives", async () => {
+    const wrapper = await mountList();
+    api.list_org_domains.mockResolvedValue({
+      data: [
+        link("acme.com"),
+        link("pending.com", 0),
+        link("granted.com", 1, true),
+        link("new.com", 0),
+      ],
+    });
+
+    await expect(submitFrom(wrapper)("new.com", "dns")).resolves.toBe(true);
+    // The app refetches through mutation meta.invalidates; the test client has no such hook.
+    await wrapper.find('[data-test="settings-org-linked-domains-refresh-btn"]').trigger("click");
+    await settle();
+
+    const dialog = wrapper.findComponent(DetailsDialogStub);
+    expect(dialog.props("open")).toBe(true);
+    expect(dialog.props("link").domain).toBe("new.com");
+  });
+
+  it("explains a failed check and a rejection in the status tooltip, and no row expands", async () => {
+    api.list_org_domains.mockResolvedValue({
+      data: [
+        { ...link("broken.com", 2), verification_failure_reason: 1 },
+        link("pending.com", 0),
+        link("granted.com", 1, true),
+      ],
+    });
+    const wrapper = await mountList();
+    const reason = (domain: string) =>
+      wrapper.find(`[data-test="settings-org-linked-domains-state-reason-${domain}"]`);
+
+    expect(reason("broken.com").attributes("content")).toBe(
+      "TXT record found, but the value doesn't match",
+    );
+    expect(reason("denied.com").attributes("content")).toBe("not yours");
+    expect(reason("pending.com").exists()).toBe(false);
+
+    expect(wrapper.find('[data-test="o2-table-expand-cell"]').exists()).toBe(false);
+  });
+
+  it("keeps Details and Remove in the same slots on every row", async () => {
+    const wrapper = await mountList();
+    const slotOf = (domain: string) => {
+      const remove = wrapper.find(`[data-test="settings-org-linked-domains-remove-${domain}"]`);
+      return [...remove.element.parentElement!.children].indexOf(remove.element);
+    };
+
+    expect(slotOf("acme.com")).toBe(slotOf("pending.com"));
+    expect(slotOf("granted.com")).toBe(slotOf("pending.com"));
+
+    // A request row has no Remove, so a placeholder keeps the same number of slots.
+    const slotsOf = (domain: string) =>
+      wrapper.find(`[data-test="settings-org-linked-domains-details-${domain}"]`).element
+        .parentElement!.children.length;
+    expect(slotsOf("asked.com")).toBe(slotsOf("acme.com"));
+  });
+
+  it("links through DNS or raises a request depending on the method", async () => {
+    const wrapper = await mountList();
+
+    await expect(submitFrom(wrapper)("new.com", "dns")).resolves.toBe(true);
+    expect(api.link_org_domain).toHaveBeenCalledWith("acme", "new.com");
+    expect(api.raise_org_domain_request).not.toHaveBeenCalled();
+
+    await expect(submitFrom(wrapper)("ask.com", "request")).resolves.toBe(true);
+    expect(api.raise_org_domain_request).toHaveBeenCalledWith("acme", "ask.com");
+  });
+
+  it("refuses a second DNS link for a domain this org already linked", async () => {
+    const wrapper = await mountList();
+
+    await expect(submitFrom(wrapper)("pending.com", "dns")).resolves.toBe(false);
+    expect(api.link_org_domain).not.toHaveBeenCalled();
+    expect(mockToast).toHaveBeenCalledWith(expect.objectContaining({ variant: "error" }));
+  });
+
+  it("still allows a link request for a domain pending DNS verification", async () => {
+    const wrapper = await mountList();
+
+    await expect(submitFrom(wrapper)("pending.com", "request")).resolves.toBe(true);
+    expect(api.raise_org_domain_request).toHaveBeenCalledWith("acme", "pending.com");
+  });
+
+  it("keeps the dialog open when linking fails", async () => {
+    api.link_org_domain.mockRejectedValue({ response: { data: { message: "taken" } } });
+    const wrapper = await mountList();
+
+    await expect(submitFrom(wrapper)("new.com", "dns")).resolves.toBe(false);
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({ variant: "error", message: "taken" }),
+    );
+  });
+
+  it("removes the domain's mappings before unlinking it", async () => {
+    const wrapper = await mountList([
+      mapping("acme.com"),
+      mapping("acme.com", "child"),
+      mapping("x.com"),
+    ]);
+
+    await wrapper
+      .find('[data-test="settings-org-linked-domains-remove-acme.com"]')
+      .trigger("click");
+    await flushPromises();
+
+    expect(api.post_organization_settings).toHaveBeenCalledWith("acme", {
+      domain_org_mappings: [mapping("x.com")],
+    });
+    expect(api.unlink_org_domain).toHaveBeenCalledWith("acme", "acme.com");
+    expect(api.post_organization_settings.mock.invocationCallOrder[0]).toBeLessThan(
+      api.unlink_org_domain.mock.invocationCallOrder[0],
+    );
+  });
+
+  it("keeps the link when removing its mappings fails", async () => {
+    api.post_organization_settings.mockRejectedValue(new Error("boom"));
+    const wrapper = await mountList([mapping("acme.com")]);
+
+    await wrapper
+      .find('[data-test="settings-org-linked-domains-remove-acme.com"]')
+      .trigger("click");
+    await flushPromises();
+
+    expect(api.unlink_org_domain).not.toHaveBeenCalled();
+  });
+
+  it("unlinks without touching settings when nothing is mapped", async () => {
+    const wrapper = await mountList([mapping("x.com")]);
+
+    await wrapper
+      .find('[data-test="settings-org-linked-domains-remove-acme.com"]')
+      .trigger("click");
+    await flushPromises();
+
+    expect(api.post_organization_settings).not.toHaveBeenCalled();
+    expect(api.unlink_org_domain).toHaveBeenCalledWith("acme", "acme.com");
+  });
+
+  it("does nothing when the removal is not confirmed", async () => {
+    mockConfirm.mockResolvedValue(false);
+    const wrapper = await mountList([mapping("acme.com")]);
+
+    await wrapper
+      .find('[data-test="settings-org-linked-domains-remove-acme.com"]')
+      .trigger("click");
+    await flushPromises();
+
+    expect(api.post_organization_settings).not.toHaveBeenCalled();
+    expect(api.unlink_org_domain).not.toHaveBeenCalled();
+  });
+
+  it("blocks removal until org settings have loaded", async () => {
+    const wrapper = await mountList([], false);
+
+    const remove = wrapper.find('[data-test="settings-org-linked-domains-remove-acme.com"]');
+    expect(remove.attributes("disabled")).toBeDefined();
+    await remove.trigger("click");
+    await flushPromises();
+
+    expect(mockConfirm).not.toHaveBeenCalled();
+    expect(api.unlink_org_domain).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/components/settings/OrgLinkedDomains.vue b/web/src/components/settings/OrgLinkedDomains.vue
new file mode 100644
index 0000000000..2b68bc077f
--- /dev/null
+++ b/web/src/components/settings/OrgLinkedDomains.vue
@@ -0,0 +1,498 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div
+    class="bg-card-glass-bg h-full min-h-0 overflow-hidden"
+    data-test="settings-org-linked-domains"
+  >
+    <OTable
+      :frame="false"
+      data-test="settings-org-linked-domains-table"
+      :data="visibleRows"
+      :columns="columns"
+      row-key="id"
+      pagination="client"
+      sorting="client"
+      :show-global-filter="false"
+      :loading="loading"
+      :error="loadError"
+    >
+      <template #toolbar>
+        <OSearchInput
+          v-model="filterQuery"
+          class="min-w-0 flex-1 max-md:min-w-40"
+          :placeholder="t('settings.orgDomainMapping.searchDomains')"
+          data-test="settings-org-linked-domains-search"
+        />
+      </template>
+      <template #toolbar-trailing>
+        <ORefreshButton
+          layout="inline"
+          variant="outline"
+          :last-run-at="domains.dataUpdatedAt.value || null"
+          :loading="domains.isFetching.value || requests.isFetching.value"
+          data-test="settings-org-linked-domains-refresh-btn"
+          @click="refresh"
+        />
+      </template>
+      <template #empty>
+        <OEmptyState
+          v-if="!loading"
+          size="hero"
+          preset="no-linked-domains"
+          :filtered="filterQuery !== ''"
+          @action="onEmptyAction"
+        />
+      </template>
+      <template #error="{ message }">
+        <OEmptyState preset="load-error" :description="raw(message)" @action="refresh" />
+      </template>
+
+      <template #cell-state="{ row }">
+        <span class="relative inline-flex">
+          <OBadge
+            :variant="STATE_BADGES[row.state].variant"
+            size="sm"
+            :data-test="`settings-org-linked-domains-state-${row.domain}`"
+          >
+            {{ t(STATE_BADGES[row.state].labelKey) }}
+          </OBadge>
+          <OTooltip
+            v-if="stateReason(row)"
+            :max-width="'25rem'"
+            :content="stateReason(row)!"
+            :data-test="`settings-org-linked-domains-state-reason-${row.domain}`"
+          />
+        </span>
+      </template>
+      <template #cell-method="{ row }">
+        {{ t(METHOD_KEYS[row.method]) }}
+      </template>
+      <template #cell-updated="{ row }">
+        <OTimeCell :value="row.updated" unit="us" />
+      </template>
+      <template #cell-actions="{ row }">
+        <div class="flex items-center justify-center gap-1">
+          <OButton
+            variant="ghost"
+            size="icon-sm"
+            icon-left="info"
+            class="max-md:hidden"
+            :title="t('settings.orgDomainMapping.details')"
+            :data-test="`settings-org-linked-domains-details-${row.domain}`"
+            @click.stop="openDetails(row)"
+          />
+          <OButton
+            v-if="row.link"
+            variant="ghost-destructive"
+            size="icon-sm"
+            icon-left="delete"
+            class="max-md:hidden"
+            :disabled="!settingsReady"
+            :title="t('settings.orgDomainMapping.removeDomain')"
+            :data-test="`settings-org-linked-domains-remove-${row.domain}`"
+            @click.stop="remove(row)"
+          />
+          <!-- Holds the Remove slot on request rows so Details stays in the same column. -->
+          <span v-else class="h-8 w-8 shrink-0 max-md:hidden" aria-hidden="true" />
+          <ODropdown side="bottom" align="end">
+            <template #trigger>
+              <OButton
+                icon-left="more-vert"
+                variant="ghost"
+                size="icon-xs-sq"
+                class="md:hidden"
+                :data-test="`settings-org-linked-domains-more-${row.domain}`"
+                @click.stop
+              />
+            </template>
+            <ODropdownItem
+              icon-left="info"
+              class="md:hidden"
+              :data-test="`settings-org-linked-domains-details-${row.domain}-menu`"
+              @select="openDetails(row)"
+            >
+              <span>{{ t("settings.orgDomainMapping.details") }}</span>
+            </ODropdownItem>
+            <ODropdownItem
+              v-if="row.link"
+              icon-left="delete"
+              variant="destructive"
+              class="md:hidden"
+              :disabled="!settingsReady"
+              :data-test="`settings-org-linked-domains-remove-${row.domain}-menu`"
+              @select="remove(row)"
+            >
+              <span>{{ t("settings.orgDomainMapping.removeDomain") }}</span>
+            </ODropdownItem>
+          </ODropdown>
+        </div>
+      </template>
+    </OTable>
+
+    <OrgLinkDomainDialog
+      v-model:open="linkDialogOpen"
+      :initial-method="linkDialogMethod"
+      :submit="submitLink"
+    />
+
+    <OrgDomainDetailsDialog
+      v-model:open="detailsOpen"
+      :domain="detailsRow?.domain ?? ''"
+      :link="detailsRow?.link ?? null"
+      :request="detailsRow?.request ?? null"
+      :failure-reason="detailsRow?.link ? failureReason(detailsRow.link) : null"
+      :verifying="verifyingDomain !== null"
+      @verify="detailsRow?.link && verify(detailsRow.link.domain)"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { useMutation, useQuery } from "@tanstack/vue-query";
+import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
+import OBadge from "@/lib/core/Badge/OBadge.vue";
+import type { BadgeVariant } from "@/lib/core/Badge/OBadge.types";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import { COL, type OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
+import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
+import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import { useConfirmDialog } from "@/composables/useConfirmDialog";
+import type {
+  OrgDomainMapping,
+  OrgDomainOwnership,
+  OrgDomainRequest,
+} from "@/services/organizations";
+import {
+  linkOrgDomainMutation,
+  orgDomainRequestsQuery,
+  orgDomainsQuery,
+  raiseOrgDomainRequestMutation,
+  unlinkOrgDomainMutation,
+  updateOrgSettingsMutation,
+  verifyOrgDomainMutation,
+} from "@/services/organizations.queries";
+import OrgDomainDetailsDialog from "./OrgDomainDetailsDialog.vue";
+import OrgLinkDomainDialog from "./OrgLinkDomainDialog.vue";
+import type { LinkMethod } from "./OrgDomainMapping.schema";
+
+type RowState = "verified" | "pending" | "failed" | "requested" | "rejected";
+type RowMethod = "dns" | "approved" | "request";
+
+interface LinkedDomainRow {
+  id: string;
+  domain: string;
+  state: RowState;
+  method: RowMethod;
+  updated: number | null;
+  link: OrgDomainOwnership | null;
+  request: OrgDomainRequest | null;
+}
+
+const props = defineProps<{
+  orgId: string;
+  mappings: OrgDomainMapping[];
+  /** False until org settings load, when `mappings` cannot yet be trusted to be complete. */
+  settingsReady: boolean;
+}>();
+
+const { t } = useI18nTyped();
+const { confirm } = useConfirmDialog();
+
+const FAILURE_REASON_KEYS: Record<number, I18nKey> = {
+  0: "settings.orgDomainMapping.failureReason.recordMissing",
+  1: "settings.orgDomainMapping.failureReason.valueMismatch",
+  2: "settings.orgDomainMapping.failureReason.dnsFailed",
+};
+
+const STATE_BADGES: Record<RowState, { variant: BadgeVariant; labelKey: I18nKey }> = {
+  verified: { variant: "success-outline", labelKey: "settings.orgDomainMapping.state.verified" },
+  pending: { variant: "default-outline", labelKey: "settings.orgDomainMapping.state.pending" },
+  failed: { variant: "error-outline", labelKey: "settings.orgDomainMapping.state.failed" },
+  requested: { variant: "warning-outline", labelKey: "settings.orgDomainMapping.state.requested" },
+  rejected: { variant: "error-outline", labelKey: "settings.orgDomainMapping.state.rejected" },
+};
+
+const METHOD_KEYS: Record<RowMethod, I18nKey> = {
+  dns: "settings.orgDomainMapping.method.dns",
+  approved: "settings.orgDomainMapping.method.approved",
+  request: "settings.orgDomainMapping.method.request",
+};
+
+const LINK_STATES: Record<number, RowState> = { 0: "pending", 1: "verified", 2: "failed" };
+
+const domains = useQuery(() => orgDomainsQuery(props.orgId));
+const requests = useQuery(() => orgDomainRequestsQuery(props.orgId));
+const linkDomain = useMutation(() => linkOrgDomainMutation(props.orgId));
+const raiseRequest = useMutation(() => raiseOrgDomainRequestMutation(props.orgId));
+const unlinkDomain = useMutation(() => unlinkOrgDomainMutation(props.orgId));
+const verifyDomain = useMutation(() => verifyOrgDomainMutation(props.orgId));
+const updateSettings = useMutation(() => updateOrgSettingsMutation(props.orgId));
+
+const loading = computed(() => domains.isPending.value || requests.isPending.value);
+const loadError = computed(() => {
+  const err: any = domains.error.value ?? requests.error.value;
+  if (!err) return null;
+  return err?.response?.data?.message || err?.message || t("settings.orgDomainMapping.loadFailed");
+});
+
+// An approved request becomes a link, so only open and rejected requests are listed beside the links.
+const rows = computed<LinkedDomainRow[]>(() => {
+  const ownRequests = (requests.data.value ?? []).filter((r) => r.org_id === props.orgId);
+  // An approved link keeps its request, so Details can say who asked and why it was approved.
+  const approvedRequest = (domain: string) =>
+    ownRequests
+      .filter((r) => r.status === 1 && r.domain === domain)
+      .sort((a, b) => b.updated_at - a.updated_at)[0] ?? null;
+  const result: LinkedDomainRow[] = (domains.data.value ?? []).map((link) => ({
+    id: `link-${link.id}`,
+    domain: link.domain,
+    state: LINK_STATES[link.verification_state] ?? "pending",
+    method: link.meta_mapped ? "approved" : "dns",
+    updated: link.last_checked_at ?? link.updated_at,
+    link,
+    request: link.meta_mapped ? approvedRequest(link.domain) : null,
+  }));
+  for (const request of ownRequests) {
+    if (request.status === 1) continue;
+    result.push({
+      id: `request-${request.id}`,
+      domain: request.domain,
+      state: request.status === 2 ? "rejected" : "requested",
+      method: "request",
+      updated: request.updated_at,
+      link: null,
+      request,
+    });
+  }
+  return result;
+});
+
+const filterQuery = ref("");
+const visibleRows = computed(() => {
+  const query = filterQuery.value.trim().toLowerCase();
+  return query ? rows.value.filter((row) => row.domain.includes(query)) : rows.value;
+});
+
+const columns: OTableColumnDef<LinkedDomainRow>[] = [
+  {
+    id: "domain",
+    header: t("settings.orgDomainMapping.domain"),
+    accessorKey: "domain",
+    sortable: true,
+    size: 320,
+    meta: { isName: true, flex: true },
+  },
+  {
+    id: "state",
+    header: t("settings.orgDomainMapping.status"),
+    accessorKey: "state",
+    sortable: true,
+    size: 160,
+  },
+  {
+    id: "method",
+    header: t("settings.orgDomainMapping.linkedVia"),
+    accessorKey: "method",
+    size: 200,
+  },
+  {
+    id: "updated",
+    header: t("settings.orgDomainMapping.lastChecked"),
+    accessorKey: "updated",
+    sortable: true,
+    size: COL.updatedAt,
+  },
+  {
+    id: "actions",
+    header: t("common.actions"),
+    isAction: true,
+    pinned: "right",
+    meta: { align: "center", actionCount: 2 },
+  },
+];
+
+const failureReason = (link: OrgDomainOwnership): I18nText | null =>
+  link.verification_state === 2 && link.verification_failure_reason != null
+    ? t(FAILURE_REASON_KEYS[link.verification_failure_reason])
+    : null;
+
+const stateReason = (row: LinkedDomainRow): I18nText | null => {
+  if (row.link) return failureReason(row.link);
+  if (row.state === "rejected" && row.request?.reason) return raw(row.request.reason);
+  return null;
+};
+
+// The dialog reads the live row by id, so it shows the new state after Verify now refetches.
+const detailsRowId = ref<string | null>(null);
+const detailsRow = computed(() => rows.value.find((row) => row.id === detailsRowId.value) ?? null);
+const detailsOpen = computed({
+  get: () => detailsRowId.value !== null,
+  set: (open: boolean) => {
+    if (!open) detailsRowId.value = null;
+  },
+});
+
+function openDetails(row: LinkedDomainRow) {
+  detailsRowId.value = row.id;
+}
+
+// Set after a DNS link so the record opens once the new link arrives.
+const openOnArrival = ref<string | null>(null);
+
+function openArrivedRecord() {
+  if (!openOnArrival.value) return;
+  const row = rows.value.find((r) => r.link && r.domain === openOnArrival.value);
+  if (!row) return;
+  openDetails(row);
+  openOnArrival.value = null;
+}
+
+watch(rows, openArrivedRecord);
+
+const errorMessage = (err: any) => raw(err?.response?.data?.message || err?.message);
+
+function refresh() {
+  domains.refetch();
+  requests.refetch();
+}
+
+const linkDialogOpen = ref(false);
+const linkDialogMethod = ref<LinkMethod>("dns");
+
+function openLink(method: LinkMethod = "dns") {
+  linkDialogMethod.value = method;
+  linkDialogOpen.value = true;
+}
+
+function onEmptyAction(id?: string) {
+  if (id === "clear-filters") filterQuery.value = "";
+  else openLink(id === "request" ? "request" : "dns");
+}
+
+async function submitLink(domain: string, method: LinkMethod): Promise<boolean> {
+  if (method === "request") {
+    try {
+      await raiseRequest.mutateAsync(domain);
+    } catch (err) {
+      toast({
+        variant: "error",
+        message: errorMessage(err) || t("settings.orgDomainMapping.requestFailed"),
+      });
+      return false;
+    }
+    toast({ variant: "success", message: t("settings.orgDomainMapping.requestSent") });
+    return true;
+  }
+
+  // The backend inserts a second row with a new token rather than rejecting a repeat link.
+  if ((domains.data.value ?? []).some((link) => link.domain.toLowerCase() === domain)) {
+    toast({ variant: "error", message: t("settings.orgDomainMapping.alreadyLinked") });
+    return false;
+  }
+
+  try {
+    await linkDomain.mutateAsync(domain);
+  } catch (err) {
+    toast({
+      variant: "error",
+      message: errorMessage(err) || t("settings.orgDomainMapping.linkFailed"),
+    });
+    return false;
+  }
+  openOnArrival.value = domain;
+  openArrivedRecord();
+  toast({ variant: "success", message: t("settings.orgDomainMapping.linked") });
+  return true;
+}
+
+const verifyingDomain = ref<string | null>(null);
+
+async function verify(domain: string) {
+  verifyingDomain.value = domain;
+  try {
+    const res = await verifyDomain.mutateAsync(domain);
+    if (res?.data?.verification_state === 1) {
+      toast({ variant: "success", message: t("settings.orgDomainMapping.verified") });
+    } else {
+      toast({ variant: "warning", message: t("settings.orgDomainMapping.notVerifiedYet") });
+    }
+  } catch (err) {
+    toast({
+      variant: "error",
+      message: errorMessage(err) || t("settings.orgDomainMapping.verifyFailed"),
+    });
+    // A failed check still records its failure reason server-side, and error paths skip invalidation.
+    await domains.refetch();
+  } finally {
+    verifyingDomain.value = null;
+  }
+}
+
+async function remove(row: LinkedDomainRow) {
+  // Without the real mappings, the unlink would leave the domain's mappings behind and block every later mapping save.
+  if (!props.settingsReady) return;
+  const remaining = props.mappings.filter((m) => m.domain.toLowerCase() !== row.domain);
+  const mappedCount = props.mappings.length - remaining.length;
+  const ok = await confirm({
+    title: t("settings.orgDomainMapping.removeTitle"),
+    message:
+      mappedCount > 0
+        ? t(
+            "settings.orgDomainMapping.removeWithMappingsBody",
+            { domain: row.domain, count: mappedCount },
+            mappedCount,
+          )
+        : t("settings.orgDomainMapping.removeBody", { domain: row.domain }),
+    confirmLabel: t("settings.orgDomainMapping.removeDomain"),
+  });
+  if (!ok) return;
+
+  // The settings endpoint rejects every mapping save while one points at an unlinked domain, so mappings go first.
+  if (mappedCount > 0) {
+    try {
+      await updateSettings.mutateAsync({ domain_org_mappings: remaining });
+    } catch (err) {
+      toast({
+        variant: "error",
+        message: errorMessage(err) || t("settings.orgDomainMapping.saveFailed"),
+      });
+      return;
+    }
+  }
+  try {
+    await unlinkDomain.mutateAsync(row.domain);
+  } catch (err) {
+    toast({
+      variant: "error",
+      message: errorMessage(err) || t("settings.orgDomainMapping.unlinkFailed"),
+    });
+    return;
+  }
+  toast({ variant: "success", message: t("settings.orgDomainMapping.removed") });
+}
+
+defineExpose({ openLink });
+</script>
diff --git a/web/src/components/settings/OrganizationSettings.vue b/web/src/components/settings/OrganizationSettings.vue
index 2d350ca29d..3119393d1b 100644
--- a/web/src/components/settings/OrganizationSettings.vue
+++ b/web/src/components/settings/OrganizationSettings.vue
@@ -109,12 +109,6 @@
         />
       </template>
 
-      <!-- Domain -> organization mappings: cloud-only, and stored on the meta org. -->
-      <template v-if="showDomainOrgMappings">
-        <OSeparator class="mt-6 mb-4" />
-        <DomainOrgMappings v-model="domainOrgMappings" @change="formDirty = true" />
-      </template>
-
       <div class="mt-3 flex gap-2">
         <!-- <OButton
         data-test="add-alert-cancel-btn"
@@ -143,9 +137,6 @@ import { useMutation } from "@tanstack/vue-query";
 import { useOrgId } from "@/composables/query";
 import { useStore } from "vuex";
 import CrossLinkManager from "@/components/cross-linking/CrossLinkManager.vue";
-import DomainOrgMappings from "./DomainOrgMappings.vue";
-import useIsMetaOrg from "@/composables/useIsMetaOrg";
-import type { DomainOrgMapping } from "./DomainOrgMappings.schema";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OForm from "@/lib/forms/Form/OForm.vue";
 import OFormInput from "@/lib/forms/Input/OFormInput.vue";
@@ -174,14 +165,7 @@ const organizationSettingsSchema = makeOrganizationSettingsSchema(t);
 const crossLinks = ref(store.state?.organizationData?.organizationSettings?.cross_links || []);
 const formDirty = ref(false);
 
-// Domain mappings are read and written on the meta org only, and the backend
-// ignores the field outside cloud — so the section renders under both conditions.
-const { isMetaOrg } = useIsMetaOrg();
-const showDomainOrgMappings = computed(() => config.isCloud === "true" && isMetaOrg.value);
 const showRedInsights = config.isEnterprise == "true";
-const domainOrgMappings = ref<DomainOrgMapping[]>(
-  store.state?.organizationData?.organizationSettings?.domain_org_mappings || [],
-);
 
 // Dynamic defaults (edit-prefill from the store) → a typed computed. The trace/
 // span/toggle values are form-owned (OFormInput / OFormSwitch).
@@ -206,15 +190,6 @@ watch(
   },
 );
 
-watch(
-  () => store.state?.organizationData?.organizationSettings?.domain_org_mappings,
-  (newVal) => {
-    if (!formDirty.value) {
-      domainOrgMappings.value = newVal || [];
-    }
-  },
-);
-
 // @submit fires only once the schema passes (both field names required + regex),
 // so the old validateOrgSettings()/error refs are gone. Awaited by OForm so the
 // inline Save button's spinner spans the POST.
@@ -228,12 +203,7 @@ const saveOrgSettings = async (value: OrganizationSettingsForm) => {
       usage_stream_enabled: value.usageStreamEnabled,
     };
 
-    // Only sent when the section rendered: an org that never showed it must not
-    // post an empty list and wipe mappings another admin saved.
-    if (showDomainOrgMappings.value) {
-      payload.domain_org_mappings = domainOrgMappings.value;
-    }
-    // Same rule for the enterprise-only switch: a hidden field must not overwrite the stored one.
+    // A hidden enterprise-only field must not overwrite the stored one.
     if (showRedInsights) {
       payload.red_insights_enabled = value.redInsightsEnabled;
       payload.ai_rca_thread_tool_output = value.aiRcaThreadToolOutput;
@@ -253,7 +223,6 @@ const saveOrgSettings = async (value: OrganizationSettingsForm) => {
       toggle_ingestion_logs: value.toggleIngestionLogs,
       cross_links: crossLinks.value,
       usage_stream_enabled: value.usageStreamEnabled,
-      ...(showDomainOrgMappings.value ? { domain_org_mappings: domainOrgMappings.value } : {}),
       ...(showRedInsights
         ? {
             red_insights_enabled: value.redInsightsEnabled,
@@ -284,8 +253,6 @@ const saveOrgSettings = async (value: OrganizationSettingsForm) => {
 // Exposed for unit tests that exercise the submit handler directly.
 defineExpose({
   crossLinks,
-  domainOrgMappings,
-  showDomainOrgMappings,
   formDirty,
   saveOrgSettings,
   organizationSettingsSchema,
diff --git a/web/src/components/settings/SyntheticsLocationForm.vue b/web/src/components/settings/SyntheticsLocationForm.vue
index 6c987fd793..7890b21447 100644
--- a/web/src/components/settings/SyntheticsLocationForm.vue
+++ b/web/src/components/settings/SyntheticsLocationForm.vue
@@ -42,6 +42,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :options="providerOptions"
           :placeholder="t('synthetics.locations.providerPlaceholder')"
           required
+          :disabled="isEdit"
           data-test="synthetics-location-provider-select"
         />
         <OFormInput
@@ -50,6 +51,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :label="t('synthetics.locations.customProviderLabel')"
           :placeholder="t('synthetics.locations.customProviderPlaceholder')"
           required
+          :disabled="isEdit"
           data-test="synthetics-location-custom-provider-input"
         />
         <OFormInput
@@ -57,6 +59,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :label="t('synthetics.locations.region')"
           :placeholder="t('synthetics.locations.regionPlaceholder')"
           required
+          :disabled="isEdit"
           data-test="synthetics-location-region-input"
         />
         <OFormInput
@@ -76,6 +79,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           </label>
           <div
             class="text-text-secondary rounded-default border-border-default bg-surface-subtle border px-3 py-2 text-sm"
+            data-test="synthetics-location-id-preview"
           >
             {{ derivedId || "-" }}
           </div>
@@ -197,6 +201,13 @@ export default defineComponent({
         watch(
           [liveProvider, liveCustomProvider, liveRegion],
           ([p, cp, r]: [string, string, string]) => {
+            // Edit: the id is immutable, so show the persisted one, never a
+            // value recomputed from (read-only) provider/region fields.
+            const persistedId = props.isEdit ? (props.data as any)?.id : undefined;
+            if (persistedId) {
+              derivedId.value = persistedId;
+              return;
+            }
             const provider = p === "custom" ? cp || "custom" : p;
             derivedId.value = provider && r ? `${provider}-${r}` : "";
           },
diff --git a/web/src/components/settings/index.vue b/web/src/components/settings/index.vue
index 11d1377328..0fe22af66d 100644
--- a/web/src/components/settings/index.vue
+++ b/web/src/components/settings/index.vue
@@ -96,6 +96,7 @@ export default defineComponent({
       queryManagement: "queryManagement",
       query_management: "queryManagement",
       domainManagement: "domain_management",
+      orgDomainMapping: "org_domain_mapping",
       passwordPolicy: "password_policy",
       announcementBanners: "announcements",
       announcementBannerEditor: "announcements",
@@ -179,6 +180,10 @@ export default defineComponent({
         toGeneral();
         return;
       }
+      if (name === "orgDomainMapping" && config.isCloud !== "true") {
+        toGeneral();
+        return;
+      }
       // A cold load has no org config yet; redirecting then would bounce a valid deep link.
       const slackConfigLoaded = typeof store.state.zoConfig?.slack_enabled === "boolean";
       if (name === "slack" && slackConfigLoaded && !slackVisible.value) {
@@ -298,6 +303,16 @@ export default defineComponent({
           dataTest: "domain-management-tab",
           group: "Access & Security",
         },
+        {
+          key: "org_domain_mapping",
+          label: t("settings.orgDomainMapping.tabLabel"),
+          description: t("settings.orgDomainMapping.tabDesc"),
+          icon: "domain",
+          to: { name: "orgDomainMapping", query: { org_identifier: org } },
+          visible: isCloud,
+          dataTest: "org-domain-mapping-tab",
+          group: "Access & Security",
+        },
         {
           key: "announcements",
           label: t("announcements.settings.label"),
diff --git a/web/src/components/settings/orgDomainRestrictions.spec.ts b/web/src/components/settings/orgDomainRestrictions.spec.ts
new file mode 100644
index 0000000000..21c0732eec
--- /dev/null
+++ b/web/src/components/settings/orgDomainRestrictions.spec.ts
@@ -0,0 +1,76 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import {
+  blockEmailsInConfig,
+  configToBlocklists,
+  setDomainBlocklist,
+} from "./orgDomainRestrictions";
+
+const apiConfig = {
+  domains: [{ domain: "corp.io", allow_all_users: false, allowed_emails: ["a@corp.io"] }],
+  enabled: false,
+  blocked_emails: ["X@acme.com", "y@corp.io"],
+  blocked_domains: ["spam.net"],
+  updated_at: 5,
+};
+
+describe("orgDomainRestrictions", () => {
+  it("returns no blocklists for a missing config", () => {
+    expect(configToBlocklists(undefined)).toEqual([]);
+  });
+
+  it("groups blocked emails by domain and ignores the API-only rules", () => {
+    expect(configToBlocklists(apiConfig)).toEqual([
+      { name: "acme.com", blockedEmails: ["x@acme.com"] },
+      { name: "corp.io", blockedEmails: ["y@corp.io"] },
+    ]);
+  });
+
+  describe("setDomainBlocklist", () => {
+    it("replaces one domain's emails and keeps allow rules and blocked domains", () => {
+      const next = setDomainBlocklist(apiConfig, "Acme.com", ["bob@acme.com"], 1_000);
+      expect(next).toEqual({
+        domains: apiConfig.domains,
+        enabled: true,
+        blocked_emails: ["y@corp.io", "bob@acme.com"],
+        blocked_domains: ["spam.net"],
+        updated_at: 1_000_000,
+      });
+    });
+
+    it("clears a domain's emails when given an empty list", () => {
+      const next = setDomainBlocklist(apiConfig, "acme.com", []);
+      expect(next.blocked_emails).toEqual(["y@corp.io"]);
+    });
+  });
+
+  describe("blockEmailsInConfig", () => {
+    it("adds a block without touching an allow list", () => {
+      const next = blockEmailsInConfig(apiConfig, ["A@corp.io"], 1);
+      expect(next.domains).toEqual(apiConfig.domains);
+      expect(next.blocked_emails).toEqual(["X@acme.com", "y@corp.io", "a@corp.io"]);
+      expect(next.blocked_domains).toEqual(["spam.net"]);
+      expect(next.enabled).toBe(true);
+      expect(next.updated_at).toBe(1000);
+    });
+
+    it("does not duplicate an email that is already blocked", () => {
+      const next = blockEmailsInConfig({ blocked_emails: ["bob@acme.com"] }, ["BOB@acme.com"]);
+      expect(next.blocked_emails).toEqual(["bob@acme.com"]);
+    });
+  });
+});
diff --git a/web/src/components/settings/orgDomainRestrictions.ts b/web/src/components/settings/orgDomainRestrictions.ts
new file mode 100644
index 0000000000..dfa13642ed
--- /dev/null
+++ b/web/src/components/settings/orgDomainRestrictions.ts
@@ -0,0 +1,82 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+export interface DomainBlocklist {
+  name: string;
+  blockedEmails: string[];
+}
+
+export interface DomainManagementConfig {
+  domains: { domain: string; allow_all_users: boolean; allowed_emails: string[] }[];
+  enabled: boolean;
+  blocked_emails: string[];
+  blocked_domains: string[];
+  updated_at: number;
+}
+
+const emailDomain = (email: string) => email.split("@")[1]?.toLowerCase() ?? "";
+
+export function configToBlocklists(
+  config: Partial<DomainManagementConfig> | undefined,
+): DomainBlocklist[] {
+  const byDomain = new Map<string, string[]>();
+  for (const email of config?.blocked_emails ?? []) {
+    const domain = emailDomain(email ?? "");
+    if (!domain) continue;
+    byDomain.set(domain, [...(byDomain.get(domain) ?? []), email.toLowerCase()]);
+  }
+  return [...byDomain].map(([name, blockedEmails]) => ({ name, blockedEmails }));
+}
+
+export function setDomainBlocklist(
+  config: Partial<DomainManagementConfig> | undefined,
+  domain: string,
+  emails: string[],
+  now = Date.now(),
+): DomainManagementConfig {
+  const target = domain.toLowerCase();
+  const others = (config?.blocked_emails ?? []).filter((e) => emailDomain(e) !== target);
+  return withBlockedEmails(config, [...others, ...emails], now);
+}
+
+export function blockEmailsInConfig(
+  config: Partial<DomainManagementConfig> | undefined,
+  emails: string[],
+  now = Date.now(),
+): DomainManagementConfig {
+  const blocked = [...(config?.blocked_emails ?? [])];
+  for (const email of emails) {
+    const target = email.toLowerCase();
+    if (!blocked.some((e) => e.toLowerCase() === target)) blocked.push(target);
+  }
+  return withBlockedEmails(config, blocked, now);
+}
+
+// The UI edits only the blocklist; allow rules and blocked domains are API-only and pass through untouched.
+function withBlockedEmails(
+  config: Partial<DomainManagementConfig> | undefined,
+  blocked: string[],
+  now: number,
+): DomainManagementConfig {
+  return {
+    domains: [...(config?.domains ?? [])],
+    // The backend skips every block while restrictions are disabled.
+    enabled: true,
+    blocked_emails: blocked,
+    blocked_domains: [...(config?.blocked_domains ?? [])],
+    // The backend stores timestamps in microseconds.
+    updated_at: now * 1000,
+  };
+}
diff --git a/web/src/components/settings/saveQueue.ts b/web/src/components/settings/saveQueue.ts
new file mode 100644
index 0000000000..be6fdf45b4
--- /dev/null
+++ b/web/src/components/settings/saveQueue.ts
@@ -0,0 +1,26 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { nextTick } from "vue";
+
+// Each save starts after the previous one and its prop update, so it builds on the list that save left.
+export function createSaveQueue() {
+  let tail: Promise<unknown> = Promise.resolve();
+  return <T>(run: () => Promise<T>): Promise<T> => {
+    const next = tail.then(() => nextTick()).then(run);
+    tail = next.catch(() => undefined);
+    return next;
+  };
+}
diff --git a/web/src/components/settings/settingsIndex.spec.ts b/web/src/components/settings/settingsIndex.spec.ts
index 88fde162f8..74547f6d17 100644
--- a/web/src/components/settings/settingsIndex.spec.ts
+++ b/web/src/components/settings/settingsIndex.spec.ts
@@ -495,6 +495,13 @@ describe("SettingsIndex.vue", () => {
       wrapper = createWrapper();
       expect(wrapper.vm.isConstrainedSection).toBe(false);
     });
+
+    // The page renders its own OPageLayout header and tables, like Correlation Settings.
+    it("should be false for orgDomainMapping section", () => {
+      mockRouter.currentRoute.value.name = "orgDomainMapping";
+      wrapper = createWrapper();
+      expect(wrapper.vm.isConstrainedSection).toBe(false);
+    });
   });
 
   describe("password policy section", () => {
diff --git a/web/src/components/synthetic-monitoring/MonitorTable.vue b/web/src/components/synthetic-monitoring/MonitorTable.vue
index 61388e45f5..661377d5dd 100644
--- a/web/src/components/synthetic-monitoring/MonitorTable.vue
+++ b/web/src/components/synthetic-monitoring/MonitorTable.vue
@@ -632,14 +632,15 @@ type Mode = "all" | "browser";
 // noticing, not worth acting on this second, and washing it too would put most of
 // a wobbly estate in colour.
 const monitorRowClass = (row: any): string => {
-  if (String(row?.status ?? "").toLowerCase() === "failed") return "!bg-status-error-bg";
+  const st = String(row?.status ?? "").toLowerCase();
+  if (st === "failed" || st === "error") return "!bg-status-error-bg";
   return row?.enabled === false ? "!bg-surface-panel" : "";
 };
 
 const monitorRowStyle = (row: any): Record<string, string> => {
   const status = String(row?.status ?? "").toLowerCase();
   const color =
-    status === "failed"
+    status === "failed" || status === "error"
       ? "var(--color-error-500)"
       : status === "warning"
         ? "var(--color-warning-500)"
diff --git a/web/src/components/synthetics/configure/CheckRetries.spec.ts b/web/src/components/synthetics/configure/CheckRetries.spec.ts
index 87dac74215..77418d8d07 100644
--- a/web/src/components/synthetics/configure/CheckRetries.spec.ts
+++ b/web/src/components/synthetics/configure/CheckRetries.spec.ts
@@ -174,6 +174,18 @@ describe("CheckRetries", () => {
       const lastEmit = emitted![emitted!.length - 1][0] as BrowserCheck;
       expect(lastEmit.waitBeforeRetrySecs).toBe(30);
     });
+
+    it("round-trips 5 seconds unscaled (value is seconds, not milliseconds)", async () => {
+      wrapper = mountCheckRetries({ waitBeforeRetrySecs: 5 });
+
+      const input = wrapper.find('[data-test="synthetics-check-retries-delay-input"]');
+      expect(input.attributes("value")).toBe("5");
+      await input.setValue("5");
+
+      const emitted = wrapper.emitted("update:check");
+      const lastEmit = emitted![emitted!.length - 1][0] as BrowserCheck;
+      expect(lastEmit.waitBeforeRetrySecs).toBe(5);
+    });
   });
 
   describe("validation error", () => {
diff --git a/web/src/components/synthetics/configure/CheckRetries.vue b/web/src/components/synthetics/configure/CheckRetries.vue
index 502c9ccf17..d5dfb51215 100644
--- a/web/src/components/synthetics/configure/CheckRetries.vue
+++ b/web/src/components/synthetics/configure/CheckRetries.vue
@@ -60,7 +60,7 @@ const retries = computed({
   },
 });
 
-const retryDelayMs = computed({
+const retryDelaySecs = computed({
   get: () => props.check.waitBeforeRetrySecs ?? 0,
   set: (v: string | number) =>
     emit("update:check", { ...props.check, waitBeforeRetrySecs: Number(v) }),
@@ -111,7 +111,7 @@ const retryDelayMs = computed({
           t("synthetics.scheduleAlert.retryDelay")
         }}</label>
         <OInput
-          v-model="retryDelayMs"
+          v-model="retryDelaySecs"
           type="number"
           class="w-25!"
           :placeholder="raw('0')"
diff --git a/web/src/components/synthetics/journey/JourneySteps.vue b/web/src/components/synthetics/journey/JourneySteps.vue
index a309b99803..3d84c8512e 100644
--- a/web/src/components/synthetics/journey/JourneySteps.vue
+++ b/web/src/components/synthetics/journey/JourneySteps.vue
@@ -565,7 +565,7 @@ const startRowColspan = computed(
           >{{ stepProgress(row)!.done }}/{{ stepProgress(row)!.total }}</span
         >
         <OBadge
-          v-else-if="mode === 'editor' && stepBadge(row)"
+          v-else-if="mode !== 'preview' && stepBadge(row)"
           :variant="stepBadge(row)!.variant"
           size="sm"
           :data-test="`synthetics-journey-step-badge-${rowIndex(row)}`"
diff --git a/web/src/composables/dashboard/useConfigPanel.spec.ts b/web/src/composables/dashboard/useConfigPanel.spec.ts
index 5121320570..8ed7a49373 100644
--- a/web/src/composables/dashboard/useConfigPanel.spec.ts
+++ b/web/src/composables/dashboard/useConfigPanel.spec.ts
@@ -1096,6 +1096,29 @@ describe("useConfigPanel – flame graph sections", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// useConfigPanel — logs section
+// ---------------------------------------------------------------------------
+describe("useConfigPanel – logs section", () => {
+  it("shows a logs panel only its own section and general", () => {
+    const c = makeComposable(makePanelData("logs"));
+    expect(ORDERED_SECTION_IDS.filter((id) => c.isSectionVisible(id))).toEqual(["general", "logs"]);
+  });
+
+  it("keeps the panel time option for logs, which reads the dashboard time range", () => {
+    expect(
+      makeComposable(makePanelData("logs")).isConfigOptionVisible("general", "panel-default-time"),
+    ).toBe(true);
+  });
+
+  it("leaves other charts' sections as they were", () => {
+    const c = makeComposable(makePanelData("bar"));
+    expect(c.isSectionVisible("data")).toBe(true);
+    expect(c.isSectionVisible("general")).toBe(true);
+    expect(c.isSectionVisible("logs")).toBe(false);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // useConfigPanel — layout section
 // ---------------------------------------------------------------------------
@@ -1697,6 +1720,21 @@ describe("useConfigPanel – node graph options", () => {
   });
 });
 
+describe("useConfigPanel – box plot options", () => {
+  const visible = (type: string, section: any, option: string) =>
+    makeComposable(makePanelData(type, {}), ref(false)).isConfigOptionVisible(section, option);
+
+  it("shows the whisker option on a box plot only", () => {
+    expect(visible("boxplot", "data", "boxplot-whisker")).toBe(true);
+    expect(visible("bar", "data", "boxplot-whisker")).toBe(false);
+  });
+
+  it("shows no thresholds or series overrides on a box plot", () => {
+    expect(shouldShowThresholds({ data: { type: "boxplot", config: {} } })).toBe(false);
+    expect(shouldShowSeriesOverrides({ data: { type: "boxplot" } })).toBe(false);
+  });
+});
+
 describe("useConfigPanel – sparkline search visibility", () => {
   it("drops the sparkline option for an all-instant PromQL metric only", async () => {
     const { allVisibleQueriesInstant } = await import("@/utils/dashboard/configUtils");
diff --git a/web/src/composables/dashboard/useConfigPanel.ts b/web/src/composables/dashboard/useConfigPanel.ts
index db3824f5bf..c8ec10f35c 100644
--- a/web/src/composables/dashboard/useConfigPanel.ts
+++ b/web/src/composables/dashboard/useConfigPanel.ts
@@ -131,6 +131,7 @@ export const shouldShowHeatmapYBucket = (dashboardPanelData: any, promqlMode: bo
 export const HTML_PANEL_SECTIONS: Record<string, readonly SectionId[]> = {
   "alert-list": ["general", "alertList"],
   "flame-graph": ["general", "data", "flameGraph"],
+  logs: ["general", "logs"],
 };
 
 export const isSectionAllowedForType = (sectionId: SectionId, type: unknown): boolean =>
@@ -413,6 +414,10 @@ export function useConfigPanel(
         label: t("dashboard.nodeGraphShowEdgeLabels"),
         visible: dashboardPanelData.data.type === "node-graph",
       },
+      "boxplot-whisker": {
+        label: t("dashboard.boxplotWhisker"),
+        visible: dashboardPanelData.data.type === "boxplot",
+      },
       "heatmap-histogram-mode": {
         label: t("dashboard.heatmapHistogramMode"),
         visible: !!promqlMode.value && dashboardPanelData.data.type === "heatmap",
@@ -943,6 +948,32 @@ export function useConfigPanel(
         visible: dashboardPanelData.data.type === "flame-graph",
       },
     },
+    logs: {
+      "logs-fields": {
+        label: [
+          t("dashboard.logsMessageField"),
+          t("dashboard.logsLevelField"),
+          t("dashboard.logsTimeField"),
+        ],
+        visible: dashboardPanelData.data.type === "logs",
+      },
+      "logs-order": {
+        label: t("dashboard.logsOrder"),
+        visible: dashboardPanelData.data.type === "logs",
+      },
+      "logs-show-time": {
+        label: t("dashboard.logsShowTime"),
+        visible: dashboardPanelData.data.type === "logs",
+      },
+      "logs-wrap": {
+        label: t("dashboard.logsWrap"),
+        visible: dashboardPanelData.data.type === "logs",
+      },
+      "logs-prettify-json": {
+        label: t("dashboard.logsPrettifyJson"),
+        visible: dashboardPanelData.data.type === "logs",
+      },
+    },
   }));
 
   // ── Search state ──────────────────────────────────────────────────────────
diff --git a/web/src/composables/dashboard/useDashboardPanel.spec.ts b/web/src/composables/dashboard/useDashboardPanel.spec.ts
index 411263967c..0d5619e981 100644
--- a/web/src/composables/dashboard/useDashboardPanel.spec.ts
+++ b/web/src/composables/dashboard/useDashboardPanel.spec.ts
@@ -231,6 +231,81 @@ describe("useDashboardPanel", () => {
     expect(data.data.queries[2].query).toBe("stale");
   });
 
+  it("regenerates the other builder tabs of a box plot as raw values", () => {
+    const panel = useDashboardPanelData("dashboard-panel-test-boxplot");
+    const data = panel.dashboardPanelData;
+    data.meta.streamFields.groupedFields = [{ name: "logs", schema: [{ name: "took" }] }];
+    data.data.type = "boxplot";
+    const builderQuery = () => ({
+      query: "stale",
+      customQuery: false,
+      fields: {
+        stream: "logs",
+        stream_type: "logs",
+        x: [],
+        y: [
+          {
+            alias: "y_axis_1",
+            functionName: null,
+            args: [{ type: "field", value: { field: "took" } }],
+          },
+        ],
+        z: [],
+        breakdown: [],
+        filter: { filterType: "group", logicalOperator: "AND", conditions: [] },
+      },
+      config: {},
+    });
+    data.data.queries = [builderQuery(), builderQuery()];
+    data.layout.currentQueryIndex = 1;
+
+    panel.regenerateOtherBuilderQueries();
+
+    expect(data.data.queries[0].query).toContain("y_axis_1_q1");
+    expect(data.data.queries[1].query).toBe("stale");
+  });
+
+  it("escapes stored identifiers, allows only ASC or DESC and caps a box plot's rows", () => {
+    const panel = useDashboardPanelData("dashboard-panel-test-boxplot-sql");
+    const data = panel.dashboardPanelData;
+    data.meta.streamFields.groupedFields = [{ name: "logs", schema: [{ name: "took" }] }];
+    data.data.type = "boxplot";
+    const fieldOf = (alias: string, column: string, extra = {}) => ({
+      alias,
+      column,
+      functionName: null,
+      args: [{ type: "field", value: { field: column } }],
+      ...extra,
+    });
+    const builderQuery = (sortBy: string, limit?: number) => ({
+      query: "stale",
+      customQuery: false,
+      fields: {
+        stream: 'lo"gs',
+        stream_type: "logs",
+        x: [fieldOf('x"; DROP', "host", { sortBy })],
+        y: [fieldOf('y"', "took")],
+        z: [],
+        breakdown: [],
+        filter: { filterType: "group", logicalOperator: "AND", conditions: [] },
+      },
+      config: { limit },
+    });
+    data.data.queries = [builderQuery("ASC; DROP"), builderQuery("desc", 5), builderQuery("asc")];
+    data.layout.currentQueryIndex = 2;
+
+    panel.regenerateOtherBuilderQueries();
+
+    const [injected, limited] = data.data.queries;
+    expect(injected.query).toContain('FROM "lo""gs"');
+    expect(injected.query).toContain('GROUP BY "x""; DROP"');
+    expect(injected.query).toContain('as "y""_q1"');
+    expect(injected.query).not.toContain("ORDER BY");
+    expect(injected.query).toMatch(/LIMIT 10000$/);
+    expect(limited.query).toContain('ORDER BY "x""; DROP" DESC');
+    expect(limited.query).toMatch(/LIMIT 5$/);
+  });
+
   it("uses user defined schema when enabled", () => {
     const panel = useDashboardPanelData("dashboard-panel-test-4");
 
diff --git a/web/src/composables/dashboard/useDashboardPanel.ts b/web/src/composables/dashboard/useDashboardPanel.ts
index 3467108a02..a80ee7e228 100644
--- a/web/src/composables/dashboard/useDashboardPanel.ts
+++ b/web/src/composables/dashboard/useDashboardPanel.ts
@@ -1025,10 +1025,10 @@ const useDashboardPanelData = (pageKey: string = "dashboard", t: TranslateFn) =>
     }
     return;
   };
-  // Heatmap y bucketing is panel config, so every builder tab's SQL must carry it, not only the active tab's.
+  // Heatmap y bucketing and box plot raw values shape the SQL, so every builder tab must carry them, not only the active tab.
   const regenerateOtherBuilderQueries = () => {
     if (
-      dashboardPanelData.data.type !== "heatmap" ||
+      !["heatmap", "boxplot"].includes(dashboardPanelData.data.type) ||
       dashboardPanelData.data.queryType === "promql"
     ) {
       return;
diff --git a/web/src/composables/dashboard/useHtmlPanelConfig.ts b/web/src/composables/dashboard/useHtmlPanelConfig.ts
index fcd1429e58..c0603e6fe7 100644
--- a/web/src/composables/dashboard/useHtmlPanelConfig.ts
+++ b/web/src/composables/dashboard/useHtmlPanelConfig.ts
@@ -33,6 +33,14 @@ export const useHtmlPanelConfig = (dashboardPanelData: any) => {
     if (typeof numeric === "number" && Number.isFinite(numeric)) config.value[key] = numeric;
     else delete config.value[key];
   };
+  const setFlagConfig = (key: string, value: unknown) => {
+    if (value === true) config.value[key] = true;
+    else delete config.value[key];
+  };
+  const setDefaultOnFlag = (key: string, value: unknown) => {
+    if (value === false) config.value[key] = false;
+    else delete config.value[key];
+  };
   const setListConfig = (key: string, value: unknown) => {
     const list = Array.isArray(value)
       ? value.filter((item): item is string => typeof item === "string")
@@ -73,6 +81,8 @@ export const useHtmlPanelConfig = (dashboardPanelData: any) => {
     config,
     setTextConfig,
     setNumberConfig,
+    setFlagConfig,
+    setDefaultOnFlag,
     setListConfig,
     listModel,
     choiceModel,
diff --git a/web/src/composables/dashboard/usePanelAggregation.spec.ts b/web/src/composables/dashboard/usePanelAggregation.spec.ts
index 605e2cf62e..09cd194323 100644
--- a/web/src/composables/dashboard/usePanelAggregation.spec.ts
+++ b/web/src/composables/dashboard/usePanelAggregation.spec.ts
@@ -2,7 +2,10 @@ import { describe, it, expect, beforeEach, vi } from "vitest";
 import { reactive } from "vue";
 import {
   defaultFlameGraphPanelQuery,
+  defaultLogsPanelQuery,
   isPanelStarterQuery,
+  markPanelStarterQuery,
+  orderLogsStarter,
   usePanelAggregation,
 } from "./usePanelAggregation";
 
@@ -743,6 +746,75 @@ describe("usePanelAggregation", () => {
         expect(ring.y[0].args[0].value.field).toBe("_timestamp");
       });
     });
+    describe("box plot chart type", () => {
+      const yField = (functionName: string | null) => ({
+        functionName,
+        args: [{ type: "field" }, { type: "extra" }],
+      });
+
+      it("drops aggregation and keeps one x, one y and no breakdown", () => {
+        const panelData = makePanelData("boxplot");
+        const fields = panelData.data.queries[0].fields;
+        fields.x = [{ alias: "x1" }, { alias: "x2" }];
+        fields.y = [yField("avg"), yField("sum")];
+        fields.breakdown = [{ alias: "b1" }];
+        panelData.data.queries[0].config.time_shift = [{ offSet: "1h" }] as any;
+        makeAggregation(panelData).resetAggregationFunction();
+        expect(fields.x).toEqual([{ alias: "x1" }]);
+        expect(fields.y.map((item: any) => item.functionName)).toEqual([null]);
+        expect(fields.y[0].args).toHaveLength(1);
+        expect(fields.breakdown).toEqual([]);
+        expect(panelData.data.queries[0].config.time_shift).toEqual([]);
+      });
+
+      it("never keeps a timestamp y, and falls back to a numeric column", () => {
+        const panelData: any = makePanelData("boxplot");
+        panelData.meta = {
+          streamFields: {
+            groupedFields: [
+              {
+                name: "demo_app",
+                schema: [
+                  { name: "_timestamp", type: "Int64" },
+                  { name: "host", type: "Utf8" },
+                  { name: "cpu_pct", type: "Float64" },
+                ],
+              },
+            ],
+          },
+        };
+        const fields = panelData.data.queries[0].fields;
+        fields.stream = "demo_app";
+        fields.x = [{ alias: "x_axis_1", column: "_timestamp", functionName: "histogram" }];
+        fields.y = [
+          {
+            alias: "y_axis_1",
+            column: "_timestamp",
+            functionName: "count",
+            args: [{ type: "field", value: { field: "_timestamp" } }],
+          },
+        ];
+        makeAggregation(panelData).resetAggregationFunction();
+        expect(fields.y).toHaveLength(1);
+        expect(fields.y[0]).toMatchObject({ column: "cpu_pct", functionName: null });
+      });
+
+      it("keeps a numeric y and leaves y empty when the stream has no numeric column", () => {
+        const kept = makePanelData("boxplot");
+        kept.data.queries[0].fields.y = [
+          { functionName: "avg", args: [{ type: "field", value: { field: "latency_ms" } }] },
+        ];
+        makeAggregation(kept).resetAggregationFunction();
+        expect(kept.data.queries[0].fields.y[0].args[0].value.field).toBe("latency_ms");
+
+        const empty = makePanelData("boxplot");
+        empty.data.queries[0].fields.y = [
+          { functionName: "count", args: [{ type: "field", value: { field: "_timestamp" } }] },
+        ];
+        makeAggregation(empty).resetAggregationFunction();
+        expect(empty.data.queries[0].fields.y).toEqual([]);
+      });
+    });
     describe("funnel chart type", () => {
       const yField = (functionName: string | null) => ({
         functionName,
@@ -845,5 +917,101 @@ describe("usePanelAggregation", () => {
         expect(panelData.data.queryType).toBe("");
       });
     });
+
+    describe("logs", () => {
+      it("logs resets to one custom SQL query on the chosen stream, newest rows first", () => {
+        const panelData = makePanelData("logs");
+        panelData.data.queries.push(makeDefaultQuery({ query: "SELECT 2" }));
+        panelData.layout.currentQueryIndex = 1;
+        panelData.data.queries[1].fields.stream = "demo_app";
+        panelData.data.queries[1].config.time_shift = [{ offSet: "1h" }] as any;
+        usePanelAggregation({
+          dashboardPanelData: panelData,
+          getDefaultQueries: () => [makeDefaultQuery()],
+          getDefaultCustomChartText,
+          getTimestampColumn: () => "ts",
+        }).resetAggregationFunction();
+        expect(panelData.data.queries).toHaveLength(1);
+        expect(panelData.layout.currentQueryIndex).toBe(0);
+        const [query] = panelData.data.queries;
+        expect(query.customQuery).toBe(true);
+        expect(query.fields.stream).toBe("demo_app");
+        expect(query.query).toBe('SELECT * FROM "demo_app" ORDER BY ts DESC LIMIT 100');
+        expect(query.config.time_shift).toEqual([]);
+        expect(panelData.data.queryType).toBe("sql");
+        expect((panelData.layout as any).showQueryBar).toBe(true);
+        expect(panelData.data.htmlContent).toBe("");
+        expect(panelData.data.markdownContent).toBe("");
+      });
+
+      it("keeps hand-written SQL on a switch to logs", () => {
+        const typed = makePanelData("logs");
+        Object.assign(typed.data.queries[0], {
+          customQuery: true,
+          query: "SELECT host, message FROM \"test_stream\" WHERE level = 'error'",
+        });
+        makeAggregation(typed).resetAggregationFunction();
+        expect(typed.data.queries[0]).toMatchObject({
+          customQuery: true,
+          query: "SELECT host, message FROM \"test_stream\" WHERE level = 'error'",
+        });
+      });
+
+      it("returns an untouched logs starter to the builder on a switch to a line chart", () => {
+        const panelData = makePanelData("logs");
+        panelData.data.queries[0].fields.stream = "test_stream";
+        makeAggregation(panelData).resetAggregationFunction();
+        expect(isPanelStarterQuery(panelData.data.queries[0])).toBe(true);
+        panelData.data.type = "line";
+        makeAggregation(panelData).resetAggregationFunction();
+        const [query] = panelData.data.queries;
+        expect(query.customQuery).toBe(false);
+        expect(query.query).toBe("");
+        expect(query.fields.x.map((field: any) => field.alias)).toEqual(["x_axis_1"]);
+        expect(query.fields.y.map((field: any) => field.functionName)).toEqual(["count"]);
+      });
+
+      it("keeps hand-written SQL that looks like the starter on a switch to a builder chart", () => {
+        const panelData = makePanelData("line");
+        Object.assign(panelData.data.queries[0], {
+          customQuery: true,
+          query: 'SELECT * FROM "default" ORDER BY _timestamp DESC LIMIT 100',
+        });
+        makeAggregation(panelData).resetAggregationFunction();
+        expect(panelData.data.queries[0]).toMatchObject({
+          customQuery: true,
+          query: 'SELECT * FROM "default" ORDER BY _timestamp DESC LIMIT 100',
+        });
+      });
+
+      it("keeps hand-written SQL on another stream when a table switches to logs", () => {
+        const panelData = makePanelData("logs");
+        Object.assign(panelData.data.queries[0], {
+          customQuery: true,
+          query: 'SELECT * FROM "other_stream" ORDER BY _timestamp DESC LIMIT 100',
+        });
+        panelData.data.queries[0].fields.stream = "test_stream";
+        makeAggregation(panelData).resetAggregationFunction();
+        expect(panelData.data.queries[0].query).toBe(
+          'SELECT * FROM "other_stream" ORDER BY _timestamp DESC LIMIT 100',
+        );
+        expect(isPanelStarterQuery(panelData.data.queries[0])).toBe(false);
+      });
+
+      it("orders the logs starter oldest first by fetching the earliest rows", () => {
+        const oldest = defaultLogsPanelQuery("s", "_timestamp", "oldest");
+        expect(oldest).toBe('SELECT * FROM "s" ORDER BY _timestamp ASC LIMIT 100');
+        const query = { query: defaultLogsPanelQuery("s", "_timestamp") };
+        markPanelStarterQuery(query);
+        orderLogsStarter(query, "oldest");
+        expect(query.query).toBe(oldest);
+        expect(isPanelStarterQuery(query)).toBe(true);
+        orderLogsStarter(query, "newest");
+        expect(query.query).toBe(defaultLogsPanelQuery("s", "_timestamp"));
+        const typed = { query: defaultLogsPanelQuery("s", "_timestamp") };
+        orderLogsStarter(typed, "oldest");
+        expect(typed.query).toBe(defaultLogsPanelQuery("s", "_timestamp"));
+      });
+    });
   });
 });
diff --git a/web/src/composables/dashboard/usePanelAggregation.ts b/web/src/composables/dashboard/usePanelAggregation.ts
index f15443f152..74e7480faf 100644
--- a/web/src/composables/dashboard/usePanelAggregation.ts
+++ b/web/src/composables/dashboard/usePanelAggregation.ts
@@ -20,6 +20,7 @@ import {
   keepRawValueFields,
 } from "@/utils/dashboard/defaultFields";
 import { isCustomSqlPanel, isRowTimeline } from "@/utils/dashboard/chartTypeGroups";
+import type { LogsOrder } from "@/utils/dashboard/convertLogsPanelData";
 import {
   HOSTMAP_DEFAULT_COLOR,
   HOSTMAP_MAX_GROUP_LEVELS,
@@ -37,9 +38,20 @@ const seededStarters = new WeakMap<object, string>();
 export const defaultFlameGraphPanelQuery = (stream: string): string =>
   stream ? `SELECT stack, sum(samples) AS value FROM "${stream}" GROUP BY stack` : "";
 
+/** The SQL a new logs panel starts from: the stream's latest rows, or its earliest when ordered oldest first. */
+export const defaultLogsPanelQuery = (
+  stream: string,
+  timestampColumn: string,
+  order: LogsOrder = "newest",
+): string =>
+  stream
+    ? `SELECT * FROM "${stream}" ORDER BY ${timestampColumn} ${order === "oldest" ? "ASC" : "DESC"} LIMIT 100`
+    : "";
+
 // The SQL each custom-SQL panel type starts from, keyed by panel type.
 const STARTER_QUERIES: Record<string, (stream: string, timestampColumn: string) => string> = {
   "flame-graph": (stream) => defaultFlameGraphPanelQuery(stream),
+  logs: defaultLogsPanelQuery,
 };
 
 /** Records the query's current SQL as the starter it was just seeded with. */
@@ -51,6 +63,15 @@ export const markPanelStarterQuery = (query: any) => {
 export const isPanelStarterQuery = (query: any): boolean =>
   !!query && typeof query.query === "string" && seededStarters.get(toRaw(query)) === query.query;
 
+/** Rewrites an untouched logs starter to fetch rows in `order`; reversing the newest 100 would never show the oldest. */
+export const orderLogsStarter = (query: any, order: LogsOrder) => {
+  if (!isPanelStarterQuery(query)) return;
+  query.query = query.query
+    .trim()
+    .replace(/ (?:ASC|DESC) LIMIT 100$/, ` ${order === "oldest" ? "ASC" : "DESC"} LIMIT 100`);
+  markPanelStarterQuery(query);
+};
+
 const BY_SERIES_COLOR_MODES = ["palette-classic-by-series", "palette-classic"];
 
 /** A host map colours cells by value, so a by-series palette left from another type becomes its scale. */
@@ -185,6 +206,39 @@ export const usePanelAggregation = ({
         dashboardPanelData.data.customChartContent = getDefaultCustomChartText();
         break;
 
+      case "boxplot":
+        // A box plot summarises the raw values of one y field per x category, so nothing is aggregated.
+        dashboardPanelData.data.queries?.forEach((query: any) => {
+          query.fields.y.forEach((itemY: any) => {
+            if (itemY.isDerived) return;
+            itemY.functionName = null;
+            itemY.args = itemY?.args?.length ? [itemY?.args?.[0]] : [];
+            itemY.havingConditions = [];
+          });
+          keepRawValueFields(
+            query,
+            dashboardPanelData.meta?.streamFields?.groupedFields ?? [],
+            getTimestampColumn(),
+          );
+          query.fields.x = query.fields.x.slice(0, 1);
+          query.fields.y = query.fields.y.slice(0, 1);
+          query.fields.z = [];
+          query.fields.breakdown = [];
+          query.fields.latitude = null;
+          query.fields.longitude = null;
+          query.fields.weight = null;
+          query.fields.name = null;
+          query.fields.value_for_maps = null;
+          query.fields.source = null;
+          query.fields.target = null;
+          query.fields.value = null;
+          query.config.time_shift = [];
+        });
+        dashboardPanelData.data.htmlContent = "";
+        dashboardPanelData.data.markdownContent = "";
+        dashboardPanelData.data.customChartContent = getDefaultCustomChartText();
+        break;
+
       case "hostmap":
         dashboardPanelData.data.queries?.forEach((query: any) => {
           // A time bucket cannot name a cell, so only a plain field stays as the entity.
diff --git a/web/src/composables/dashboard/usePanelDrilldown.boxplot.spec.ts b/web/src/composables/dashboard/usePanelDrilldown.boxplot.spec.ts
new file mode 100644
index 0000000000..dacd7f526c
--- /dev/null
+++ b/web/src/composables/dashboard/usePanelDrilldown.boxplot.spec.ts
@@ -0,0 +1,218 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import * as echarts from "echarts";
+import { getECData } from "echarts/lib/util/innerStore";
+import { gt } from "@/types/i18n";
+import { convertPanelData } from "@/utils/dashboard/convertPanelData";
+import { usePanelDrilldown } from "./usePanelDrilldown";
+
+vi.mock("@/utils/dashboard/convertCustomChartData", () => ({
+  runJavaScriptCode: vi.fn(),
+  validateUserCode: vi.fn(() => null),
+}));
+
+vi.mock("@/utils/zincutils", () => ({
+  b64EncodeUnicode: (v: string) => `b64(${v})`,
+  escapeSingleQuotes: (v: string) => v,
+  useLocalOrganization: () => null,
+  useLocalCurrentUser: () => null,
+  useLocalTimezone: () => null,
+}));
+
+const WIDTH = 800;
+const HEIGHT = 400;
+const store = {
+  state: {
+    theme: "light",
+    timezone: "UTC",
+    zoConfig: {
+      timestamp_column: "_timestamp",
+      max_dashboard_series: 1000,
+      enable_cross_linking: false,
+    },
+    selectedOrganization: { identifier: "default" },
+  },
+  dispatch: vi.fn(),
+};
+const drilldown = [{ name: "Logs", type: "byUrl", data: { url: "https://example.com" } }];
+
+const field = (alias: string, column: string, functionName: string | null = null) => ({
+  label: column,
+  alias,
+  column,
+  functionName,
+  args: [{ type: "field", value: { field: column } }],
+  isDerived: false,
+  havingConditions: [],
+});
+
+const panel = (type: string, fields: Record<string, any>) => ({
+  id: type,
+  type,
+  title: type,
+  queryType: "sql",
+  queries: [
+    {
+      query: "SELECT 1",
+      customQuery: false,
+      fields: {
+        stream: "demo_app",
+        stream_type: "logs",
+        x: [],
+        y: [],
+        z: [],
+        breakdown: [],
+        ...fields,
+      },
+      config: { limit: 0 },
+      joins: [],
+    },
+  ],
+  config: { show_legends: false, unit: "default", decimals: 0, drilldown },
+});
+
+const x = field("x_axis_1", "service");
+const raw = field("y_axis_1", "latency_ms");
+const latencies = [12, 40, 41, 43, 80, 95, 120, 130].flatMap((value) => [
+  { x_axis_1: "checkout", y_axis_1: value },
+  { x_axis_1: "search", y_axis_1: value / 2 },
+]);
+
+const viaPanel = async (schema: any, rows: any[]) =>
+  (await convertPanelData(
+    schema,
+    [rows],
+    store,
+    { value: { offsetWidth: WIDTH, offsetHeight: HEIGHT } },
+    { value: null },
+    { value: [] },
+    { queries: [] },
+    { height: `${HEIGHT}px` },
+    { value: [] },
+    false,
+  )) as any;
+
+const cases: Record<string, () => Promise<{ schema: any; options: any }>> = {
+  boxplot: async () => {
+    const schema = panel("boxplot", { x: [x], y: [raw] });
+    return { schema, options: (await viaPanel(schema, latencies)).options };
+  },
+};
+
+/** The centre of the largest drawn element that belongs to a data item, in chart pixels. */
+const dataItemPoint = (chart: echarts.ECharts) => {
+  const zr = chart.getZr();
+  zr.flush();
+  let best: { x: number; y: number; area: number } | null = null;
+  zr.storage.getDisplayList(true).forEach((el: any) => {
+    const ecData = getECData(el);
+    if (el.silent || el.ignore || ecData?.dataIndex == null || el.type === "text") return;
+    const rect = el.getBoundingRect().clone();
+    const transform = el.getComputedTransform();
+    if (transform) rect.applyTransform(transform);
+    const area = rect.width * rect.height;
+    if (!best || area > best.area) {
+      best = { x: rect.x + rect.width / 2, y: rect.y + rect.height / 2, area };
+    }
+  });
+  return best as { x: number; y: number; area: number } | null;
+};
+
+const charts: echarts.ECharts[] = [];
+afterEach(() => {
+  charts.splice(0).forEach((chart) => chart.dispose());
+});
+
+describe("drilldown on a box plot", () => {
+  it.each(Object.keys(cases))(
+    "a click on a %s data item opens the drilldown menu and hides the tooltip",
+    async (type) => {
+      const { schema, options } = await cases[type]();
+      const element = document.createElement("div");
+      document.body.appendChild(element);
+      const chart = echarts.init(element, null, { renderer: "svg", width: WIDTH, height: HEIGHT });
+      charts.push(chart);
+      chart.setOption({ ...options, animation: false });
+
+      const popup = {
+        style: { display: "none", top: "", left: "" },
+        offsetHeight: 20,
+        offsetWidth: 40,
+      };
+      const hideChartTooltip = vi.fn();
+      const api = usePanelDrilldown({
+        panelSchema: { value: schema },
+        variablesData: { value: { values: [] } },
+        selectedTimeObj: { value: { start_time: new Date(0), end_time: new Date(3_600_000) } },
+        metadata: { value: { queries: [] } },
+        data: { value: [] },
+        panelData: { value: { options } },
+        filteredData: { value: [] },
+        resultMetaData: { value: [] },
+        store,
+        route: { query: {} },
+        router: { push: vi.fn() },
+        emit: vi.fn(),
+        allowAnnotationsAdd: { value: false },
+        isAddAnnotationMode: { value: false },
+        editAnnotation: vi.fn(),
+        handleAddAnnotation: vi.fn(),
+        chartPanelRef: {
+          value: {
+            offsetHeight: HEIGHT,
+            offsetWidth: WIDTH,
+            getBoundingClientRect: () => ({ left: 0, top: 0 }),
+          },
+        },
+        drilldownPopUpRef: { value: popup },
+        annotationPopupRef: { value: { style: {} } },
+        selectedAnnotationData: { value: null },
+        isCursorOverPanel: { value: true },
+        showErrorNotification: vi.fn(),
+        hideChartTooltip,
+        t: gt,
+      } as any);
+      const clicked = new Promise<any>((resolve) =>
+        chart.on("click", async (params: any) => {
+          await api.onChartClick(params);
+          resolve(params);
+        }),
+      );
+
+      const point = dataItemPoint(chart);
+      expect(point, `${type} draws a clickable data item`).not.toBeNull();
+      const event = {
+        zrX: point!.x,
+        zrY: point!.y,
+        offsetX: point!.x,
+        offsetY: point!.y,
+        stop: () => {},
+        preventDefault: () => {},
+      };
+      // ECharts counts a click only after a press and release on the same element.
+      const handler = chart.getZr().handler as any;
+      ["mousedown", "mouseup", "click"].forEach((name) => handler.dispatch(name, event));
+      const params = await clicked;
+
+      expect(params.componentType).toBe("series");
+      expect(params.dataIndex).not.toBeUndefined();
+      expect(popup.style.display).toBe("block");
+      expect(api.drilldownArray.value.map((item: any) => item.name)).toEqual(["Logs"]);
+      expect(hideChartTooltip).toHaveBeenCalledTimes(1);
+    },
+  );
+});
diff --git a/web/src/composables/dashboard/usePanelDrilldown.ts b/web/src/composables/dashboard/usePanelDrilldown.ts
index f884626515..d7929eb381 100644
--- a/web/src/composables/dashboard/usePanelDrilldown.ts
+++ b/web/src/composables/dashboard/usePanelDrilldown.ts
@@ -42,6 +42,7 @@ import {
   stateTimelineSourceRecord,
 } from "@/utils/dashboard/convertStateTimelineData";
 import { isFlowChart, isRowTimeline } from "@/utils/dashboard/chartTypeGroups";
+import { boxplotDrilldownSeries, boxplotDrilldownTime } from "@/utils/dashboard/convertBoxplotData";
 import { hostmapDrilldownSeries, hostmapEntityColumn } from "@/utils/dashboard/convertHostmapData";
 
 // A click on these lands on a named item (slice, bar, tile), not on a named series.
@@ -246,6 +247,9 @@ export function usePanelDrilldown({
       const { column, row } = heatmapCellValues(params);
       return { __name: row ?? params?.name, __value: value, __axisValue: column };
     }
+    if (panelSchema.value.type === "boxplot") {
+      return boxplotDrilldownSeries(panelData?.value?.options, params);
+    }
     return {
       __name: NAMED_ITEM_TYPES.includes(panelSchema.value.type) ? params?.name : params?.seriesName,
       __value: value,
@@ -876,7 +880,11 @@ export function usePanelDrilldown({
         const isHeatmap = panelSchema.value.type === "heatmap";
         // A host map cell spans the whole panel range; its value[0] is a cell index, not a time.
         const hoveredTime =
-          isHeatmap || queryDetails.type === "hostmap" ? null : drilldownParams[0]?.value?.[0];
+          isHeatmap || queryDetails.type === "hostmap"
+            ? null
+            : queryDetails.type === "boxplot"
+              ? boxplotDrilldownTime(queryDetails, panelData?.value?.options, drilldownParams[0])
+              : drilldownParams[0]?.value?.[0];
         const hoveredTimestamp = hoveredTime
           ? getUTCTimestampFromZonedTimestamp(hoveredTime, store.state.timezone)
           : null;
diff --git a/web/src/composables/dashboard/usePanelFields.spec.ts b/web/src/composables/dashboard/usePanelFields.spec.ts
index ad5f17e9f5..95eb6b8058 100644
--- a/web/src/composables/dashboard/usePanelFields.spec.ts
+++ b/web/src/composables/dashboard/usePanelFields.spec.ts
@@ -741,4 +741,46 @@ describe("usePanelFields", () => {
       expect(panelData.data.queries[0].fields.breakdown).toHaveLength(0);
     });
   });
+
+  describe("box plot slots", () => {
+    const addMany = (axis: "x" | "y" | "breakdown", count: number) => {
+      for (let i = 0; i < count; i++) {
+        const row = { name: `field_${axis}_${i}` };
+        if (axis === "x") fields.addXAxisItem(row);
+        else if (axis === "y") fields.addYAxisItem(row);
+        else fields.addBreakDownAxisItem(row);
+      }
+      return panelData.data.queries[0].fields[axis].length;
+    };
+
+    it("takes 1 x, 1 y and no breakdown fields", () => {
+      panelData.data.type = "boxplot";
+      expect(addMany("x", 3)).toBe(1);
+      expect(addMany("y", 3)).toBe(1);
+      expect(addMany("breakdown", 3)).toBe(0);
+    });
+
+    it("a box plot y field keeps raw values, a pie y field counts", () => {
+      panelData.data.type = "boxplot";
+      fields.addYAxisItem({ name: "latency_ms" });
+      expect(panelData.data.queries[0].fields.y[0].functionName).toBeNull();
+      panelData.data.queries[0].fields.y = [];
+      panelData.data.type = "pie";
+      fields.addYAxisItem({ name: "latency_ms" });
+      expect(panelData.data.queries[0].fields.y[0].functionName).toBe("count");
+    });
+  });
+
+  describe("logs slots", () => {
+    it("takes no x, y or breakdown fields", () => {
+      panelData.data.type = "logs";
+      for (let i = 0; i < 3; i++) {
+        fields.addXAxisItem({ name: `field_x_${i}` });
+        fields.addYAxisItem({ name: `field_y_${i}` });
+        fields.addBreakDownAxisItem({ name: `field_b_${i}` });
+      }
+      const { x, y, breakdown } = panelData.data.queries[0].fields;
+      expect([x.length, y.length, breakdown.length]).toEqual([0, 0, 0]);
+    });
+  });
 });
diff --git a/web/src/composables/dashboard/usePanelFields.ts b/web/src/composables/dashboard/usePanelFields.ts
index 0c7c3c78ad..236399f7b4 100644
--- a/web/src/composables/dashboard/usePanelFields.ts
+++ b/web/src/composables/dashboard/usePanelFields.ts
@@ -84,6 +84,7 @@ export const usePanelFields = ({
       case "bar-gauge":
       case "state-timeline":
       case "funnel":
+      case "boxplot":
       case "hostmap":
       case "area":
       case "bar":
@@ -104,6 +105,7 @@ export const usePanelFields = ({
       case "node-graph":
       case "alert-list":
       case "flame-graph":
+      case "logs":
         return (
           dashboardPanelData.data.queries[dashboardPanelData.layout.currentQueryIndex].fields.x
             .length >= 0
@@ -150,6 +152,8 @@ export const usePanelFields = ({
       case "node-graph":
       case "alert-list":
       case "flame-graph":
+      case "boxplot":
+      case "logs":
         return true;
       case "hostmap":
         return (
@@ -176,6 +180,7 @@ export const usePanelFields = ({
       case "treemap":
       case "sunburst":
       case "funnel":
+      case "boxplot":
         return (
           dashboardPanelData.data.queries[dashboardPanelData.layout.currentQueryIndex].fields.y
             .length >= 1
@@ -183,6 +188,7 @@ export const usePanelFields = ({
       case "node-graph":
       case "alert-list":
       case "flame-graph":
+      case "logs":
         return true;
       case "metric":
         return (
@@ -400,6 +406,7 @@ export const usePanelFields = ({
       type: "build",
       functionName:
         dashboardPanelData.data.type == "heatmap" ||
+        dashboardPanelData.data.type == "boxplot" ||
         isRawValueChart(dashboardPanelData.data.type) ||
         isDerived
           ? null
diff --git a/web/src/composables/dashboard/usePanelLivePreview.spec.ts b/web/src/composables/dashboard/usePanelLivePreview.spec.ts
index 05c0dcf5cb..119dba65dd 100644
--- a/web/src/composables/dashboard/usePanelLivePreview.spec.ts
+++ b/web/src/composables/dashboard/usePanelLivePreview.spec.ts
@@ -25,7 +25,11 @@ import {
   usePanelLivePreview,
   variablesSignature,
 } from "./usePanelLivePreview";
-import { markPanelStarterQuery } from "./usePanelAggregation";
+import {
+  defaultLogsPanelQuery,
+  markPanelStarterQuery,
+  orderLogsStarter,
+} from "./usePanelAggregation";
 
 const makeQuery = (overrides: Record<string, any> = {}) => ({
   query: 'SELECT histogram(_timestamp) AS "x_axis_1" FROM "default"',
@@ -184,6 +188,23 @@ describe("usePanelLivePreview", () => {
   });
 
   describe("live runs", () => {
+    it("runs a logs starter flipped to oldest first without waiting for Apply", async () => {
+      const { panel, applied, run, live, scope } = setup();
+      panel.type = "logs";
+      panel.queries[0].customQuery = true;
+      panel.queries[0].query = defaultLogsPanelQuery("default", "_timestamp");
+      markPanelStarterQuery(panel.queries[0]);
+      applied.value = clone(panel);
+      live.arm();
+      orderLogsStarter(panel.queries[0], "oldest");
+      await nextTick();
+      expect(live.applyState.value).not.toBe("typed");
+      vi.advanceTimersByTime(LIVE_PREVIEW_DEBOUNCE_MS);
+      expect(run).toHaveBeenCalledTimes(1);
+      expect(applied.value.queries[0].query).toMatch(/ASC LIMIT 100$/);
+      scope.stop();
+    });
+
     it("runs an aggregation change made inside the still-open axis menu", async () => {
       const { panel, run, live, scope } = setup({ domOverlay: true });
       document.body.innerHTML =
diff --git a/web/src/composables/dashboard/useSeriesFormatting.ts b/web/src/composables/dashboard/useSeriesFormatting.ts
index 2e05a826a2..26a41628e6 100644
--- a/web/src/composables/dashboard/useSeriesFormatting.ts
+++ b/web/src/composables/dashboard/useSeriesFormatting.ts
@@ -271,7 +271,7 @@ export const getPromqlMetricSeriesNames = async (
   const [
     { alignShiftedPromQLResults, METRIC_MAX_CELLS },
     { buildPromqlSeriesNames },
-    { legendFallbackOf },
+    { legendFallbackOf, legendExprOf },
     cache,
   ] = await Promise.all([
     import("@/utils/dashboard/convertPromQLData"),
@@ -297,6 +297,7 @@ export const getPromqlMetricSeriesNames = async (
       metrics: (q?.result ?? []).map((m: any) => m?.metric).filter(Boolean),
       template: queries?.[parentQueryIndex[i]]?.config?.promql_legend,
       fallback: legendFallbackOf(queries, parentQueryIndex[i]),
+      expr: legendExprOf(queries, source.metadata, parentQueryIndex[i]),
     })),
     cache.getCachedSemanticGroups(store?.state?.selectedOrganization?.identifier ?? "") ?? [],
   );
diff --git a/web/src/composables/iam/useRolePresets.spec.ts b/web/src/composables/iam/useRolePresets.spec.ts
new file mode 100644
index 0000000000..f5cf8fdea2
--- /dev/null
+++ b/web/src/composables/iam/useRolePresets.spec.ts
@@ -0,0 +1,660 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { ref } from "vue";
+import i18n from "@/locales";
+import type { TranslateFn } from "@/types/i18n";
+import type { Entity, Resource } from "@/ts/interfaces";
+import { iconRegistry } from "@/lib/core/Icon/OIcon.icons";
+import { useRoleGrants } from "@/composables/iam/useRoleGrants";
+import { useRolePresets } from "@/composables/iam/useRolePresets";
+import { MEDIUM_STALE_TIME } from "@/composables/query/cachePolicy";
+import { K8S_VIEWER_STREAMS } from "@/components/iam/roles/k8sViewerPreset";
+
+const mockToast = vi.fn();
+vi.mock("@/lib/feedback/Toast/useToast", () => ({
+  toast: (...args: unknown[]) => mockToast(...args),
+}));
+
+const ORG = "default";
+const ALL = `_all_${ORG}`;
+const PERMS = ["AllowAll", "AllowList", "AllowGet", "AllowDelete", "AllowPost", "AllowPut"];
+
+const t = i18n.global.t as unknown as TranslateFn;
+
+const MODULES = [
+  "stream",
+  "afolder",
+  "destination",
+  "template",
+  "dfolder",
+  "pipeline",
+  "function",
+  "enrichment_table",
+  "db_monitoring",
+  "sourcemaps",
+  "rum_analytics",
+  "settings",
+];
+
+// Mirrors useRolePermissionTree.modifyResourcePermissions for the resources in this fixture.
+const HIDDEN: Record<string, string[]> = {
+  settings: ["AllowList", "AllowDelete", "AllowPost"],
+  rum_analytics: ["AllowList", "AllowGet"],
+};
+
+const node = (
+  name: string,
+  { type = "Type", resourceName = name, hidden = [] as string[] } = {},
+): Resource =>
+  ({
+    name,
+    resourceName,
+    type,
+    top_level: type === "Type",
+    display_name: name,
+    parent: "",
+    childs: [],
+    entities: [],
+    permission: Object.fromEntries(
+      PERMS.map((perm) => [perm, { show: !hidden.includes(perm), value: false }]),
+    ),
+  }) as unknown as Resource;
+
+// Same key EditRole.permissionHashFor writes.
+const permissionHashFor = (row: Resource | Entity, permission: string) => {
+  let entity = row.type === "Type" ? ALL : row.name;
+  let resourceName = row.resourceName;
+  if (row.type === "Resource" && row.top_level) {
+    resourceName = row.name;
+    entity = ALL;
+  }
+  return `${resourceName}:${entity}:${permission}`;
+};
+
+const METRICS = ["cpu", "postgresql_backends", "mysql_threads", "system_cpu_time"];
+const LOGS = ["app", "_rumdata", "_sessionreplay"];
+
+function setup({
+  modules = MODULES,
+  saved = [] as string[],
+  metrics = METRICS,
+  logs = LOGS,
+  failTypes = [] as string[],
+} = {}) {
+  const resources = modules.map((key) => node(key, { hidden: HIDDEN[key] }));
+  const resourceMapper = ref<{ [key: string]: Resource }>(
+    Object.fromEntries(resources.map((resource) => [resource.name, resource])),
+  );
+  const heavyResourceEntities = ref<{ [key: string]: Entity[] }>({});
+  const grants = useRoleGrants();
+  grants.seedSaved(saved);
+  const lists: Record<string, string[]> = { metrics, logs };
+
+  const handlePermissionBatchChange = vi.fn(
+    (changes: { row: Resource | Entity; permission: string; newValue: boolean }[]) =>
+      changes.forEach(({ row, permission }) => grants.toggle(permissionHashFor(row, permission))),
+  );
+  const getStreams = vi.fn(async (type: string) => {
+    if (failTypes.includes(type)) throw new Error("403");
+    return { list: lists[type] };
+  });
+  const getResourceEntities = vi.fn(async (resource: Resource | Entity) => {
+    if (resource.entities?.length) return;
+    if (resource.name === "stream") {
+      resource.entities?.push(...["logs", "traces", "metrics", "index"].map((name) => node(name)));
+    } else if (lists[resource.name]) {
+      if (failTypes.includes(resource.name)) throw new Error("403");
+      const rows = lists[resource.name].map(
+        (name) =>
+          node(name, {
+            type: "Resource",
+            resourceName: resource.name,
+            hidden: ["AllowList", "AllowPost"],
+          }) as unknown as Entity,
+      );
+      heavyResourceEntities.value[resource.name] = rows;
+      resource.entities?.push(...rows);
+    }
+  });
+  const expandPermission = vi.fn(async (resource: Resource | Entity) => {
+    resource.expand = !resource.expand;
+    if (resource.expand) await getResourceEntities(resource).catch(() => undefined);
+  });
+
+  const presets = useRolePresets({
+    permissionsState: { permissions: resources },
+    resourceMapper,
+    heavyResourceEntities,
+    grants,
+    permissionHashFor,
+    handlePermissionBatchChange,
+    expandPermission,
+    getResourceEntities,
+    getStreams,
+    t,
+  });
+  return { ...presets, grants, handlePermissionBatchChange, getResourceEntities, getStreams };
+}
+
+const added = (ctx: ReturnType<typeof setup>) => Object.keys(ctx.grants.added.value).sort();
+
+const inRole = (preview: ReturnType<ReturnType<typeof setup>["previewPreset"]>) =>
+  preview.status === "ready" && !preview.noMatchingStreams && preview.adds.length === 0;
+
+beforeEach(() => mockToast.mockClear());
+
+describe("useRolePresets - list", () => {
+  it("lists the 5 built-ins then the 5 job presets", () => {
+    const { presets } = setup();
+    expect(presets.value.map((preset) => `${preset.section}:${preset.id}`)).toEqual([
+      "builtin:readonly",
+      "builtin:dbm",
+      "builtin:k8s",
+      "builtin:rum_viewer",
+      "builtin:rum_editor",
+      "job:alert_manager",
+      "job:alert_viewer",
+      "job:dashboard_editor",
+      "job:dashboard_viewer",
+      "job:pipeline_editor",
+    ]);
+  });
+
+  it("gives every preset a title and description in en-US and a registered icon", () => {
+    setup().presets.value.forEach((preset) => {
+      expect(i18n.global.te(preset.titleKey, "en-us")).toBe(true);
+      expect(i18n.global.te(preset.descriptionKey, "en-us")).toBe(true);
+      expect(iconRegistry).toHaveProperty(preset.icon);
+    });
+  });
+
+  it("hides a job preset when any module it grants is missing from this org", () => {
+    const { presets } = setup({ modules: MODULES.filter((key) => key !== "template") });
+    const ids = presets.value.map((preset) => preset.id);
+    expect(ids).not.toContain("alert_manager");
+    expect(ids).not.toContain("alert_viewer");
+    expect(ids).toContain("dashboard_viewer");
+  });
+});
+
+describe("useRolePresets - job presets", () => {
+  it.each([
+    [
+      "alert_manager",
+      [
+        "afolder:ALL:AllowAll",
+        "destination:ALL:AllowAll",
+        "stream:ALL:AllowGet",
+        "stream:ALL:AllowList",
+        "template:ALL:AllowAll",
+      ],
+    ],
+    [
+      "alert_viewer",
+      [
+        "afolder:ALL:AllowGet",
+        "afolder:ALL:AllowList",
+        "destination:ALL:AllowGet",
+        "destination:ALL:AllowList",
+        "template:ALL:AllowGet",
+        "template:ALL:AllowList",
+      ],
+    ],
+    ["dashboard_editor", ["dfolder:ALL:AllowAll", "stream:ALL:AllowGet", "stream:ALL:AllowList"]],
+    [
+      "dashboard_viewer",
+      [
+        "dfolder:ALL:AllowGet",
+        "dfolder:ALL:AllowList",
+        "stream:ALL:AllowGet",
+        "stream:ALL:AllowList",
+      ],
+    ],
+    [
+      "pipeline_editor",
+      [
+        "enrichment_table:ALL:AllowGet",
+        "enrichment_table:ALL:AllowList",
+        "function:ALL:AllowAll",
+        "pipeline:ALL:AllowAll",
+        "stream:ALL:AllowGet",
+        "stream:ALL:AllowList",
+      ],
+    ],
+  ])("%s stages exactly its module-wide grants", async (id, keys) => {
+    const ctx = setup();
+    const expected = keys.map((key) => key.replace("ALL", ALL));
+    const preview = ctx.previewPreset(id);
+    expect([...preview.adds].sort()).toEqual(expected);
+    expect(preview.skipped).toBe(0);
+    await ctx.applyPreset(id);
+    expect(added(ctx)).toEqual(expected);
+  });
+
+  it("leaves nothing missing after any job preset", () => {
+    const ctx = setup();
+    [
+      "alert_manager",
+      "alert_viewer",
+      "dashboard_editor",
+      "dashboard_viewer",
+      "pipeline_editor",
+    ].forEach((id) => expect(ctx.previewPreset(id).stillMissing).toEqual([]));
+  });
+
+  it("still flags Streams for a manual Dashboard Folders grant the preset does not cover", () => {
+    const ctx = setup({ saved: [`dfolder:${ALL}:AllowAll`] });
+    expect(ctx.previewPreset("alert_viewer").stillMissing).toEqual([
+      expect.objectContaining({ module: "stream", actions: ["AllowList", "AllowGet"] }),
+    ]);
+  });
+});
+
+describe("useRolePresets - preview", () => {
+  it("stages nothing", () => {
+    const ctx = setup();
+    ctx.presets.value.forEach((preset) => ctx.previewPreset(preset.id));
+    expect(ctx.handlePermissionBatchChange).not.toHaveBeenCalled();
+    expect(added(ctx)).toEqual([]);
+  });
+
+  it("counts a grant the role already holds as skipped", () => {
+    const ctx = setup({ saved: [`destination:${ALL}:AllowAll`] });
+    const preview = ctx.previewPreset("alert_manager");
+    expect(preview.adds).not.toContain(`destination:${ALL}:AllowAll`);
+    expect(preview.adds).toHaveLength(4);
+    expect(preview.skipped).toBe(1);
+  });
+
+  it("counts a grant staged but not saved as held", () => {
+    const ctx = setup();
+    ctx.grants.toggle(`dfolder:${ALL}:AllowAll`);
+    expect(ctx.previewPreset("dashboard_editor").adds).toEqual([
+      `stream:${ALL}:AllowList`,
+      `stream:${ALL}:AllowGet`,
+    ]);
+  });
+
+  it("skips List and Get on a module the role holds All on, and reads In Role", () => {
+    const ctx = setup({ saved: [`dfolder:${ALL}:AllowAll`, `stream:${ALL}:AllowAll`] });
+    const preview = ctx.previewPreset("dashboard_viewer");
+    expect(preview).toEqual({
+      status: "ready",
+      adds: [],
+      restores: [],
+      skipped: 4,
+      readsEveryStream: false,
+      stillMissing: [],
+    });
+    expect(inRole(preview)).toBe(true);
+  });
+
+  it("flags a preset that adds the stream wildcard Get, and only then", () => {
+    const ctx = setup();
+    expect(ctx.previewPreset("alert_manager").readsEveryStream).toBe(true);
+    expect(ctx.previewPreset("alert_viewer").readsEveryStream).toBe(false);
+  });
+
+  it("does not flag a role that already holds the stream wildcard Get", () => {
+    const ctx = setup({ saved: [`stream:${ALL}:AllowGet`, `stream:${ALL}:AllowList`] });
+    expect(ctx.previewPreset("alert_manager").readsEveryStream).toBe(false);
+  });
+
+  it("does not read In Role while one grant is still missing", () => {
+    const ctx = setup({ saved: [`dfolder:${ALL}:AllowAll`, `stream:${ALL}:AllowList`] });
+    const preview = ctx.previewPreset("dashboard_viewer");
+    expect(preview.adds).toEqual([`stream:${ALL}:AllowGet`]);
+    expect(inRole(preview)).toBe(false);
+  });
+
+  it("does not skip a module-wide grant because one item in the module is granted", () => {
+    const ctx = setup({ saved: ["dfolder:Payments:AllowAll"] });
+    expect(ctx.previewPreset("dashboard_viewer").adds).toContain(`dfolder:${ALL}:AllowList`);
+  });
+
+  it("adds a grant whose saved wider scope is staged for removal", () => {
+    const ctx = setup({ saved: [`stream:${ALL}:AllowAll`] });
+    expect(ctx.previewPreset("dashboard_viewer").adds).not.toContain(`stream:${ALL}:AllowList`);
+    ctx.grants.toggle(`stream:${ALL}:AllowAll`);
+    expect(ctx.previewPreset("dashboard_viewer").adds).toContain(`stream:${ALL}:AllowList`);
+  });
+
+  it("counts a saved grant staged for removal as an add, and Add restores it", async () => {
+    const ctx = setup({ saved: [`afolder:${ALL}:AllowAll`] });
+    ctx.grants.toggle(`afolder:${ALL}:AllowAll`);
+    const preview = ctx.previewPreset("alert_manager");
+    expect(preview.adds).toHaveLength(5);
+    expect(preview.adds).toContain(`afolder:${ALL}:AllowAll`);
+    expect(preview.restores).toEqual([`afolder:${ALL}:AllowAll`]);
+
+    await ctx.applyPreset("alert_manager", { announce: true });
+
+    expect(mockToast).toHaveBeenCalledWith({
+      variant: "success",
+      message: "Alert Manager: 4 permissions added. Review Changes before you save.",
+    });
+    expect(ctx.grants.removed.value).toEqual({});
+    expect(ctx.grants.has(`afolder:${ALL}:AllowAll`)).toBe(true);
+    expect(added(ctx)).not.toContain(`afolder:${ALL}:AllowAll`);
+  });
+});
+
+describe("useRolePresets - stream presets", () => {
+  it("reports loading until the lists load, then ready", async () => {
+    const ctx = setup();
+    expect(ctx.previewPreset("k8s")).toEqual({
+      status: "loading",
+      adds: [],
+      restores: [],
+      skipped: 0,
+      stillMissing: [],
+    });
+    await ctx.loadPresetStreams();
+    const preview = ctx.previewPreset("k8s");
+    expect(preview.status).toBe("ready");
+    expect(preview.noMatchingStreams).toBe(false);
+    expect(preview.adds).toEqual(["metrics:system_cpu_time:AllowGet", `metrics:${ALL}:AllowList`]);
+  });
+
+  it("loads the metrics and logs lists once, quietly", async () => {
+    const ctx = setup();
+    await Promise.all([ctx.loadPresetStreams(), ctx.loadPresetStreams()]);
+    await ctx.loadPresetStreams();
+    expect(ctx.getStreams.mock.calls).toEqual([
+      ["metrics", false, false, false],
+      ["logs", false, false, false],
+    ]);
+    expect(ctx.getResourceEntities.mock.calls.map(([resource]) => resource.name)).toEqual([
+      "stream",
+      "stream",
+      "metrics",
+      "logs",
+    ]);
+    expect(mockToast).not.toHaveBeenCalled();
+  });
+
+  it("reads a list that matched no curated stream fresh on the next call, and finds streams ingested since", async () => {
+    const metrics = ["cpu"];
+    const ctx = setup({ metrics });
+    await ctx.loadPresetStreams();
+    expect(ctx.previewPreset("k8s").noMatchingStreams).toBe(true);
+
+    metrics.push("system_cpu_time");
+    await ctx.loadPresetStreams();
+
+    expect(ctx.getStreams).toHaveBeenLastCalledWith("metrics", false, false, true);
+    expect(ctx.previewPreset("k8s")).toMatchObject({
+      status: "ready",
+      noMatchingStreams: false,
+      adds: ["metrics:system_cpu_time:AllowGet", `metrics:${ALL}:AllowList`],
+    });
+  });
+
+  it("rebuilds the rows from the read that follows a failed refresh", async () => {
+    const metrics = ["cpu"];
+    const failTypes: string[] = [];
+    const ctx = setup({ metrics, failTypes });
+    await ctx.loadPresetStreams();
+
+    metrics.push("postgresql_backends");
+    failTypes.push("metrics");
+    await ctx.loadPresetStreams();
+    expect(ctx.previewPreset("dbm").status).toBe("failed");
+
+    failTypes.pop();
+    await ctx.loadPresetStreams();
+    expect(ctx.previewPreset("dbm").adds).toContain("metrics:postgresql_backends:AllowGet");
+  });
+
+  it("reads a matched list fresh once it is older than the stream list cache", async () => {
+    const now = vi.spyOn(Date, "now").mockReturnValue(0);
+    const ctx = setup();
+    await ctx.loadPresetStreams();
+    await ctx.loadPresetStreams();
+    expect(ctx.getStreams).toHaveBeenCalledTimes(2);
+
+    now.mockReturnValue(MEDIUM_STALE_TIME);
+    await ctx.loadPresetStreams();
+    expect(ctx.getStreams.mock.calls.slice(2)).toEqual([
+      ["metrics", false, false, true],
+      ["logs", false, false, true],
+    ]);
+    now.mockRestore();
+  });
+
+  it("reports failed when a list does not load, and the next call retries only that list", async () => {
+    const ctx = setup({ failTypes: ["metrics", "logs"] });
+    await ctx.loadPresetStreams();
+    expect(ctx.previewPreset("dbm").status).toBe("failed");
+    await ctx.loadPresetStreams();
+    expect(ctx.getStreams).toHaveBeenCalledTimes(4);
+    expect(mockToast).not.toHaveBeenCalled();
+  });
+
+  it("keeps the metrics presets ready when only the logs list fails", async () => {
+    const ctx = setup({ failTypes: ["logs"] });
+    await ctx.loadPresetStreams();
+    expect(ctx.previewPreset("k8s").status).toBe("ready");
+    expect(ctx.previewPreset("dbm").status).toBe("ready");
+    expect(ctx.previewPreset("rum_viewer").status).toBe("failed");
+    expect(ctx.previewPreset("rum_editor").status).toBe("failed");
+
+    await ctx.loadPresetStreams();
+    expect(ctx.getStreams.mock.calls.map(([type]) => type)).toEqual(["metrics", "logs", "logs"]);
+  });
+
+  it("counts only curated streams that exist in this org", async () => {
+    const ctx = setup();
+    await ctx.loadPresetStreams();
+    expect([...ctx.previewPreset("dbm").adds].sort()).toEqual([
+      `db_monitoring:${ALL}:AllowGet`,
+      `db_monitoring:${ALL}:AllowList`,
+      `metrics:${ALL}:AllowList`,
+      "metrics:mysql_threads:AllowGet",
+      "metrics:postgresql_backends:AllowGet",
+      "metrics:system_cpu_time:AllowGet",
+    ]);
+  });
+
+  it("flags no matching streams and never reads In Role then", async () => {
+    const ctx = setup({ metrics: ["cpu"], logs: ["app"] });
+    await ctx.loadPresetStreams();
+    const k8s = ctx.previewPreset("k8s");
+    expect(k8s).toMatchObject({ status: "ready", adds: [], noMatchingStreams: true });
+    expect(inRole(k8s)).toBe(false);
+    expect(ctx.previewPreset("dbm").adds).toEqual([
+      `db_monitoring:${ALL}:AllowList`,
+      `db_monitoring:${ALL}:AllowGet`,
+    ]);
+  });
+
+  it("skips a curated stream Get the role holds on its type, but still adds the type List", async () => {
+    const ctx = setup({ saved: [`metrics:${ALL}:AllowGet`] });
+    await ctx.loadPresetStreams();
+    expect(ctx.previewPreset("k8s")).toMatchObject({
+      adds: [`metrics:${ALL}:AllowList`],
+      skipped: 1,
+    });
+  });
+
+  it("skips the type List the role holds on every stream", async () => {
+    const ctx = setup({ saved: [`stream:${ALL}:AllowList`] });
+    await ctx.loadPresetStreams();
+    expect(ctx.previewPreset("k8s").adds).toEqual(["metrics:system_cpu_time:AllowGet"]);
+  });
+
+  it("dbm stages the curated streams, the List-only metrics type node and db_monitoring", async () => {
+    const ctx = setup();
+    await ctx.applyPreset("dbm", { announce: true });
+    expect(added(ctx)).toEqual([
+      `db_monitoring:${ALL}:AllowGet`,
+      `db_monitoring:${ALL}:AllowList`,
+      `metrics:${ALL}:AllowList`,
+      "metrics:mysql_threads:AllowGet",
+      "metrics:postgresql_backends:AllowGet",
+      "metrics:system_cpu_time:AllowGet",
+    ]);
+    expect(added(ctx)).not.toContain(`metrics:${ALL}:AllowGet`);
+    expect(mockToast).toHaveBeenCalledTimes(1);
+    expect(mockToast).toHaveBeenCalledWith({
+      variant: "success",
+      message: t("iam.editRole.presetApplied", {
+        title: t("iam.editRole.presetDbmTitle"),
+        permissions: t("iam.editRole.presetPermissionCount", { count: 6 }, 6),
+      }),
+    });
+  });
+
+  it("k8s stages nothing and warns when no curated stream matches", async () => {
+    const ctx = setup({ metrics: ["cpu"] });
+    await ctx.applyPreset("k8s", { announce: true });
+    expect(added(ctx)).toEqual([]);
+    expect(mockToast).toHaveBeenCalledWith({
+      variant: "warning",
+      message: t("iam.editRole.k8sPresetNoMatch", { total: K8S_VIEWER_STREAMS.length }),
+    });
+  });
+
+  it("rum_viewer stages sourcemaps List and the RUM log streams; rum_editor adds the writes", async () => {
+    const viewer = setup();
+    await viewer.applyPreset("rum_viewer");
+    expect(added(viewer)).toEqual([
+      `logs:${ALL}:AllowList`,
+      "logs:_rumdata:AllowGet",
+      "logs:_sessionreplay:AllowGet",
+      `sourcemaps:${ALL}:AllowList`,
+    ]);
+
+    const editor = setup();
+    await editor.applyPreset("rum_editor");
+    expect(added(editor)).toEqual([
+      `logs:${ALL}:AllowList`,
+      "logs:_rumdata:AllowGet",
+      "logs:_sessionreplay:AllowGet",
+      `rum_analytics:${ALL}:AllowDelete`,
+      `rum_analytics:${ALL}:AllowPost`,
+      `rum_analytics:${ALL}:AllowPut`,
+      `sourcemaps:${ALL}:AllowList`,
+    ]);
+  });
+
+  it("stages only what the preview counted when opening the type reloads more streams", async () => {
+    const metrics: string[] = [];
+    const ctx = setup({ metrics });
+    await ctx.loadPresetStreams();
+    const { adds } = ctx.previewPreset("dbm");
+    expect([...adds].sort()).toEqual([
+      `db_monitoring:${ALL}:AllowGet`,
+      `db_monitoring:${ALL}:AllowList`,
+    ]);
+
+    metrics.push("postgresql_backends");
+    await ctx.applyPreset("dbm", { announce: true });
+
+    expect(added(ctx)).toEqual([...adds].sort());
+  });
+
+  it("readonly stages List and Get on every visible top-level resource, minus hidden actions", () => {
+    const ctx = setup();
+    ctx.seedReadonlyPreset();
+    const keys = added(ctx);
+    expect(keys).toContain(`settings:${ALL}:AllowGet`);
+    expect(keys).not.toContain(`settings:${ALL}:AllowList`);
+    expect(keys.some((key) => key.startsWith("rum_analytics:"))).toBe(false);
+    expect(keys).toHaveLength(MODULES.length * 2 - 3);
+    expect(mockToast).not.toHaveBeenCalled();
+  });
+});
+
+describe("useRolePresets - apply", () => {
+  it("stages exactly the previewed adds in one batch", async () => {
+    const ctx = setup({ saved: [`stream:${ALL}:AllowList`] });
+    const { adds } = ctx.previewPreset("pipeline_editor");
+    await ctx.applyPreset("pipeline_editor");
+    expect(ctx.handlePermissionBatchChange).toHaveBeenCalledTimes(1);
+    expect(added(ctx)).toEqual([...adds].sort());
+  });
+
+  it("never toggles a held grant off, even when applied twice", async () => {
+    const ctx = setup({ saved: [`afolder:${ALL}:AllowAll`] });
+    await ctx.applyPreset("alert_manager");
+    await ctx.applyPreset("alert_manager");
+    await ctx.applyPreset("readonly");
+    await ctx.applyPreset("readonly");
+    expect(ctx.grants.removed.value).toEqual({});
+    expect(ctx.grants.has(`afolder:${ALL}:AllowAll`)).toBe(true);
+    expect(added(ctx)).toContain(`template:${ALL}:AllowAll`);
+  });
+
+  it("ignores a second apply while the first is in flight", async () => {
+    const ctx = setup();
+    const first = ctx.applyPreset("k8s");
+    expect(ctx.applyingPreset.value).toBe(true);
+    const second = ctx.applyPreset("alert_manager", { announce: true });
+    ctx.seedReadonlyPreset();
+    await Promise.all([first, second]);
+
+    expect(ctx.applyingPreset.value).toBe(false);
+    expect(added(ctx)).toEqual([`metrics:${ALL}:AllowList`, "metrics:system_cpu_time:AllowGet"]);
+    expect(mockToast).toHaveBeenCalledTimes(1);
+  });
+
+  it("toasts the staged count when announced", async () => {
+    const ctx = setup();
+    await ctx.applyPreset("alert_manager", { announce: true });
+    expect(mockToast).toHaveBeenCalledWith({
+      variant: "success",
+      message: "Alert Manager: 5 permissions added. Review Changes before you save.",
+    });
+  });
+
+  it("uses the singular for one permission", async () => {
+    const ctx = setup({ saved: [`dfolder:${ALL}:AllowAll`, `stream:${ALL}:AllowList`] });
+    await ctx.applyPreset("dashboard_editor", { announce: true });
+    expect(mockToast).toHaveBeenCalledWith({
+      variant: "success",
+      message: "Dashboard Editor: 1 permission added. Review Changes before you save.",
+    });
+  });
+
+  it("says restored, not added, when the preset only undoes staged removals", async () => {
+    const saved = [`dfolder:${ALL}:AllowAll`, `stream:${ALL}:AllowList`, `stream:${ALL}:AllowGet`];
+    const ctx = setup({ saved });
+    saved.forEach((key) => ctx.grants.toggle(key));
+    await ctx.applyPreset("dashboard_editor", { announce: true });
+    expect(ctx.grants.removed.value).toEqual({});
+    expect(added(ctx)).toEqual([]);
+    expect(mockToast).toHaveBeenCalledWith({
+      variant: "success",
+      message: "Dashboard Editor: 3 permissions restored. Review Changes before you save.",
+    });
+  });
+
+  it("does not toast without announce, or when nothing was staged", async () => {
+    const ctx = setup();
+    await ctx.applyPreset("readonly");
+    await ctx.applyPreset("readonly", { announce: true });
+    expect(mockToast).not.toHaveBeenCalled();
+  });
+
+  it("stages nothing and does not toast for an unknown id", async () => {
+    const ctx = setup();
+    await ctx.applyPreset("nope", { announce: true });
+    expect(added(ctx)).toEqual([]);
+    expect(mockToast).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/composables/iam/useRolePresets.ts b/web/src/composables/iam/useRolePresets.ts
index c7ea48f36e..a28e77e899 100644
--- a/web/src/composables/iam/useRolePresets.ts
+++ b/web/src/composables/iam/useRolePresets.ts
@@ -13,10 +13,16 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import type { Ref } from "vue";
+import { computed, readonly, ref, type ComputedRef, type Ref } from "vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
-import type { Resource, Entity } from "@/ts/interfaces";
-import type { I18nText } from "@/types/i18n";
+import type { Resource, Entity, PermissionType } from "@/ts/interfaces";
+import { raw, type TranslateFn } from "@/types/i18n";
+import { useRoleScopes } from "@/composables/iam/useRoleScopes";
+import { buildGrantKey, splitGrantKey } from "@/composables/iam/useRoleGrants";
+import { MEDIUM_STALE_TIME } from "@/composables/query/cachePolicy";
+import { STREAM_PARENT_KEY } from "@/components/iam/roles/roleModules";
+import { findCompanionGaps, type CompanionGap } from "@/components/iam/roles/roleCompanions";
+import { JOB_PRESETS, type JobPreset } from "@/components/iam/roles/jobPresets";
 import {
   DBM_MODULE_RESOURCE,
   DBM_VIEWER_STREAM_ROW_PERMS,
@@ -40,28 +46,127 @@ import {
   type RumPreset,
 } from "@/components/iam/roles/rumPresets";
 
+export type PresetSection = "builtin" | "job";
+
+export type PresetInfo = {
+  id: string;
+  section: PresetSection;
+  titleKey: string;
+  descriptionKey: string;
+  icon: JobPreset["icon"];
+  tone: JobPreset["tone"];
+};
+
+export type PresetPreview = {
+  status: "ready" | "loading" | "failed";
+  /** Grant keys Add will stage, including saved keys now staged for removal. */
+  adds: string[];
+  /** The part of `adds` that undoes a staged removal of a saved grant, so it is no change to the payload. */
+  restores: string[];
+  /** Grants already effective, directly or through a wider scope. */
+  skipped: number;
+  stillMissing: CompanionGap[];
+  noMatchingStreams?: boolean;
+  /** Add will stage a Get or All on every stream in the org, new ones included. */
+  readsEveryStream?: boolean;
+};
+
+type Row = Resource | Entity;
+type Grant = { row: Row; permission: PermissionType };
+
+const READONLY_PERMS: readonly PermissionType[] = ["AllowList", "AllowGet"];
+
 // db_monitoring is checked as a plain GET (never LIST), and has no child
 // entities for a wildcard relation to reach — unlike the `metrics` type node,
 // AllowGet on it grants nothing beyond the module itself.
-const DBM_MODULE_PERMS = ["AllowList", "AllowGet"] as const;
+const DBM_MODULE_PERMS: readonly PermissionType[] = ["AllowList", "AllowGet"];
+
+const ACTION_ORDER = ["AllowAll", "AllowList", "AllowGet", "AllowPost", "AllowPut", "AllowDelete"];
+
+// The ids AddRole's "Start from" and the `?preset=` link send.
+const BUILTIN_PRESETS: Omit<JobPreset, "grants">[] = [
+  {
+    id: "readonly",
+    titleKey: "iam.editRole.presetReadonlyTitle",
+    descriptionKey: "iam.editRole.presetReadonlyDescription",
+    icon: "visibility",
+    tone: "other",
+  },
+  {
+    id: "dbm",
+    titleKey: "iam.editRole.presetDbmTitle",
+    descriptionKey: "iam.editRole.presetDbmDescription",
+    icon: "database",
+    tone: "monitoring",
+  },
+  {
+    id: "k8s",
+    titleKey: "iam.editRole.presetK8sTitle",
+    descriptionKey: "iam.editRole.presetK8sDescription",
+    icon: "cloud",
+    tone: "monitoring",
+  },
+  {
+    id: "rum_viewer",
+    titleKey: "iam.editRole.presetRumViewerTitle",
+    descriptionKey: "iam.editRole.presetRumViewerDescription",
+    icon: "devices",
+    tone: "monitoring",
+  },
+  {
+    id: "rum_editor",
+    titleKey: "iam.editRole.presetRumEditorTitle",
+    descriptionKey: "iam.editRole.presetRumEditorDescription",
+    icon: "insights",
+    tone: "data",
+  },
+];
+
+// The stream type whose curated names each stream preset ticks; its list alone decides the preset's status.
+const STREAM_TYPE_OF = new Map([
+  ["dbm", "metrics"],
+  ["k8s", "metrics"],
+  ["rum_viewer", "logs"],
+  ["rum_editor", "logs"],
+]);
+
+const toInfo = (preset: Omit<JobPreset, "grants">, section: PresetSection): PresetInfo => ({
+  id: preset.id,
+  section,
+  titleKey: preset.titleKey,
+  descriptionKey: preset.descriptionKey,
+  icon: preset.icon,
+  tone: preset.tone,
+});
 
 type PresetDeps = {
   permissionsState: { permissions: Resource[] };
   resourceMapper: Ref<{ [key: string]: Resource }>;
   heavyResourceEntities: Ref<{ [key: string]: Entity[] }>;
-  /** Presets skip a grant the role already holds, since staging it again would revoke it. */
-  grants: { has: (key: string) => boolean };
-  permissionHashFor: (row: any, permission: string) => string;
-  handlePermissionChange: (row: any, permission: string) => void;
+  /** Presets judge "already held" on the live grants, since staging a held key again would revoke it. */
+  grants: {
+    current: Ref<Set<string>>;
+    removed: Ref<Record<string, unknown>>;
+  };
+  permissionHashFor: (row: Row, permission: string) => string;
   handlePermissionBatchChange: (
-    changes: { row: any; permission: string; newValue: boolean }[],
+    changes: { row: Row; permission: string; newValue: boolean }[],
   ) => void;
-  /** Loads a node's children, which the stream presets need before they can tick a stream. */
-  expandPermission: (resource: any) => Promise<unknown>;
-  t: (key: string, named?: Record<string, unknown>) => I18nText;
+  /** Opens a node and loads its children, which the `?preset=` link needs before it can tick a stream. */
+  expandPermission: (resource: Row) => Promise<unknown>;
+  /** Loads a node's children without opening it, so the panel can count the stream presets. */
+  getResourceEntities?: (resource: Row) => Promise<unknown>;
+  /** Reads a stream list with or without the loading toast; `force` skips the cached list. */
+  getStreams?: (
+    type: string,
+    schema: boolean,
+    notify?: boolean,
+    force?: boolean,
+  ) => Promise<unknown>;
+  t: TranslateFn;
 };
 
-/** The starting points a new role can be seeded from, staged exactly as clicking would. */
+/** The starting points a role can be built from, previewed and staged exactly as clicking would. */
 export const useRolePresets = (deps: PresetDeps) => {
   const {
     permissionsState,
@@ -69,86 +174,200 @@ export const useRolePresets = (deps: PresetDeps) => {
     heavyResourceEntities,
     grants,
     permissionHashFor,
-    handlePermissionChange,
     handlePermissionBatchChange,
     expandPermission,
+    getResourceEntities,
+    getStreams,
     t,
   } = deps;
 
-  // Seed AllowList + AllowGet on every visible top-level resource. Mirrors a
-  // user manually checking those two columns, so the changes flow through the
-  // normal added/removed-permission bookkeeping and the Save payload.
-  const seedReadonlyPreset = () => {
-    const readonlyPerms = ["AllowList", "AllowGet"];
-    permissionsState.permissions.forEach((resource: Resource) => {
-      readonlyPerms.forEach((perm) => {
-        const permDetail = resource.permission?.[perm as "AllowList"];
-        // Held grants are the source of truth: `value` survives an undo and would make the preset a no-op.
-        if (!permDetail || !permDetail.show || grants.has(permissionHashFor(resource, perm)))
-          return;
-        permDetail.value = true;
-        handlePermissionChange(resource, perm);
-      });
-    });
+  const isGranted = (node: Row, action: string) =>
+    grants.current.value.has(permissionHashFor(node, action));
+
+  // model.fga defines every action as `ALLOW_ALL or ALLOW_<ACTION>`.
+  const holds = (node: Row, action: string) =>
+    isGranted(node, action) || isGranted(node, "AllowAll");
+
+  // Only each scope's `covers` and `node` are read here, so its labels are never shown.
+  const { moduleScopes, streamTypeScopes } = useRoleScopes({
+    resourceMapper,
+    isGranted,
+    resourceLabel: (key) => key,
+    moduleLabel: raw,
+    t,
+    ACTION_ORDER,
+  });
+
+  // permissionHashFor writes `_all_<org>` on every catalogue node, so the org id is read back from the same source.
+  const orgId = () => {
+    const [node] = Object.values(resourceMapper.value);
+    return node ? splitGrantKey(permissionHashFor(node, "")).entity.slice("_all_".length) : "";
   };
 
-  const collectVisibleReadGrants = (row: Entity, perms: readonly (keyof Entity["permission"])[]) =>
-    perms
-      .filter((perm) => {
-        const permDetail = row.permission?.[perm];
-        return (
-          !!permDetail && permDetail.show && !grants.has(permissionHashFor(row, perm as string))
-        );
-      })
-      .map((perm) => ({ row, permission: perm as string, newValue: true }));
+  const streamTypeNodes = () => resourceMapper.value[STREAM_PARENT_KEY]?.entities ?? [];
 
-  // Stream rows are lazily loaded CHILDREN of the `stream` resource, so both the
-  // `stream` node and its `metrics` child must be expanded (which fetches the
-  // org's streams) before any row exists to tick. `db_monitoring` is a separate,
-  // module-level toggle resource with no entities of its own — it is ticked
-  // directly off resourceMapper, no expand needed.
-  const seedDbmViewerPreset = async () => {
-    const changes: { row: any; permission: string; newValue: boolean }[] = [];
+  const streamTypeNode = (type: string) => streamTypeNodes().find((node) => node.name === type);
 
-    const dbMonitoringResource = resourceMapper.value[DBM_MODULE_RESOURCE];
-    if (dbMonitoringResource) {
-      changes.push(...collectVisibleReadGrants(dbMonitoringResource, DBM_MODULE_PERMS));
-    }
+  // Stream types and streams are the only preset rows under a wider scope; a module row has none.
+  const widerScopes = (row: Row) => {
+    if (streamTypeNodes().some((node) => node === row)) return moduleScopes(STREAM_PARENT_KEY);
+    const typeNode = streamTypeNode(row.resourceName);
+    return typeNode ? streamTypeScopes(typeNode) : [];
+  };
 
-    const streamResource = resourceMapper.value["stream"];
-    let matched = 0;
-    if (streamResource) {
-      if (!streamResource.expand) await expandPermission(streamResource);
+  // The pane's lock rule (ModulePane isInherited) on the live grants, so a wider grant staged for removal no longer counts.
+  const isEffective = ({ row, permission }: Grant) =>
+    holds(row, permission) ||
+    widerScopes(row).some(
+      (scope) =>
+        !!scope.node && scope.covers.includes(row.resourceName) && holds(scope.node, permission),
+    );
 
-      const metricsEntity = streamResource.entities?.find(
-        (entity: Entity) => entity.name === "metrics",
+  // A hidden checkbox is an action FGA rejects, and one rejected tuple fails the whole save.
+  const visible = (row: Row | undefined, perms: readonly PermissionType[]): Grant[] =>
+    row
+      ? perms
+          .filter((permission) => row.permission?.[permission]?.show)
+          .map((permission) => ({ row, permission }))
+      : [];
+
+  // `typeNode.entities` holds only rows under the current filter, so curated names are matched on the full list.
+  const curatedStreamGrants = (
+    type: string,
+    streams: string[],
+    rowPerms: readonly PermissionType[],
+    typePerms: readonly PermissionType[],
+  ) => {
+    const typeNode = streamTypeNode(type);
+    const curated = new Set(streams);
+    const rows = typeNode
+      ? (heavyResourceEntities.value[type] ?? []).filter((row) => curated.has(row.name))
+      : [];
+    // GET /{org}/streams is checked against the type node and LIST rejects ALLOW_GET there; ALLOW_GET would wildcard every stream of the type, so the node is LIST-only and only after a match.
+    return {
+      matched: rows.length,
+      grants: [
+        ...rows.flatMap((row) => visible(row, rowPerms)),
+        ...(rows.length ? visible(typeNode, typePerms) : []),
+      ],
+    };
+  };
+
+  // Module grants are staged even with no matching stream; the matched count feeds the toast.
+  const resolvePreset = (presetId: string): { grants: Grant[]; matched?: number } | null => {
+    if (presetId === "readonly")
+      return {
+        grants: permissionsState.permissions.flatMap((resource) =>
+          visible(resource, READONLY_PERMS),
+        ),
+      };
+    if (presetId === "dbm") {
+      const streams = curatedStreamGrants(
+        "metrics",
+        DBM_VIEWER_STREAMS,
+        DBM_VIEWER_STREAM_ROW_PERMS,
+        DBM_VIEWER_TYPE_NODE_PERMS,
       );
-      if (metricsEntity) {
-        if (!metricsEntity.expand) await expandPermission(metricsEntity);
-
-        // `metrics.entities` only holds rows visible under the current filter, so seeding off it would silently miss streams.
-        const rows = heavyResourceEntities.value["metrics"] ?? [];
-        const curated = new Set(DBM_VIEWER_STREAMS);
-        const matchedRows = rows.filter((row: Entity) => curated.has(row.name));
-        matched = matchedRows.length;
-        changes.push(
-          ...matchedRows.flatMap((row: Entity) =>
-            collectVisibleReadGrants(row, DBM_VIEWER_STREAM_ROW_PERMS),
+      return {
+        matched: streams.matched,
+        grants: [
+          ...visible(resourceMapper.value[DBM_MODULE_RESOURCE], DBM_MODULE_PERMS),
+          ...streams.grants,
+        ],
+      };
+    }
+    if (presetId === "k8s")
+      return curatedStreamGrants(
+        "metrics",
+        K8S_VIEWER_STREAMS,
+        K8S_VIEWER_STREAM_ROW_PERMS,
+        K8S_VIEWER_TYPE_NODE_PERMS,
+      );
+    if (presetId === "rum_viewer" || presetId === "rum_editor") {
+      const streams = curatedStreamGrants(
+        "logs",
+        RUM_STREAMS,
+        RUM_STREAM_ROW_PERMS,
+        RUM_TYPE_NODE_PERMS,
+      );
+      return {
+        matched: streams.matched,
+        grants: [
+          ...visible(resourceMapper.value[RUM_SOURCEMAPS_RESOURCE], RUM_SOURCEMAPS_PERMS),
+          ...(RUM_PRESETS[presetId].withWrite
+            ? visible(resourceMapper.value[RUM_ANALYTICS_RESOURCE], RUM_ANALYTICS_WRITE_PERMS)
+            : []),
+          ...streams.grants,
+        ],
+      };
+    }
+    const job = JOB_PRESETS.find((preset) => preset.id === presetId);
+    return job
+      ? {
+          grants: Object.entries(job.grants).flatMap(([key, perms]) =>
+            visible(resourceMapper.value[key], perms),
           ),
-        );
-
-        // GET /{org}/streams is checked against `metrics:_all_<org>`, never the per-stream objects, and FGA's LIST relation does not accept ALLOW_GET; ALLOW_GET here would instead wildcard every metric stream in the org, so the type node is LIST-only.
-        if (matchedRows.length) {
-          changes.push(...collectVisibleReadGrants(metricsEntity, DBM_VIEWER_TYPE_NODE_PERMS));
         }
-      }
-    }
+      : null;
+  };
 
-    if (changes.length) {
-      handlePermissionBatchChange(changes);
-    }
+  // Toggle revokes a held key and a repeated key cancels itself, so only new keys reach it, once each.
+  const pendingGrants = (list: Grant[]) => {
+    const seen = new Set<string>();
+    const adds = list.filter((grant) => {
+      const key = permissionHashFor(grant.row, grant.permission);
+      if (seen.has(key)) return false;
+      seen.add(key);
+      return !isEffective(grant);
+    });
+    return { adds, unique: seen.size };
+  };
 
-    reportDbmViewerSeeding(matched, DBM_VIEWER_STREAMS.length);
+  const isRestore = (key: string) => key in grants.removed.value;
+
+  type Staged = { added: number; restored: number };
+
+  const stage = (list: Grant[]): Staged => {
+    const { adds } = pendingGrants(list);
+    // Read before staging, since the toggle clears the removal.
+    const restored = adds.filter((grant) =>
+      isRestore(permissionHashFor(grant.row, grant.permission)),
+    ).length;
+    if (adds.length)
+      handlePermissionBatchChange(adds.map((grant) => ({ ...grant, newValue: true })));
+    return { added: adds.length - restored, restored };
+  };
+
+  const applying = ref(false);
+
+  // A double click or a panel Add racing the `?preset=` seed must not run a second apply over the first.
+  const locked = async (run: () => Promise<void> | void) => {
+    if (applying.value) return;
+    applying.value = true;
+    try {
+      await run();
+    } finally {
+      applying.value = false;
+    }
+  };
+
+  // Respects the lock but never takes it: it is synchronous, so nothing can race it.
+  const seedReadonlyPreset = () => {
+    if (applying.value) return;
+    stage(resolvePreset("readonly")?.grants ?? []);
+  };
+
+  // Per stream type, so a 403 on logs leaves the metrics presets usable.
+  const streamStatus = ref<Record<string, "loading" | "loaded" | "failed">>({});
+  const streamLoads = new Map<string, { load: Promise<void>; at: number }>();
+
+  // The `?preset=` link opens the nodes so the ticked rows show; expandPermission toggles, so only a collapsed node is opened.
+  const openStreamType = async (type: string) => {
+    const streamResource = resourceMapper.value[STREAM_PARENT_KEY];
+    if (!streamResource) return;
+    if (!streamResource.expand) await expandPermission(streamResource);
+    const typeNode = streamTypeNode(type);
+    if (typeNode && !typeNode.expand) await expandPermission(typeNode);
   };
 
   const reportDbmViewerSeeding = (matched: number, total: number) => {
@@ -159,41 +378,6 @@ export const useRolePresets = (deps: PresetDeps) => {
     );
   };
 
-  // Stream rows are lazily loaded CHILDREN of the `stream` resource, so both the `stream` node and its `metrics` child must be expanded (which fetches the org's streams) before any row exists to tick.
-  const seedK8sViewerPreset = async () => {
-    const streamResource = resourceMapper.value["stream"];
-    if (!streamResource) return;
-
-    // expandPermission toggles, so only call it on a node that is still collapsed.
-    if (!streamResource.expand) await expandPermission(streamResource);
-
-    const metricsEntity = streamResource.entities?.find(
-      (entity: Entity) => entity.name === "metrics",
-    );
-    if (!metricsEntity) return;
-
-    if (!metricsEntity.expand) await expandPermission(metricsEntity);
-
-    // `metrics.entities` only holds rows visible under the current filter, so seeding off it would silently miss streams.
-    const rows = heavyResourceEntities.value["metrics"] ?? [];
-    const curated = new Set(K8S_VIEWER_STREAMS);
-    const matched = rows.filter((row: Entity) => curated.has(row.name));
-    const changes = matched.flatMap((row: Entity) =>
-      collectVisibleReadGrants(row, K8S_VIEWER_STREAM_ROW_PERMS),
-    );
-
-    // GET /{org}/streams is checked against `metrics:_all_<org>`, never the per-stream objects, and FGA's LIST relation does not accept ALLOW_GET; ALLOW_GET here would instead wildcard every metric stream in the org, so the type node is LIST-only.
-    if (matched.length) {
-      changes.push(...collectVisibleReadGrants(metricsEntity, K8S_VIEWER_TYPE_NODE_PERMS));
-    }
-
-    if (changes.length) {
-      handlePermissionBatchChange(changes);
-    }
-
-    reportK8sViewerSeeding(matched.length, K8S_VIEWER_STREAMS.length);
-  };
-
   const reportK8sViewerSeeding = (matched: number, total: number) => {
     toast(
       matched
@@ -202,77 +386,177 @@ export const useRolePresets = (deps: PresetDeps) => {
     );
   };
 
-  // Module grants are staged even before RUM ingestion; the logs type node only when a RUM stream matched, like DBM.
-  const seedRumPreset = async (preset: RumPreset) => {
-    const changes: { row: any; permission: string; newValue: boolean }[] = [];
-    const modules: [string, readonly (keyof Entity["permission"])[]][] = [
-      [RUM_SOURCEMAPS_RESOURCE, RUM_SOURCEMAPS_PERMS],
-      ...(RUM_PRESETS[preset].withWrite
-        ? [
-            [RUM_ANALYTICS_RESOURCE, RUM_ANALYTICS_WRITE_PERMS] as [
-              string,
-              typeof RUM_ANALYTICS_WRITE_PERMS,
-            ],
-          ]
-        : []),
-    ];
-    for (const [name, perms] of modules) {
-      const resource = resourceMapper.value[name];
-      if (resource) changes.push(...collectVisibleReadGrants(resource, perms));
-    }
+  // A loaded list is the one the panel previewed, so Add stages from it before opening the type, whose reload could add streams the button never counted; the link has no list yet, so it opens first.
+  const stageStreamPreset = async (presetId: string, type: string) => {
+    const previewed = streamStatus.value[type] === "loaded";
+    if (!previewed) await openStreamType(type);
+    const resolved = resolvePreset(presetId);
+    const staged = stage(resolved?.grants ?? []);
+    if (previewed) await openStreamType(type);
+    return { resolved, staged };
+  };
 
-    let matched = 0;
-    const streamResource = resourceMapper.value["stream"];
-    if (streamResource) {
-      if (!streamResource.expand) await expandPermission(streamResource);
-      const logsEntity = streamResource.entities?.find((entity: Entity) => entity.name === "logs");
-      if (logsEntity) {
-        if (!logsEntity.expand) await expandPermission(logsEntity);
-        const rows = heavyResourceEntities.value["logs"] ?? [];
-        const curated = new Set(RUM_STREAMS);
-        const matchedRows = rows.filter((row: Entity) => curated.has(row.name));
-        matched = matchedRows.length;
-        changes.push(
-          ...matchedRows.flatMap((row: Entity) =>
-            collectVisibleReadGrants(row, RUM_STREAM_ROW_PERMS),
-          ),
-        );
-        if (matched) changes.push(...collectVisibleReadGrants(logsEntity, RUM_TYPE_NODE_PERMS));
+  // An undone removal is no change to the saved role, so it is never counted as added.
+  const announceApplied = (presetId: string, { added, restored }: Staged) => {
+    const preset = [...BUILTIN_PRESETS, ...JOB_PRESETS].find((item) => item.id === presetId);
+    const count = added || restored;
+    if (!count || !preset) return;
+    toast({
+      variant: "success",
+      message: t(added ? "iam.editRole.presetApplied" : "iam.editRole.presetRestored", {
+        title: t(preset.titleKey),
+        permissions: t("iam.editRole.presetPermissionCount", { count }, count),
+      }),
+    });
+  };
+
+  // The panel gets the same applied toast as the job presets; the `?preset=` link keeps the seeding toast.
+  const seedDbmViewerPreset = (opts: { announce?: boolean } = {}) =>
+    locked(async () => {
+      const { resolved, staged } = await stageStreamPreset("dbm", "metrics");
+      if (opts.announce && resolved?.matched) return announceApplied("dbm", staged);
+      reportDbmViewerSeeding(resolved?.matched ?? 0, DBM_VIEWER_STREAMS.length);
+    });
+
+  const seedK8sViewerPreset = (opts: { announce?: boolean } = {}) =>
+    locked(async () => {
+      const { resolved, staged } = await stageStreamPreset("k8s", "metrics");
+      // With no metrics node there is no stream list to match, so there is nothing to report.
+      if (!streamTypeNode("metrics")) return;
+      if (opts.announce && resolved?.matched) return announceApplied("k8s", staged);
+      reportK8sViewerSeeding(resolved?.matched ?? 0, K8S_VIEWER_STREAMS.length);
+    });
+
+  const seedRumPreset = (preset: RumPreset, opts: { announce?: boolean } = {}) =>
+    locked(async () => {
+      const { resolved, staged } = await stageStreamPreset(preset, "logs");
+      const total = RUM_STREAMS.length;
+      if (opts.announce && resolved?.matched) return announceApplied(preset, staged);
+      toast(
+        resolved?.matched
+          ? {
+              variant: "info",
+              message: t("iam.editRole.rumPresetSeeded", { matched: resolved.matched, total }),
+            }
+          : { variant: "warning", message: t("iam.editRole.rumPresetNoMatch", { total }) },
+      );
+    });
+
+  const applyPreset = (presetId: string, opts: { announce?: boolean } = {}): Promise<void> => {
+    if (presetId === "dbm") return seedDbmViewerPreset(opts);
+    if (presetId === "k8s") return seedK8sViewerPreset(opts);
+    if (presetId === "rum_viewer" || presetId === "rum_editor")
+      return seedRumPreset(presetId, opts);
+    return locked(() => {
+      const resolved = resolvePreset(presetId);
+      if (!resolved) return;
+      const { added, restored } = stage(resolved.grants);
+      if (opts.announce) announceApplied(presetId, { added, restored });
+    });
+  };
+
+  // A job preset needing a module this org lacks would stage a tuple FGA rejects, so it is not offered.
+  const presets: ComputedRef<PresetInfo[]> = computed(() => [
+    ...BUILTIN_PRESETS.map((preset) => toInfo(preset, "builtin")),
+    ...JOB_PRESETS.filter((preset) =>
+      Object.keys(preset.grants).every((key) => resourceMapper.value[key]),
+    ).map((preset) => toInfo(preset, "job")),
+  ]);
+
+  const loadStreamType = async (type: string, force: boolean) => {
+    streamStatus.value[type] = "loading";
+    try {
+      const streamResource = resourceMapper.value[STREAM_PARENT_KEY];
+      if (streamResource) {
+        if (!getResourceEntities) throw new Error("No entity loader to read the stream lists");
+        await getResourceEntities(streamResource);
+        // A cold read toasts "Please wait while loading streams"; a quiet read first lets the loader answer from cache.
+        await getStreams?.(type, false, false, force);
+        const typeNode = streamTypeNode(type);
+        // The loader skips a node that already has rows, so they are emptied to rebuild from this read; checkboxes come from the grant store.
+        if (typeNode) {
+          typeNode.entities = [];
+          await getResourceEntities(typeNode);
+        }
       }
+      streamStatus.value[type] = "loaded";
+    } catch {
+      // A 403 on stream List lands here too: the badge shows nothing and the next call retries.
+      streamStatus.value[type] = "failed";
     }
+  };
 
-    if (changes.length) {
-      handlePermissionBatchChange(changes);
-    }
+  // Streams ingested after a lookup that matched none, or after the stream list query went stale, show only on a fresh read.
+  const needsFreshRead = (type: string, at: number) =>
+    Date.now() - at >= MEDIUM_STALE_TIME ||
+    [...STREAM_TYPE_OF].some(([id, of]) => of === type && !resolvePreset(id)?.matched);
 
-    toast(
-      matched
-        ? {
-            variant: "info",
-            message: t("iam.editRole.rumPresetSeeded", { matched, total: RUM_STREAMS.length }),
-          }
-        : {
-            variant: "warning",
-            message: t("iam.editRole.rumPresetNoMatch", { total: RUM_STREAMS.length }),
-          },
+  /** Loads the metrics and logs lists the stream presets match against, without a toast; a failed, stale or matchless one reads again past the cache. */
+  const loadPresetStreams = async () => {
+    await Promise.all(
+      [...new Set(STREAM_TYPE_OF.values())].map((type) => {
+        const last = streamLoads.get(type);
+        const status = streamStatus.value[type];
+        if (
+          last &&
+          (status === "loading" || (status === "loaded" && !needsFreshRead(type, last.at)))
+        )
+          return last.load;
+        const load = loadStreamType(type, !!last);
+        streamLoads.set(type, { load, at: Date.now() });
+        return load;
+      }),
     );
   };
 
-  const applyPreset = async (presetId: string) => {
-    if (presetId === "readonly") seedReadonlyPreset();
-    else if (presetId === "dbm") await seedDbmViewerPreset();
-    else if (presetId === "k8s") await seedK8sViewerPreset();
-    else if (presetId === "rum_viewer" || presetId === "rum_editor") await seedRumPreset(presetId);
+  // Computed on call, never cached, so a grant changed elsewhere shows on the next render.
+  const previewPreset = (presetId: string): PresetPreview => {
+    const streamType = STREAM_TYPE_OF.get(presetId);
+    const listStatus = streamType ? streamStatus.value[streamType] : "loaded";
+    if (listStatus !== "loaded")
+      return {
+        status: listStatus === "failed" ? "failed" : "loading",
+        adds: [],
+        restores: [],
+        skipped: 0,
+        stillMissing: [],
+      };
+    const resolved = resolvePreset(presetId);
+    const { adds, unique } = pendingGrants(resolved?.grants ?? []);
+    const addKeys = adds.map((grant) => permissionHashFor(grant.row, grant.permission));
+    const everyStream = `_all_${orgId()}`;
+    const readsEveryStream = ["AllowGet", "AllowAll"].some((permission) =>
+      addKeys.includes(buildGrantKey(STREAM_PARENT_KEY, permission, everyStream)),
+    );
+    return {
+      status: "ready",
+      adds: addKeys,
+      restores: addKeys.filter(isRestore),
+      skipped: unique - addKeys.length,
+      readsEveryStream,
+      get stillMissing() {
+        return findCompanionGaps(
+          new Set([...grants.current.value, ...addKeys]),
+          new Set(Object.keys(resourceMapper.value)),
+          orgId(),
+        );
+      },
+      ...(streamType ? { noMatchingStreams: !resolved?.matched } : {}),
+    };
   };
 
   return {
     seedReadonlyPreset,
-    collectVisibleReadGrants,
     seedDbmViewerPreset,
     reportDbmViewerSeeding,
     seedK8sViewerPreset,
     reportK8sViewerSeeding,
     seedRumPreset,
     applyPreset,
+    presets,
+    previewPreset,
+    loadPresetStreams,
+    /** True while a preset is being staged; Add stays disabled meanwhile. */
+    applyingPreset: readonly(applying),
   };
 };
diff --git a/web/src/composables/iam/useRoleSave.spec.ts b/web/src/composables/iam/useRoleSave.spec.ts
index 5c9fd2018b..14b8e0f141 100644
--- a/web/src/composables/iam/useRoleSave.spec.ts
+++ b/web/src/composables/iam/useRoleSave.spec.ts
@@ -16,18 +16,28 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { ref } from "vue";
 import { flushPromises } from "@vue/test-utils";
+import i18n from "@/locales";
 import { useRoleSave } from "@/composables/iam/useRoleSave";
 import analytics from "@/services/product_analytics";
+import { toast } from "@/lib/feedback/Toast/useToast";
 
 vi.mock("@/services/product_analytics", () => ({ default: { track: vi.fn() } }));
 vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: vi.fn() }));
 
-const makeDeps = (mutateAsync: () => Promise<unknown>) => ({
+type Staged = { object: string; permission: string };
+
+const makeDeps = (
+  mutateAsync: () => Promise<unknown>,
+  staged: { add: Staged[]; remove: Staged[] } = {
+    add: [{ object: "logs:_all_default", permission: "AllowGet" }],
+    remove: [],
+  },
+) => ({
   editingRole: ref("r1"),
   permissionsUiType: ref("table"),
   updateJsonInTable: vi.fn(),
   grants: {
-    payload: () => ({ add: [{ object: "logs:_all_default", permission: "AllowGet" }], remove: [] }),
+    payload: () => staged,
     commit: vi.fn(),
   },
   addedUsers: ref(new Set<unknown>()),
@@ -36,7 +46,9 @@ const makeDeps = (mutateAsync: () => Promise<unknown>) => ({
   removedServiceAccounts: ref(new Set<unknown>()),
   roleUsers: ref<string[]>([]),
   updateRoleOne: { mutateAsync: vi.fn(mutateAsync) },
-  t: (key: string) => key as any,
+  pendingCounts: vi.fn(() => ({ changes: 1, modules: 1 })),
+  presetSettled: vi.fn(() => Promise.resolve()),
+  t: i18n.global.t as any,
 });
 
 describe("useRoleSave product analytics", () => {
@@ -59,3 +71,156 @@ describe("useRoleSave product analytics", () => {
     expect(analytics.track).not.toHaveBeenCalled();
   });
 });
+
+describe("useRoleSave toast", () => {
+  const savedToast = async (deps: ReturnType<typeof makeDeps>) => {
+    vi.mocked(toast).mockClear();
+    useRoleSave(deps).saveRole();
+    await flushPromises();
+    return vi.mocked(toast).mock.calls.map(([arg]) => arg);
+  };
+
+  // Drawer rows, not payload keys: four keys can be three rows.
+  it("names the changes and the modules the drawer shows", async () => {
+    const deps = makeDeps(() => Promise.resolve({}), {
+      add: [
+        { object: "logs:app", permission: "AllowGet" },
+        { object: "logs:app", permission: "AllowList" },
+        { object: "dashboard:f1/d1", permission: "AllowGet" },
+      ],
+      remove: [{ object: "metrics:cpu", permission: "AllowGet" }],
+    });
+    deps.pendingCounts.mockReturnValue({ changes: 3, modules: 2 });
+
+    expect(await savedToast(deps)).toEqual([
+      { variant: "success", message: "Saved 3 changes in 2 modules." },
+    ]);
+  });
+
+  it("uses the singular for one change in one module", async () => {
+    const deps = makeDeps(() => Promise.resolve({}));
+
+    expect(await savedToast(deps)).toEqual([
+      { variant: "success", message: "Saved 1 change in 1 module." },
+    ]);
+  });
+
+  it("keeps the plain success message for a members-only save", async () => {
+    const deps = makeDeps(() => Promise.resolve({}), { add: [], remove: [] });
+    deps.addedUsers.value.add("new@example.com");
+
+    expect(await savedToast(deps)).toEqual([
+      { variant: "success", message: i18n.global.t("iam.editRole.updateSuccess") },
+    ]);
+  });
+
+  it("says nothing changed when nothing is staged", async () => {
+    const deps = makeDeps(() => Promise.resolve({}), { add: [], remove: [] });
+
+    expect(await savedToast(deps)).toEqual([
+      { variant: "info", message: i18n.global.t("iam.editRole.noUpdatesDetected") },
+    ]);
+    expect(deps.updateRoleOne.mutateAsync).not.toHaveBeenCalled();
+  });
+
+  it("counts the grants typed in JSON, flushed before the payload is read", async () => {
+    let staged = { add: [] as Staged[], remove: [] as Staged[] };
+    const deps = makeDeps(() => Promise.resolve({}));
+    deps.grants.payload = () => staged;
+    deps.permissionsUiType.value = "json";
+    deps.updateJsonInTable.mockImplementation(() => {
+      staged = { add: [{ object: "logs:app", permission: "AllowGet" }], remove: [] };
+    });
+
+    expect(await savedToast(deps)).toEqual([
+      { variant: "success", message: "Saved 1 change in 1 module." },
+    ]);
+  });
+});
+
+describe("useRoleSave preset and save interlock", () => {
+  // A preset still staging when Save is clicked must reach the payload, not be committed unsent.
+  it("builds the payload only after a staging preset has settled", async () => {
+    let settle!: () => void;
+    let staged = { add: [] as Staged[], remove: [] as Staged[] };
+    const deps = makeDeps(() => Promise.resolve({}));
+    deps.grants.payload = () => staged;
+    deps.presetSettled.mockImplementation(
+      () =>
+        new Promise<void>((resolve) => {
+          settle = resolve;
+        }),
+    );
+
+    const saving = useRoleSave(deps).saveRole();
+    staged = { add: [{ object: "logs:app", permission: "AllowGet" }], remove: [] };
+    settle();
+    await saving;
+
+    expect(deps.updateRoleOne.mutateAsync).toHaveBeenCalledWith({
+      role_id: "r1",
+      payload: {
+        add: [{ object: "logs:app", permission: "AllowGet" }],
+        remove: [],
+        add_users: [],
+        remove_users: [],
+      },
+    });
+  });
+
+  it("reports saving from the click until the request settles", async () => {
+    let finish!: (value: unknown) => void;
+    const deps = makeDeps(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        }),
+    );
+    const { saveRole, isSaving } = useRoleSave(deps);
+
+    const saving = saveRole();
+    expect(isSaving.value).toBe(true);
+    await flushPromises();
+    expect(isSaving.value).toBe(true);
+
+    finish({});
+    await saving;
+    expect(isSaving.value).toBe(false);
+  });
+
+  it("sends one request for a second click while the first is in flight", async () => {
+    let finish!: (value: unknown) => void;
+    const deps = makeDeps(
+      () =>
+        new Promise((resolve) => {
+          finish = resolve;
+        }),
+    );
+    const { saveRole } = useRoleSave(deps);
+
+    const first = saveRole();
+    await flushPromises();
+    // False, so the editor draft is not marked saved by the click that sent nothing.
+    expect(await saveRole()).toBe(false);
+    finish({});
+    expect(await first).toBe(true);
+
+    expect(deps.updateRoleOne.mutateAsync).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("useRoleSave network failure", () => {
+  it("shows the save-failure toast when the request has no response", async () => {
+    vi.mocked(toast).mockClear();
+    const deps = makeDeps(() => Promise.reject(new TypeError("Network Error")));
+    vi.spyOn(console, "log").mockImplementation(() => {});
+
+    await useRoleSave(deps).saveRole();
+    await flushPromises();
+
+    expect(toast).toHaveBeenCalledWith({
+      variant: "error",
+      message: i18n.global.t("iam.editRole.updateError"),
+    });
+  });
+});
diff --git a/web/src/composables/iam/useRoleSave.ts b/web/src/composables/iam/useRoleSave.ts
index 414b046567..ecf4918b55 100644
--- a/web/src/composables/iam/useRoleSave.ts
+++ b/web/src/composables/iam/useRoleSave.ts
@@ -13,10 +13,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import type { Ref } from "vue";
+import { readonly, ref, type Ref } from "vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import analytics from "@/services/product_analytics";
-import type { I18nText } from "@/types/i18n";
+import type { TranslateFn } from "@/types/i18n";
 
 type Staged = { object: string; permission: string };
 
@@ -35,7 +35,11 @@ type SaveDeps = {
   updateRoleOne: {
     mutateAsync: (vars: { role_id: string; payload: Record<string, unknown> }) => Promise<unknown>;
   };
-  t: (key: string) => I18nText;
+  /** Drawer rows and modules, the numbers the Review Changes badge shows. */
+  pendingCounts: () => { changes: number; modules: number };
+  /** Resolves once a preset still staging has finished, so the save carries its grants. */
+  presetSettled: () => Promise<void>;
+  t: TranslateFn;
 };
 
 /** Sends the staged grant and membership changes, then makes them the new baseline. */
@@ -51,11 +55,23 @@ export const useRoleSave = (deps: SaveDeps) => {
     removedServiceAccounts,
     roleUsers,
     updateRoleOne,
+    pendingCounts,
+    presetSettled,
     t,
   } = deps;
 
+  // Counted before commit() clears the staging, from the same rows the badge counts.
+  const savedMessage = (changed: Staged[]) => {
+    const { changes, modules } = pendingCounts();
+    if (!changed.length || !changes) return t("iam.editRole.updateSuccess");
+    return t("iam.editRole.saveSuccessCounts", {
+      changes: t("iam.editRole.changeCount", { count: changes }, changes),
+      modules: t("iam.editRole.presetModuleCount", { count: modules }, modules),
+    });
+  };
+
   /** Resolves true once the backend accepted the changes; false when there was nothing to send or it failed. */
-  const saveRole = (): Promise<boolean> => {
+  const send = (): Promise<boolean> => {
     if (permissionsUiType.value === "json") updateJsonInTable();
 
     // Users and service accounts are both sent as users; merge the two staging
@@ -84,6 +100,8 @@ export const useRoleSave = (deps: SaveDeps) => {
       return Promise.resolve(false);
     }
 
+    const message = savedMessage([...payload.add, ...payload.remove]);
+
     // Was: invalidate, then update — the refetch raced the write.
     return updateRoleOne
       .mutateAsync({ role_id: editingRole.value, payload })
@@ -94,10 +112,7 @@ export const useRoleSave = (deps: SaveDeps) => {
         });
         // combine permissionsHash and selectedPermissionsHash
 
-        toast({
-          variant: "success",
-          message: t("iam.editRole.updateSuccess"),
-        });
+        toast({ variant: "success", message });
 
         // Resetting permissions state on save
 
@@ -125,7 +140,7 @@ export const useRoleSave = (deps: SaveDeps) => {
         return true;
       })
       .catch((err) => {
-        if (err.response.status != 403) {
+        if (err?.response?.status != 403) {
           toast({
             variant: "error",
             message: t("iam.editRole.updateError"),
@@ -136,7 +151,24 @@ export const useRoleSave = (deps: SaveDeps) => {
       });
   };
 
+  const isSaving = ref(false);
+
+  // A preset staging past the payload would be absorbed by commit() unsent, so the save waits for it.
+  const saveRole = async (): Promise<boolean> => {
+    // A second click while the PUT is in flight would send the same changes twice.
+    if (isSaving.value) return false;
+    isSaving.value = true;
+    try {
+      await presetSettled();
+      return await send();
+    } finally {
+      isSaving.value = false;
+    }
+  };
+
   return {
     saveRole,
+    /** True from the click until the PUT settles; preset Add stays off meanwhile. */
+    isSaving: readonly(isSaving),
   };
 };
diff --git a/web/src/composables/iam/useRoleSummary.spec.ts b/web/src/composables/iam/useRoleSummary.spec.ts
index b4e8248fce..fb8b69e519 100644
--- a/web/src/composables/iam/useRoleSummary.spec.ts
+++ b/web/src/composables/iam/useRoleSummary.spec.ts
@@ -281,6 +281,10 @@ describe("useRoleSummary - pending changes [characterization]", () => {
           { action: "AllowGet", label: i18n.global.t("iam.get") },
         ],
         keys: ["metrics:cpu:AllowGet", "metrics:cpu:AllowList"],
+        moduleKey: "stream",
+        effect: "Can view the cpu metrics stream.",
+        neededBy: [],
+        notes: [],
       },
     ]);
   });
@@ -334,6 +338,205 @@ describe("useRoleSummary - pending changes [characterization]", () => {
   });
 });
 
+describe("useRoleSummary - review drawer model", () => {
+  // Dash Folders need streams to load panels, so a role with a folder and no stream grant lacks Streams.
+  const withCompanionModules = (summary: ReturnType<typeof setup>) => {
+    summary.resourceMapper.value = { stream: {}, dfolder: {}, destination: {} };
+  };
+
+  it("keeps the drawer open while a module is missing, even with no change left", async () => {
+    const summary = setup();
+    withCompanionModules(summary);
+    summary.seed({ saved: ["dfolder:f1:AllowGet"], added: ["metrics:cpu:AllowGet"] });
+    summary.unsavedDrawerOpen.value = true;
+    await flushPromises();
+
+    summary.seed({ saved: ["dfolder:f1:AllowGet"] });
+    await flushPromises();
+
+    expect(summary.companionGaps.value.map((gap) => [gap.module, gap.actions])).toEqual([
+      ["stream", ["AllowList", "AllowGet"]],
+    ]);
+    expect(summary.unsavedDrawerOpen.value).toBe(true);
+  });
+
+  it("closes the drawer once nothing is staged and nothing is missing", async () => {
+    const summary = setup();
+    withCompanionModules(summary);
+    summary.seed({ saved: ["dfolder:f1:AllowGet"], added: [`stream:${ALL}:AllowAll`] });
+    summary.unsavedDrawerOpen.value = true;
+    await flushPromises();
+
+    summary.seed({ saved: ["dfolder:f1:AllowGet", `stream:${ALL}:AllowAll`] });
+    await flushPromises();
+
+    expect(summary.unsavedDrawerOpen.value).toBe(false);
+  });
+
+  it("groups changes by rail module, with unknown resources in a trailing Other group", () => {
+    const summary = setup();
+    summary.seed({
+      added: ["mystery:x1:AllowGet", "dashboard:f1/d1:AllowGet", "logs:app:AllowGet"],
+      saved: ["metrics:cpu:AllowGet"],
+      removed: ["metrics:cpu:AllowGet"],
+    });
+
+    expect(
+      summary.pendingGroups.value.map((group) => [
+        group.key,
+        String(group.label),
+        group.changes.map((change) => change.id),
+      ]),
+    ).toEqual([
+      ["stream", "Streams", ["logs-app-added", "metrics-cpu-removed"]],
+      ["dfolder", "Dash Folders", ["dashboard-f1/d1-added"]],
+      ["other", i18n.global.t("iam.editRole.changeOtherGroup"), ["mystery-x1-added"]],
+    ]);
+  });
+
+  it.each([
+    [
+      `stream:${ALL}:AllowList`,
+      "added",
+      "Can see the list of every stream (logs, metrics, traces and indices), including new ones.",
+    ],
+    [`logs:${ALL}:AllowGet`, "added", "Can open all logs streams."],
+    ["dfolder:f1:AllowList", "added", "Can see the list of dashboards in the f1 folder."],
+    [
+      "dashboard:f1/d1:AllowAll",
+      "removed",
+      "Can no longer view, create, edit, and delete the f1/d1 dashboard.",
+    ],
+    [`destination:${ALL}:AllowList`, "added", "Can load the destinations list."],
+    ["mystery:x1:AllowPut", "added", "Can edit x1 in mystery."],
+  ])("describes %s (%s) in one sentence", (key, state, effect) => {
+    const summary = setup();
+    summary.seed(state === "added" ? { added: [key] } : { saved: [key], removed: [key] });
+
+    expect(summary.pendingChanges.value.map((change) => change.effect)).toEqual([effect]);
+  });
+
+  it.each([
+    ["added", "Can delete all logs_cache, including new ones."],
+    ["removed", "Can no longer delete all logs_cache, including new ones."],
+  ])("describes All (%s) by the actions the resource shows", (state, effect) => {
+    const summary = setup();
+    const hidden = ["AllowList", "AllowGet", "AllowPost", "AllowPut"];
+    summary.resourceMapper.value.logs_cache = {
+      permission: Object.fromEntries(
+        ACTION_ORDER.map((action) => [action, { show: !hidden.includes(action), value: false }]),
+      ),
+    };
+    const key = `logs_cache:${ALL}:AllowAll`;
+    summary.seed(state === "added" ? { added: [key] } : { saved: [key], removed: [key] });
+
+    expect(summary.pendingChanges.value.map((change) => change.effect)).toEqual([effect]);
+  });
+
+  it("joins List and a write action without reading as view", () => {
+    const summary = setup();
+    summary.seed({ added: ["dfolder:f1:AllowList", "dfolder:f1:AllowPost"] });
+
+    expect(summary.pendingChanges.value[0].effect).toBe(
+      "Can list and create dashboards in the f1 folder.",
+    );
+  });
+
+  it("notes that a list-only destination grant shows only the destinations they can open", () => {
+    const summary = setup();
+    withCompanionModules(summary);
+    summary.seed({ added: [`destination:${ALL}:AllowList`] });
+
+    expect(summary.pendingChanges.value[0].notes).toEqual([
+      i18n.global.t("iam.editRole.noteDestinationsFiltered"),
+    ]);
+  });
+
+  it("notes which module an added grant serves, and which one still needs a removed grant", () => {
+    const summary = setup();
+    withCompanionModules(summary);
+    summary.seed({
+      saved: ["dfolder:f1:AllowGet", "logs:app:AllowGet"],
+      added: [`stream:${ALL}:AllowList`],
+      removed: ["logs:app:AllowGet"],
+    });
+
+    const notesOf = (id: string) =>
+      summary.pendingChanges.value.find((change) => change.id === id)?.notes;
+    expect(notesOf(`stream-${ALL}-added`)).toEqual(["Dash Folders needs this to load panel data."]);
+    expect(notesOf("logs-app-removed")).toEqual([
+      "Dash Folders still needs this to load panel data.",
+    ]);
+    const neededByOf = (id: string) =>
+      summary.pendingChanges.value.find((change) => change.id === id)?.neededBy;
+    expect(neededByOf(`stream-${ALL}-added`)).toEqual(["Dash Folders"]);
+    expect(neededByOf("logs-app-removed")).toEqual(["Dash Folders"]);
+  });
+
+  it("passes the rail's staged counts to the overview card", () => {
+    const summary = setup();
+    summary.seed({ saved: ["logs:app:AllowGet"] });
+
+    expect(summary.summaryModules.value[0]).toMatchObject({ added: 0, removed: 0 });
+  });
+});
+
+describe("useRoleSummary - a removal a kept grant still covers", () => {
+  // The catalogue nodes a role load builds; Streams lists no types until it is opened, so stream coverage must not need them.
+  const withScopes = (summary: ReturnType<typeof setup>) => {
+    summary.resourceMapper.value = { destination: {}, dfolder: {}, stream: { entities: [] } };
+  };
+
+  it.each([
+    ["the same object's AllowAll", `destination:${ALL}:AllowAll`, `destination:${ALL}:AllowGet`],
+    ["a module-wide grant", `destination:${ALL}:AllowGet`, "destination:d1:AllowGet"],
+    ["every stream", `stream:${ALL}:AllowGet`, "logs:app:AllowGet"],
+    ["every stream", `stream:${ALL}:AllowGet`, `logs:${ALL}:AllowGet`],
+    ["the stream type", `logs:${ALL}:AllowAll`, "logs:app:AllowGet"],
+    ["the folder", "dfolder:f1:AllowGet", "dashboard:f1/d1:AllowGet"],
+    ["every folder", `dfolder:${ALL}:AllowGet`, "dashboard:f1/d1:AllowGet"],
+  ])("reports no access change when %s (%s) still allows %s", (_, kept, removed) => {
+    const summary = setup();
+    withScopes(summary);
+    summary.seed({ saved: [kept, removed], removed: [removed] });
+
+    expect(summary.pendingChanges.value.map((change) => change.effect)).toEqual([
+      i18n.global.t("iam.editRole.effectStillAllowed"),
+    ]);
+  });
+
+  // AllowAll also grants List, so keeping only Get still loses the folder's list.
+  it.each([
+    [
+      ["dfolder:f1:AllowList", "dfolder:f1:AllowGet"],
+      "Can no longer create, edit, and delete dashboards in the f1 folder.",
+    ],
+    [
+      ["dfolder:f1:AllowGet"],
+      "Can no longer list, create, edit, and delete dashboards in the f1 folder.",
+    ],
+  ])("names only what a removed AllowAll loses when %j is kept", (kept, effect) => {
+    const summary = setup();
+    withScopes(summary);
+    summary.seed({ saved: [...kept, "dfolder:f1:AllowAll"], removed: ["dfolder:f1:AllowAll"] });
+
+    expect(summary.pendingChanges.value.map((change) => change.effect)).toEqual([effect]);
+  });
+
+  it("keeps the full sentence when the kept grants cover another action or item", () => {
+    const summary = setup();
+    withScopes(summary);
+    summary.seed({
+      saved: [`destination:${ALL}:AllowList`, "destination:d2:AllowGet", "destination:d1:AllowGet"],
+      removed: ["destination:d1:AllowGet"],
+    });
+
+    expect(summary.pendingChanges.value.map((change) => change.effect)).toEqual([
+      "Can no longer open the d1 destination.",
+    ]);
+  });
+});
+
 describe("useRoleSummary - grants inside a drill-in row", () => {
   const traces = { name: "traces", type: "Type", has_entities: true, childName: "traces" };
   const folder = { name: "f1", type: "Resource", has_entities: true, childName: "dashboard" };
diff --git a/web/src/composables/iam/useRoleSummary.ts b/web/src/composables/iam/useRoleSummary.ts
index 90a71b9775..6ae55947f1 100644
--- a/web/src/composables/iam/useRoleSummary.ts
+++ b/web/src/composables/iam/useRoleSummary.ts
@@ -15,10 +15,14 @@
 
 import { computed, watch, type ComputedRef, type Ref } from "vue";
 import { raw, type I18nText } from "@/types/i18n";
+import { getIntlLocale } from "@/locales";
 import { buildGrantKey, splitGrantKey } from "@/composables/iam/useRoleGrants";
-import { STREAM_PARENT_KEY, type RoleModule } from "@/components/iam/roles/roleModules";
+import { useRoleScopes } from "@/composables/iam/useRoleScopes";
+import { moduleIcon, STREAM_PARENT_KEY, type RoleModule } from "@/components/iam/roles/roleModules";
+import { findCompanionGaps, type CompanionGap } from "@/components/iam/roles/roleCompanions";
 import type { RailModule } from "@/components/iam/roles/ModuleRail.vue";
-import type { PendingChange } from "@/components/iam/roles/UnsavedChangesDrawer.vue";
+import type { ScopeRow } from "@/components/iam/roles/ModulePane.vue";
+import type { PendingChange, PendingGroup } from "@/components/iam/roles/UnsavedChangesDrawer.vue";
 import type { SummaryAction, SummaryModule } from "@/components/iam/roles/RoleSummary.vue";
 import type { Resource, Entity } from "@/ts/interfaces";
 
@@ -32,7 +36,7 @@ type SummaryDeps = {
   heavyResourceEntities: Ref<{ [key: string]: Entity[] }>;
   roleModules: ComputedRef<RoleModule[]>;
   railModules: ComputedRef<RailModule[]>;
-  /** Closed here once nothing is left to review. */
+  /** Closed here once nothing is left to review and nothing is missing. */
   unsavedDrawerOpen: Ref<boolean>;
   resourceLabel: (key: string) => string;
   moduleLabel: (key: string) => I18nText;
@@ -42,6 +46,53 @@ type SummaryDeps = {
   ACTION_LABEL_KEYS: Readonly<Record<string, string>>;
 };
 
+/** Group of a change whose resource is in no rail module, so it is still listed and undone. */
+export const OTHER_MODULE_KEY = "other";
+
+// A sentence per resource reads better than "{name} in {module}": `afolder:f1` -> "alerts in the f1 folder".
+const TARGET_KEYS: Record<string, { all?: string; one: string }> = {
+  afolder: {
+    all: "iam.editRole.targetAlertsEveryFolder",
+    one: "iam.editRole.targetAlertsInFolder",
+  },
+  alert: { one: "iam.editRole.targetOneAlert" },
+  dfolder: {
+    all: "iam.editRole.targetDashboardsEveryFolder",
+    one: "iam.editRole.targetDashboardsInFolder",
+  },
+  dashboard: { one: "iam.editRole.targetOneDashboard" },
+  rfolder: {
+    all: "iam.editRole.targetReportsEveryFolder",
+    one: "iam.editRole.targetReportsInFolder",
+  },
+  report: { one: "iam.editRole.targetOneReport" },
+  destination: {
+    all: "iam.editRole.targetEveryDestination",
+    one: "iam.editRole.targetOneDestination",
+  },
+  template: { all: "iam.editRole.targetEveryTemplate", one: "iam.editRole.targetOneTemplate" },
+};
+
+// List results are filtered by per-item Get (alerts/destinations.rs, templates.rs), so List alone loads only the list.
+const FILTERED_LISTS: Record<string, { can: string; cannot: string; note: string }> = {
+  destination: {
+    can: "iam.editRole.effectCanLoadDestinations",
+    cannot: "iam.editRole.effectCannotLoadDestinations",
+    note: "iam.editRole.noteDestinationsFiltered",
+  },
+  template: {
+    can: "iam.editRole.effectCanLoadTemplates",
+    cannot: "iam.editRole.effectCannotLoadTemplates",
+    note: "iam.editRole.noteTemplatesFiltered",
+  },
+};
+
+const WRITE_VERB_KEYS: [string, string][] = [
+  ["AllowPost", "iam.editRole.verbCreate"],
+  ["AllowPut", "iam.editRole.verbEdit"],
+  ["AllowDelete", "iam.editRole.verbDelete"],
+];
+
 /** What the role grants, per module, and every change staged since it loaded. */
 export const useRoleSummary = (deps: SummaryDeps) => {
   const {
@@ -65,14 +116,8 @@ export const useRoleSummary = (deps: SummaryDeps) => {
   const resourceParent = (resource: string) =>
     permissionsState.resources.find((candidate: any) => candidate.key === resource)?.parent;
 
-  // Names come from entities the role load already fetched; an unloaded id shows as itself.
-  const entityLabel = (resource: string, entity: string) => {
-    if (entity === `_all_${getOrgId()}`) {
-      return resource === STREAM_PARENT_KEY
-        ? t("iam.editRole.scopeEveryStream")
-        : t("iam.editRole.scopeAllOf", { module: resourceLabel(resource) });
-    }
-
+  // An item's row from the lists the role load already fetched, or undefined while unloaded.
+  const loadedRow = (resource: string, entity: string): any => {
     const parent = resourceParent(resource);
     const pools = [
       heavyResourceEntities.value[resource],
@@ -83,9 +128,19 @@ export const useRoleSummary = (deps: SummaryDeps) => {
     ];
     for (const pool of pools) {
       const match = pool?.find((candidate: any) => candidate.name === entity);
-      if (match) return raw(match.display_name ?? entity);
+      if (match) return match;
     }
-    return raw(entity);
+    return undefined;
+  };
+
+  // Names come from entities the role load already fetched; an unloaded id shows as itself.
+  const entityLabel = (resource: string, entity: string) => {
+    if (entity === `_all_${getOrgId()}`) {
+      return resource === STREAM_PARENT_KEY
+        ? t("iam.editRole.scopeEveryStream")
+        : t("iam.editRole.scopeAllOf", { module: resourceLabel(resource) });
+    }
+    return raw(loadedRow(resource, entity)?.display_name ?? entity);
   };
 
   type GrantState = "saved" | "added" | "removed";
@@ -230,37 +285,248 @@ export const useRoleSummary = (deps: SummaryDeps) => {
           icon: module.icon,
           group: module.group,
           granted: rail?.granted ?? 0,
+          added: rail?.added ?? 0,
+          removed: rail?.removed ?? 0,
           description: moduleDescription(module.key, module.countedKeys),
           actions: actionsOf(module.countedKeys.flatMap((key) => heldGrants(key))),
         };
       });
   });
 
+  // resource -> rail module, so `logs` reads under Streams and `alert` under Alert Folders.
+  const moduleOfResource = computed(
+    () =>
+      new Map(
+        roleModules.value.flatMap((module) =>
+          module.countedKeys.map((key) => [key, module.key] as const),
+        ),
+      ),
+  );
+
+  const moduleKeyOf = (resource: string) =>
+    moduleOfResource.value.get(resource) ?? OTHER_MODULE_KEY;
+
+  const availableModules = computed(() => new Set(Object.keys(resourceMapper.value)));
+
+  /** Modules the live grants need to work but lack; judged on `current`, so a staged removal can raise one. */
+  const companionGaps = computed<CompanionGap[]>(() =>
+    findCompanionGaps(selectedPermissionsHash.value, availableModules.value, getOrgId()),
+  );
+
+  const listFormat = computed(() => new Intl.ListFormat(getIntlLocale(), { type: "conjunction" }));
+  const listOf = (items: string[]) => raw(listFormat.value.format(items));
+
+  // All grants only the actions the row shows, so All on logs_cache means delete; an unknown row reads as every action.
+  const actionsOfAll = (resource: string, entity: string) => {
+    const row =
+      (isWideEntity(entity) ? undefined : loadedRow(resource, entity)) ??
+      resourceMapper.value[resource];
+    const each = ACTION_ORDER.filter((action) => action !== "AllowAll");
+    const shown = each.filter((action) => row?.permission?.[action]?.show);
+    return shown.length ? shown : each;
+  };
+
+  const verbsOf = (actions: string[]) => {
+    const list = actions.includes("AllowList");
+    const get = actions.includes("AllowGet");
+    const verbs: string[] = [];
+    if (list && get) verbs.push(t("iam.editRole.verbView"));
+    else if (list)
+      verbs.push(t(actions.length === 1 ? "iam.editRole.verbSeeListOf" : "iam.editRole.verbList"));
+    else if (get) verbs.push(t("iam.editRole.verbOpen"));
+    WRITE_VERB_KEYS.forEach(([action, key]) => {
+      if (actions.includes(action)) verbs.push(t(key));
+    });
+    return listOf(verbs);
+  };
+
+  const targetOf = (resource: string, entity: string) => {
+    const wide = isWideEntity(entity);
+    const name = entityLabel(resource, entity);
+    if (resource === STREAM_PARENT_KEY && wide) return t("iam.editRole.targetEveryStream");
+    if (resourceParent(resource) === STREAM_PARENT_KEY) {
+      const type = resourceLabel(resource).toLowerCase();
+      return wide
+        ? t("iam.editRole.targetTypeStreams", { type })
+        : t("iam.editRole.targetOneStream", { name, type });
+    }
+    const keys = TARGET_KEYS[resource];
+    if (wide)
+      return keys?.all
+        ? t(keys.all)
+        : t("iam.editRole.targetAllOf", { module: resourceLabel(resource) });
+    return keys
+      ? t(keys.one, { name })
+      : t("iam.editRole.targetItemIn", { name, module: resourceLabel(resource) });
+  };
+
+  // Only each scope's `resource`, `node` and `covers` are read, so its labels and hints are never shown.
+  const { moduleScopes, folderScopes, streamTypeScopes } = useRoleScopes({
+    resourceMapper,
+    isGranted: () => false,
+    resourceLabel,
+    moduleLabel,
+    t,
+    ACTION_ORDER,
+  });
+
+  // Dashboard, alert and report ids carry their folder as `folderId/id`; any other id is placed by its folder's loaded items.
+  const folderIdOf = (parent: string, entity: string): string =>
+    entity.includes("/")
+      ? entity.split("/")[0]
+      : ((resourceMapper.value[parent]?.entities ?? []).find((folder: any) =>
+          folder.entities?.some((item: any) => item.name === entity),
+        )?.name ?? "");
+
+  // The objects whose grants lock this row in the pane, from the scope rows useModuleNavigation pins above it: `logs:app` -> `stream:_all_`, `logs:_all_`.
+  const widerObjects = (resource: string, entity: string) => {
+    const parent = resourceParent(resource);
+    const covering = (scopes: ScopeRow[], folder?: { name: string }) =>
+      scopes
+        .filter((scope) => scope.covers.includes(resource))
+        .map((scope) => ({
+          resource: scope.resource,
+          entity: folder && scope.node === folder ? folder.name : `_all_${getOrgId()}`,
+        }));
+    // The catalogue parent names the type, so `stream:_all_` covers it before Streams loads its types; for `logs:_all_` the type row is the grant itself.
+    if (parent === STREAM_PARENT_KEY) return covering(streamTypeScopes({ name: resource }));
+    if (isWideEntity(entity)) return [];
+    if (!parent) return covering(moduleScopes(resource));
+    const folder = { name: folderIdOf(parent, entity), childName: resource };
+    return covering(folderScopes(parent, folder), folder);
+  };
+
+  // Removed actions nothing left allows, by the pane's lock rule (ModulePane isInherited) plus the row's own AllowAll.
+  const lostActions = (resource: string, entity: string, actions: string[]) => {
+    const current = selectedPermissionsHash.value;
+    const holders = [{ resource, entity }, ...widerObjects(resource, entity)];
+    // model.fga defines every action as `ALLOW_ALL or ALLOW_<ACTION>`, so a removed AllowAll loses only what nothing else allows.
+    const each = actions.includes("AllowAll") ? actionsOfAll(resource, entity) : actions;
+    const lost = each.filter(
+      (action) =>
+        !holders.some((holder) =>
+          [action, "AllowAll"].some((held) =>
+            current.has(buildGrantKey(holder.resource, held, holder.entity)),
+          ),
+        ),
+    );
+    return lost.length === each.length ? actions : lost;
+  };
+
+  const effectOf = (resource: string, entity: string, state: GrantState, granted: string[]) => {
+    const actions = state === "removed" ? lostActions(resource, entity, granted) : granted;
+    if (!actions.length) return t("iam.editRole.effectStillAllowed");
+    const filtered = FILTERED_LISTS[resource];
+    if (filtered && isWideEntity(entity) && actions.length === 1 && actions[0] === "AllowList")
+      return t(state === "added" ? filtered.can : filtered.cannot);
+    return t(state === "added" ? "iam.editRole.effectCan" : "iam.editRole.effectCannot", {
+      actions: verbsOf(actions.includes("AllowAll") ? actionsOfAll(resource, entity) : actions),
+      target: targetOf(resource, entity),
+    });
+  };
+
+  // "Dash Folders needs this to load panel data." for a change that meets, or no longer meets, another module's need.
+  const companionNeeds = (gap: CompanionGap | undefined, actions: string[]) =>
+    gap && (actions.includes("AllowAll") || gap.actions.some((a) => actions.includes(a)))
+      ? gap.neededBy
+      : [];
+
   const pendingChanges = computed<PendingChange[]>(() => {
+    const current = selectedPermissionsHash.value;
+    const orgWide = `_all_${getOrgId()}`;
+    // What would be missing without a module's grants, so an added grant can say who needs it; one scan per module, not per row.
+    const gapsWithout = new Map<string, CompanionGap[]>();
+    const gapsIfMissing = (module: string) => {
+      if (!gapsWithout.has(module)) {
+        const rest = new Set(
+          [...current].filter((key) => moduleKeyOf(splitGrantKey(key).resource) !== module),
+        );
+        gapsWithout.set(module, findCompanionGaps(rest, availableModules.value, getOrgId()));
+      }
+      return gapsWithout.get(module)!.find((gap) => gap.module === module);
+    };
+
+    const notesOf = (resource: string, entity: string, state: GrantState, actions: string[]) => {
+      const module = moduleKeyOf(resource);
+      const filtered = FILTERED_LISTS[resource];
+      const listOnly =
+        state === "added" &&
+        filtered &&
+        isWideEntity(entity) &&
+        actions.includes("AllowList") &&
+        !current.has(buildGrantKey(resource, "AllowGet", orgWide)) &&
+        !current.has(buildGrantKey(resource, "AllowAll", orgWide));
+      const needs = companionNeeds(
+        state === "added"
+          ? gapsIfMissing(module)
+          : companionGaps.value.find((gap) => gap.module === module),
+        actions,
+      );
+      const key =
+        state === "added"
+          ? "iam.editRole.companionNeedsThis"
+          : "iam.editRole.companionStillNeedsThis";
+      return {
+        notes: [
+          ...(listOnly ? [t(filtered.note)] : []),
+          ...needs.map((need) =>
+            t(key, { module: resourceLabel(need.module), reason: t(need.reasonKey) }),
+          ),
+        ],
+        neededBy: [...new Set(needs.map((need) => resourceLabel(need.module)))].map(raw),
+      };
+    };
+
     const changes: PendingChange[] = [];
     grantsByResource.value.forEach((byEntity, resource) => {
       byEntity.forEach((grants, entity) => {
         (["added", "removed"] as const).forEach((state) => {
           const ofState = grants.filter((grant) => grant.state === state);
           if (!ofState.length) return;
+          const actions = ofState.map((grant) => grant.action);
+          const { notes, neededBy } = notesOf(resource, entity, state, actions);
           changes.push({
             id: `${resource}-${entity}-${state}`,
             state,
             label: entityLabel(resource, entity),
             moduleLabel: raw(resourceLabel(resource)),
-            actions: summaryActions(ofState.map((grant) => grant.action)),
+            moduleKey: moduleKeyOf(resource),
+            actions: summaryActions(actions),
             keys: ofState.map((grant) => buildGrantKey(resource, grant.action, entity)),
+            effect: effectOf(resource, entity, state, actions),
+            neededBy,
+            notes,
           });
         });
       });
     });
     return changes;
   });
-  // Nothing left to review once the last change is undone, so the drawer gets out of the way.
+
+  // Rail order, with resources outside every module last, so nothing staged goes unlisted.
+  const pendingGroups = computed<PendingGroup[]>(() => {
+    const byModule = new Map<string, PendingChange[]>();
+    pendingChanges.value.forEach((change) => {
+      const group = byModule.get(change.moduleKey) ?? [];
+      group.push(change);
+      byModule.set(change.moduleKey, group);
+    });
+    const order = [...roleModules.value.map((module) => module.key), OTHER_MODULE_KEY];
+    return [...byModule.entries()]
+      .sort(([a], [b]) => order.indexOf(a) - order.indexOf(b))
+      .map(([key, changes]) => ({
+        key,
+        label: key === OTHER_MODULE_KEY ? t("iam.editRole.changeOtherGroup") : moduleLabel(key),
+        icon: roleModules.value.find((module) => module.key === key)?.icon ?? moduleIcon(key),
+        changes,
+      }));
+  });
+
+  // Nothing left to review once the last change is undone, unless a missing module still needs adding.
   watch(
-    () => pendingChanges.value.length,
-    (count) => {
-      if (!count) unsavedDrawerOpen.value = false;
+    () => !pendingChanges.value.length && !companionGaps.value.length,
+    (settled) => {
+      if (settled) unsavedDrawerOpen.value = false;
     },
   );
 
@@ -279,5 +545,8 @@ export const useRoleSummary = (deps: SummaryDeps) => {
     moduleDescription,
     summaryModules,
     pendingChanges,
+    pendingGroups,
+    companionGaps,
+    moduleKeyOf,
   };
 };
diff --git a/web/src/composables/metrics/useQueryHistoryRecorder.ts b/web/src/composables/metrics/useQueryHistoryRecorder.ts
index 13eefa28dc..673f2fd465 100644
--- a/web/src/composables/metrics/useQueryHistoryRecorder.ts
+++ b/web/src/composables/metrics/useQueryHistoryRecorder.ts
@@ -13,24 +13,82 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { useMutation } from "@tanstack/vue-query";
-import { useOrgId } from "@/composables/query/useOrgId";
-import { recordQueryHistoryMutation } from "@/services/query_history.queries";
-import { buildHistoryEntry } from "@/utils/metrics/queryHistory";
+import { nextTick, watch } from "vue";
+import { useRecentSearches } from "@/composables/queryHistory/useRecentSearches";
+import {
+  buildMetricsRecord,
+  metricsRunError,
+  withRunResult,
+  type MetricsPanelState,
+  type PanelErrorDetail,
+} from "@/utils/queryHistory/metrics";
+import { runResultFromError, type RunError } from "@/utils/queryHistory/recentSearches";
+import type { QueryHistoryRecordBody } from "@/services/query_history";
 import type { SelectedDate } from "@/utils/dashboard/urlTimeParams";
 
-/** Fire-and-forget: a failed record is only logged and never reaches the run. */
-export const useQueryHistoryRecorder = () => {
-  const orgId = useOrgId();
-  const recordEntry = useMutation(() => recordQueryHistoryMutation(orgId.value));
+interface RecordedPanel extends MetricsPanelState {
+  meta?: { dateTime?: { start_time?: unknown; end_time?: unknown } };
+}
 
-  const record = (dashboardPanelData: any, selectedDate: Partial<SelectedDate> | null) => {
-    const entry = buildHistoryEntry(dashboardPanelData, selectedDate);
-    if (!entry) return;
-    recordEntry.mutateAsync(entry).catch((err) => {
-      console.error("Failed to record query history", err);
-    });
+interface PendingRun {
+  body: QueryHistoryRecordBody;
+  started: boolean;
+}
+
+// Panel pages build these Dates from microseconds, so getTime() is already microseconds.
+const toMicros = (value: unknown): number | null => {
+  const us = value instanceof Date ? value.getTime() : Number.NaN;
+  return Number.isFinite(us) ? us : null;
+};
+
+/** Records a user's Run once the panel request settles; a failed record never reaches the run. */
+export const useQueryHistoryRecorder = (isLoading: () => boolean) => {
+  const recent = useRecentSearches();
+  let pending: PendingRun | null = null;
+  // Mirrors the panel's error: the panel emits only on change, so a repeat of the same error keeps it.
+  let panelError: RunError | null = null;
+
+  const settle = (body: QueryHistoryRecordBody) => {
+    const result = panelError ? runResultFromError(panelError) : { status: "ok" as const };
+    if (result) recent.record(withRunResult(body, result));
   };
 
-  return { record };
+  watch(isLoading, (loading) => {
+    if (!pending) return;
+    if (loading) {
+      pending.started = true;
+      return;
+    }
+    if (!pending.started) return;
+    const { body } = pending;
+    pending = null;
+    // The panel's error arrives through its own watcher in the same flush as the loading change.
+    nextTick(() => settle(body));
+  });
+
+  /** Captures the run as dispatched; it is recorded when the panel's request settles. */
+  const record = (
+    dashboardPanelData: RecordedPanel,
+    selectedDate: Partial<SelectedDate> | null,
+  ) => {
+    const startUs = toMicros(dashboardPanelData?.meta?.dateTime?.start_time);
+    const endUs = toMicros(dashboardPanelData?.meta?.dateTime?.end_time);
+    const body = buildMetricsRecord({
+      panel: dashboardPanelData,
+      selectedDate,
+      window: startUs !== null && endUs !== null ? { startUs, endUs } : null,
+    });
+    pending = body ? { body, started: isLoading() } : null;
+  };
+
+  const onPanelError = (detail: PanelErrorDetail | string | null | undefined) => {
+    panelError = metricsRunError(detail);
+  };
+
+  /** A cancelled run is never recorded. */
+  const cancel = () => {
+    pending = null;
+  };
+
+  return { record, onPanelError, cancel };
 };
diff --git a/web/src/composables/query/queryClient.spec.ts b/web/src/composables/query/queryClient.spec.ts
index 85620d72ef..cca215deb5 100644
--- a/web/src/composables/query/queryClient.spec.ts
+++ b/web/src/composables/query/queryClient.spec.ts
@@ -37,3 +37,31 @@ describe("purgeOrgQueries on a stale deploy", () => {
     expect(unhandled).not.toHaveBeenCalled();
   });
 });
+
+describe("a mutation's stales meta", () => {
+  it("marks the scope stale without refetching a query that is in use", async () => {
+    const { queryClient } = await import("./queryClient");
+    const { QueryObserver } = await import("@tanstack/query-core");
+    const fetches = vi.fn().mockResolvedValue(["row"]);
+    const observer = new QueryObserver(queryClient, {
+      queryKey: ["stales-test", "list"],
+      queryFn: fetches,
+      staleTime: Infinity,
+    });
+    const unsubscribe = observer.subscribe(() => {});
+    await vi.waitFor(() => expect(fetches).toHaveBeenCalledTimes(1));
+
+    await queryClient
+      .getMutationCache()
+      .build(queryClient, {
+        mutationFn: async () => "ok",
+        meta: { stales: [["stales-test"]] },
+      })
+      .execute(undefined);
+    await new Promise((resolve) => setTimeout(resolve, 20));
+
+    expect(fetches).toHaveBeenCalledTimes(1);
+    expect(queryClient.getQueryState(["stales-test", "list"])?.isInvalidated).toBe(true);
+    unsubscribe();
+  });
+});
diff --git a/web/src/composables/query/queryClient.ts b/web/src/composables/query/queryClient.ts
index 3cab469271..ce228e9368 100644
--- a/web/src/composables/query/queryClient.ts
+++ b/web/src/composables/query/queryClient.ts
@@ -51,6 +51,10 @@ declare module "@tanstack/query-core" {
     mutationMeta: {
       /** Scopes to refetch. Prefer a domain's `all` key over a precise one. */
       invalidates?: readonly (readonly unknown[])[];
+      /** Resolve `mutateAsync` only once the `invalidates` refetches land, so the caller reads fresh data next. */
+      awaitInvalidation?: boolean;
+      /** Scopes marked stale without a refetch: each refetches the next time a reader mounts it. */
+      stales?: readonly (readonly unknown[])[];
       /**
        * Scopes whose *inactive* entries are dropped outright. Use after a
        * delete: invalidation alone leaves the deleted entity's detail query
@@ -81,18 +85,23 @@ export const queryClient = new QueryClient({
    * makes the migration to this incremental.
    */
   mutationCache: new MutationCache({
-    onSuccess: (_data, _vars, _onMutateResult, mutation) => {
+    onSuccess: (_data, _vars, _onMutateResult, mutation): Promise<void> | void => {
       const meta = mutation.meta;
       if (!meta) return;
       for (const key of meta.removes ?? []) {
         queryClient.removeQueries({ queryKey: key, type: "inactive" });
       }
-      for (const key of meta.invalidates ?? []) {
-        void queryClient.invalidateQueries({ queryKey: key });
+      const refetches: Promise<void>[] = (meta.invalidates ?? []).map((key) =>
+        queryClient.invalidateQueries({ queryKey: key }),
+      );
+      for (const key of meta.stales ?? []) {
+        void queryClient.invalidateQueries({ queryKey: key, refetchType: "none" });
       }
       if (meta.successMessage) {
         notifyMutation("success", meta.successMessage);
       }
+      // TanStack awaits this callback before mutateAsync resolves.
+      if (meta.awaitInvalidation) return Promise.all(refetches).then(() => undefined);
     },
     onError: (err: any, _vars, _onMutateResult, mutation) => {
       const meta = mutation.meta;
diff --git a/web/src/composables/queryHistory/useLogsHistoryRecorder.ts b/web/src/composables/queryHistory/useLogsHistoryRecorder.ts
new file mode 100644
index 0000000000..71c0460989
--- /dev/null
+++ b/web/src/composables/queryHistory/useLogsHistoryRecorder.ts
@@ -0,0 +1,42 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { onBeforeUnmount } from "vue";
+import { useLogsAutoRun } from "@/composables/useLogs/logsAutoRun";
+import { searchState } from "@/composables/useLogs/searchState";
+import { useRecentSearches } from "./useRecentSearches";
+import { buildLogsRecord, isRecordedLogsRun, logsRunResult } from "@/utils/queryHistory/logs";
+
+/** Records each user-initiated Logs search once it finishes or fails. */
+export const useLogsHistoryRecorder = () => {
+  const { record } = useRecentSearches();
+  const { searchObj } = searchState();
+  const stop = useLogsAutoRun().onRunSettled((run) => {
+    if (!isRecordedLogsRun(run.reasons, run.signature)) return;
+    const result = logsRunResult(run);
+    if (!result) return;
+    const fields: unknown = searchObj.data.stream?.selectedFields;
+    record(
+      buildLogsRecord({
+        signature: run.signature,
+        startUs: run.startUs,
+        endUs: run.endUs,
+        columns: Array.isArray(fields) ? fields.map(String) : [],
+        result,
+      }),
+    );
+  });
+  onBeforeUnmount(stop);
+};
diff --git a/web/src/composables/queryHistory/useRecentEntryText.spec.ts b/web/src/composables/queryHistory/useRecentEntryText.spec.ts
new file mode 100644
index 0000000000..1fe946edff
--- /dev/null
+++ b/web/src/composables/queryHistory/useRecentEntryText.spec.ts
@@ -0,0 +1,93 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import { defineComponent } from "vue";
+import store from "@/test/unit/helpers/store";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { useRecentEntryText } from "./useRecentEntryText";
+
+const at = (iso: string) => Date.parse(iso) * 1000;
+
+const entry = (overrides: Partial<QueryHistoryEntry>): QueryHistoryEntry => ({
+  id: "e",
+  source: "logs",
+  query: "q",
+  query_key: "k",
+  streams: [],
+  context: {},
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: at("2026-10-29T10:00:00Z"),
+  updated_at: at("2026-10-29T10:00:00Z"),
+  ...overrides,
+});
+
+const text = () => {
+  let api!: ReturnType<typeof useRecentEntryText>;
+  mount(
+    defineComponent({
+      setup() {
+        api = useRecentEntryText();
+        return () => null;
+      },
+    }),
+    { global: { plugins: [store] } },
+  );
+  return api;
+};
+
+describe("useRecentEntryText", () => {
+  it("shows a same-day run span as times only", () => {
+    const span = text().spanText(entry({ run_count: 3, created_at: at("2026-10-29T08:05:00Z") }));
+    expect(span).toBe("ran 3x · 08:05–10:00");
+  });
+
+  it("dates both ends of a run span that covers several days", () => {
+    const span = text().spanText(entry({ run_count: 4, created_at: at("2026-10-26T09:12:00Z") }));
+    expect(span).toBe("ran 4x · Oct 26 09:12 – Oct 29 10:00");
+  });
+
+  it("names a calendar preset by its rail label, not its stored token", () => {
+    const api = text();
+    const relative = (period: string) =>
+      api.windowText(
+        entry({ context: { time: { type: "relative", period, start_time: 0, end_time: 0 } } }),
+      );
+    expect(relative("calendar:day:0")).toBe("Today");
+    expect(relative("calendar:week:0")).toBe("This week");
+    expect(relative("calendar:month:-1")).toBe("Last month");
+    expect(relative("15m")).toBe("Last 15m");
+    expect(api.windowText(entry({ context: { time_range: { period: "calendar:day:-1" } } }))).toBe(
+      "Yesterday",
+    );
+  });
+
+  it("cuts days in the configured timezone", () => {
+    const original = store.state.timezone;
+    store.state.timezone = "Asia/Kolkata";
+    try {
+      const api = text();
+      expect(api.zone.value).toBe("Asia/Kolkata");
+      expect(api.spanText(entry({ run_count: 2, created_at: at("2026-10-28T20:00:00Z") }))).toBe(
+        "ran 2x · 01:30–15:30",
+      );
+    } finally {
+      store.state.timezone = original;
+    }
+  });
+});
diff --git a/web/src/composables/queryHistory/useRecentEntryText.ts b/web/src/composables/queryHistory/useRecentEntryText.ts
new file mode 100644
index 0000000000..6d711a8ff2
--- /dev/null
+++ b/web/src/composables/queryHistory/useRecentEntryText.ts
@@ -0,0 +1,64 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { computed } from "vue";
+import { useStore } from "vuex";
+import { DateTime } from "luxon";
+import { useI18nTyped } from "@/types/i18n";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { getIntlLocale } from "@/locales";
+import { formatCalendarLabel } from "@/utils/dashboard/calendarPeriods";
+
+/** The time window and run span of a recent search, and the zone its days are cut in. */
+export const useRecentEntryText = () => {
+  const store = useStore();
+  const { t } = useI18nTyped();
+
+  const zone = computed(() => {
+    const tz = String(store.state.timezone ?? "");
+    return !tz || ["local", "browser"].includes(tz.toLowerCase()) ? undefined : tz;
+  });
+  const at = (us: number) => DateTime.fromMillis(us / 1000, zone.value ? { zone: zone.value } : {});
+  const sameDay = (a: number, b: number) => at(a).hasSame(at(b), "day");
+  // A calendar preset is stored as its token ("calendar:day:0"), which reads as its rail label.
+  const periodText = (period: string): string =>
+    formatCalendarLabel(period, store.state.timezone, t, getIntlLocale()) ??
+    t("recentSearches.relativeWindow", { period });
+
+  const windowText = (entry: QueryHistoryEntry): string => {
+    const time = entry.context.time;
+    if (time?.type === "relative" && time.period) return periodText(time.period);
+    if (time) {
+      const end = sameDay(time.start_time, time.end_time) ? "HH:mm" : "LLL d HH:mm";
+      return `${at(time.start_time).toFormat("LLL d HH:mm")} – ${at(time.end_time).toFormat(end)}`;
+    }
+    const legacy = entry.context.time_range;
+    if (legacy && "period" in legacy) return periodText(legacy.period);
+    return "";
+  };
+
+  const spanText = (entry: QueryHistoryEntry): string => {
+    const last = at(entry.updated_at).toFormat("HH:mm");
+    if (entry.run_count <= 1) return last;
+    const ran = t("recentSearches.ranCount", { count: entry.run_count });
+    if (sameDay(entry.created_at, entry.updated_at)) {
+      return `${ran} · ${at(entry.created_at).toFormat("HH:mm")}–${last}`;
+    }
+    const span = `${at(entry.created_at).toFormat("LLL d HH:mm")} – ${at(entry.updated_at).toFormat("LLL d HH:mm")}`;
+    return `${ran} · ${span}`;
+  };
+
+  return { zone, windowText, spanText };
+};
diff --git a/web/src/composables/queryHistory/useRecentSearches.ts b/web/src/composables/queryHistory/useRecentSearches.ts
new file mode 100644
index 0000000000..df096702bc
--- /dev/null
+++ b/web/src/composables/queryHistory/useRecentSearches.ts
@@ -0,0 +1,102 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { computed, type Ref } from "vue";
+import { useStore } from "vuex";
+import { useMutation, useQuery } from "@tanstack/vue-query";
+import { useOrgId } from "@/composables/query/useOrgId";
+import { useI18nTyped } from "@/types/i18n";
+import {
+  clearQueryHistoryMutation,
+  deleteQueryHistoryMutation,
+  recentFailedCountQuery,
+  recentSearchesQuery,
+  recordQueryHistoryMutation,
+  starQueryHistoryMutation,
+} from "@/services/query_history.queries";
+import type {
+  HistorySource,
+  QueryHistoryClearParams,
+  QueryHistoryRecordBody,
+} from "@/services/query_history";
+
+const DEFAULT_RETENTION_DAYS = 14;
+
+/** Shared record, star, delete and clear; everything is off when the server disables history. */
+export const useRecentSearches = () => {
+  const store = useStore();
+  const orgId = useOrgId();
+  const enabled = computed(() => store.state.zoConfig?.query_history_enabled === true);
+  const retentionDays = computed(() => {
+    const days = Number(store.state.zoConfig?.query_history_retention_days);
+    return Number.isFinite(days) ? days : DEFAULT_RETENTION_DAYS;
+  });
+
+  const recordEntry = useMutation(() => recordQueryHistoryMutation(orgId.value));
+  const starEntry = useMutation(() => starQueryHistoryMutation(orgId.value));
+  const deleteEntry = useMutation(() => deleteQueryHistoryMutation(orgId.value));
+  const clearEntries = useMutation(() => clearQueryHistoryMutation(orgId.value));
+
+  /** Fire-and-forget: a failed record is only logged and never reaches the search. */
+  const record = (body: QueryHistoryRecordBody | null) => {
+    if (!body || !enabled.value || !orgId.value) return;
+    recordEntry.mutateAsync(body).catch((err: unknown) => {
+      console.error("Failed to record query history", err);
+    });
+  };
+
+  const star = (id: string, starred: boolean) => starEntry.mutate({ id, starred });
+  /** Rejects when the server keeps the entry; the mutation has already toasted the error. */
+  const remove = (id: string, org = orgId.value) => deleteEntry.mutateAsync({ org, id });
+  const clear = (params: QueryHistoryClearParams) => clearEntries.mutateAsync(params);
+
+  const { t } = useI18nTyped();
+  /** Scope, privacy and retention of this org's recent searches. */
+  const about = computed(() =>
+    retentionDays.value > 0
+      ? t(
+          "recentSearches.aboutKeptDays",
+          { org: orgId.value, days: retentionDays.value },
+          retentionDays.value,
+        )
+      : t("recentSearches.aboutKeptForever", { org: orgId.value }),
+  );
+
+  return { orgId, enabled, retentionDays, about, record, star, remove, clear };
+};
+
+/** The recent rows of one page, fetched only while `active` is true. */
+export const useRecentSearchesList = (source: HistorySource, active: Ref<boolean>) => {
+  const store = useStore();
+  const orgId = useOrgId();
+  return useQuery(() =>
+    Object.assign(recentSearchesQuery(orgId.value, source), {
+      enabled:
+        active.value && !!orgId.value && store.state.zoConfig?.query_history_enabled === true,
+    }),
+  );
+};
+
+/** How many of one page's entries failed, fetched only while `active` is true. */
+export const useRecentFailedCount = (source: HistorySource, active: Ref<boolean>) => {
+  const store = useStore();
+  const orgId = useOrgId();
+  return useQuery(() =>
+    Object.assign(recentFailedCountQuery(orgId.value, source), {
+      enabled:
+        active.value && !!orgId.value && store.state.zoConfig?.query_history_enabled === true,
+    }),
+  );
+};
diff --git a/web/src/composables/queryHistory/useRecentSearchesEditorHost.spec.ts b/web/src/composables/queryHistory/useRecentSearchesEditorHost.spec.ts
new file mode 100644
index 0000000000..7fc51b697b
--- /dev/null
+++ b/web/src/composables/queryHistory/useRecentSearchesEditorHost.spec.ts
@@ -0,0 +1,158 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { defineComponent, h, inject } from "vue";
+import { enableAutoUnmount, flushPromises, mount } from "@vue/test-utils";
+import store from "@/test/unit/helpers/store";
+import {
+  RECENT_SEARCHES_EDITOR_HOST,
+  useRecentSearchesEditorHost,
+  type RecentSearchesEditorHost,
+} from "./useRecentSearchesEditorHost";
+
+const api = vi.hoisted(() => ({ list: vi.fn(), record: vi.fn(), star: vi.fn(), remove: vi.fn() }));
+vi.mock("@/services/query_history", () => ({ default: api }));
+
+enableAutoUnmount(afterEach);
+
+const NOW_US = Date.now() * 1000;
+const row = (id: string, query: string) => ({
+  id,
+  source: "metrics",
+  query,
+  query_key: "k",
+  streams: [],
+  context: {},
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: NOW_US,
+  updated_at: NOW_US,
+});
+
+const mountHost = (empty: { value: boolean }) => {
+  const seen: { host: RecentSearchesEditorHost | null } = { host: null };
+  const Editor = defineComponent({
+    setup() {
+      seen.host = inject(RECENT_SEARCHES_EDITOR_HOST, null);
+      return () => h("div");
+    },
+  });
+  const Page = defineComponent({
+    setup() {
+      const recent = useRecentSearchesEditorHost("metrics", {
+        opensOnFocus: () => empty.value,
+        acceptsQuery: (query) => !query.includes("\n"),
+      });
+      return { recent };
+    },
+    render: () => h(Editor),
+  });
+  const wrapper = mount(Page, { global: { plugins: [store] } });
+  const recent = () =>
+    (wrapper.vm as unknown as { recent: ReturnType<typeof useRecentSearchesEditorHost> }).recent;
+  return { wrapper, seen, recent };
+};
+
+describe("recent searches for a nested editor", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.zoConfig.query_history_enabled = true;
+    api.list.mockResolvedValue({
+      data: [row("a", "rate(x[5m])"), row("b", "up\nsum(up)"), row("c", "sum(up)")],
+    });
+  });
+  afterEach(() => {
+    delete store.state.zoConfig.query_history_enabled;
+  });
+
+  it("opens the dropdown when an empty editor gets focus and closes it on the first character", async () => {
+    const { seen, recent } = mountHost({ value: true });
+    const box = document.createElement("div");
+    seen.host!.onFocus(box);
+    await flushPromises();
+    expect(recent().open.value).toBe(true);
+    expect(recent().anchor.value).toBe(box);
+    expect(api.list).toHaveBeenCalledWith("default", { source: "metrics", status: "ok", limit: 8 });
+    seen.host!.onEdit(false, true);
+    expect(recent().open.value).toBe(false);
+  });
+
+  it("closes the dropdown on Escape and leaves the event to the editor's own Escape binding", async () => {
+    const { seen, recent } = mountHost({ value: true });
+    seen.host!.onFocus(document.createElement("div"));
+    await flushPromises();
+    const monaco = document.createElement("div");
+    monaco.className = "monaco-editor";
+    monaco.addEventListener("keydown", (e) => seen.host!.onKeydown(e));
+    const escape = new KeyboardEvent("keydown", { key: "Escape", cancelable: true });
+    const stop = vi.spyOn(escape, "stopPropagation");
+    monaco.dispatchEvent(escape);
+    expect(recent().open.value).toBe(false);
+    expect(stop).not.toHaveBeenCalled();
+    expect(escape.defaultPrevented).toBe(false);
+  });
+
+  it("opens when an edit empties the editor, closes on the next character, and respects a dismissal", async () => {
+    const { seen, recent } = mountHost({ value: false });
+    seen.host!.onFocus(document.createElement("div"));
+    await flushPromises();
+    expect(recent().open.value).toBe(false);
+
+    seen.host!.onEdit(true, false);
+    expect(recent().open.value).toBe(true);
+    seen.host!.onEdit(false, true);
+    expect(recent().open.value).toBe(false);
+    seen.host!.onEdit(true, false);
+    expect(recent().open.value).toBe(true);
+
+    recent().open.value = false;
+    seen.host!.onEdit(true, true);
+    expect(recent().open.value).toBe(false);
+    seen.host!.onEdit(false, true);
+    seen.host!.onEdit(true, false);
+    expect(recent().open.value).toBe(true);
+  });
+
+  it("reopens on a single clear after a restore wrote the editor without an edit event", async () => {
+    const { seen, recent } = mountHost({ value: true });
+    seen.host!.onFocus(document.createElement("div"));
+    await flushPromises();
+    expect(recent().open.value).toBe(true);
+    recent().open.value = false;
+
+    seen.host!.onEdit(true, false);
+    expect(recent().open.value).toBe(true);
+  });
+
+  it("keeps the dropdown closed when a query has text, but still loads clock rows", async () => {
+    const { seen, recent } = mountHost({ value: false });
+    seen.host!.onFocus(null);
+    await flushPromises();
+    expect(recent().open.value).toBe(false);
+    expect(seen.host!.queries.value).toEqual(["rate(x[5m])", "sum(up)"]);
+  });
+
+  it("offers nothing and opens nothing when history is disabled", async () => {
+    store.state.zoConfig.query_history_enabled = false;
+    const { seen, recent } = mountHost({ value: true });
+    seen.host!.onFocus(null);
+    await flushPromises();
+    expect(recent().open.value).toBe(false);
+    expect(seen.host!.queries.value).toEqual([]);
+    expect(api.list).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/composables/queryHistory/useRecentSearchesEditorHost.ts b/web/src/composables/queryHistory/useRecentSearchesEditorHost.ts
new file mode 100644
index 0000000000..fbe5c384ce
--- /dev/null
+++ b/web/src/composables/queryHistory/useRecentSearchesEditorHost.ts
@@ -0,0 +1,86 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { computed, provide, ref, type ComputedRef, type InjectionKey, type Ref } from "vue";
+import type { HistorySource } from "@/services/query_history";
+import {
+  recentQueryList,
+  recentsOpenAfterEdit,
+  routeEditorKeyToRecents,
+  type RecentsKeyTarget,
+} from "@/utils/queryHistory/recentSearches";
+import { useRecentSearches, useRecentSearchesList } from "./useRecentSearches";
+
+/** What a nested query editor reports to the page that owns the recent searches. */
+export interface RecentSearchesEditorHost {
+  /** Recent queries the editor offers as clock rows. */
+  queries: ComputedRef<string[]>;
+  onFocus: (anchor: HTMLElement | null) => void;
+  /** Whether the editor text is blank after the edit and was blank before it. */
+  onEdit: (isBlank: boolean, wasBlank: boolean) => void;
+  /** Bound in the capture phase: the editor's Escape binding stops the event, and that binding must still run. */
+  onKeydown: (event: KeyboardEvent) => void;
+}
+
+export const RECENT_SEARCHES_EDITOR_HOST: InjectionKey<RecentSearchesEditorHost> = Symbol(
+  "recentSearchesEditorHost",
+);
+
+/** Provides recents to an editor several components down (Metrics' PanelEditor) and drives its focus dropdown. */
+export const useRecentSearchesEditorHost = (
+  source: HistorySource,
+  options: {
+    /** True when focusing should open the dropdown, e.g. every visible query is empty. */
+    opensOnFocus: () => boolean;
+    /** Keeps only the queries one editor can take, e.g. no multi-query rows. */
+    acceptsQuery?: (query: string) => boolean;
+    /** Whether the editor counts as empty when its text is blank or not; defaults to the text alone. */
+    emptyWith?: (isBlank: boolean) => boolean;
+  },
+) => {
+  const { enabled } = useRecentSearches();
+  const open = ref(false);
+  const anchor = ref<HTMLElement | null>(null);
+  const dropdownRef: Ref<RecentsKeyTarget | null> = ref(null);
+  const listActive = ref(false);
+  const list = useRecentSearchesList(source, listActive);
+  const accepts = options.acceptsQuery ?? (() => true);
+  const emptyWith = options.emptyWith ?? ((isBlank: boolean) => isBlank);
+
+  const queries = computed(() =>
+    enabled.value ? recentQueryList(list.data.value ?? []).filter(accepts) : [],
+  );
+
+  const host: RecentSearchesEditorHost = {
+    queries,
+    onFocus: (box) => {
+      if (!enabled.value) return;
+      anchor.value = box;
+      listActive.value = true;
+      if (options.opensOnFocus()) open.value = true;
+    },
+    onEdit: (isBlank, wasBlank) => {
+      const isEmpty = enabled.value && emptyWith(isBlank);
+      open.value = recentsOpenAfterEdit(open.value, emptyWith(wasBlank), isEmpty);
+    },
+    onKeydown: (event) => {
+      if (!open.value) return;
+      routeEditorKeyToRecents(event, dropdownRef.value, () => (open.value = false));
+    },
+  };
+  provide(RECENT_SEARCHES_EDITOR_HOST, host);
+
+  return { open, anchor, dropdownRef, queries };
+};
diff --git a/web/src/composables/rum/useAnalyticsSearch.spec.ts b/web/src/composables/rum/useAnalyticsSearch.spec.ts
index 3991b534f7..be6bf5e23b 100644
--- a/web/src/composables/rum/useAnalyticsSearch.spec.ts
+++ b/web/src/composables/rum/useAnalyticsSearch.spec.ts
@@ -69,6 +69,25 @@ describe("useAnalyticsSearch", () => {
     });
   });
 
+  it("passes a per-run cache choice to the search service", async () => {
+    vi.mocked(searchService.search).mockResolvedValue({ data: { hits: [] } } as never);
+    const runner = useAnalyticsSearch();
+    await runner.run("p", { ...spec(), useCache: false }, "k1");
+    expect(vi.mocked(searchService.search).mock.calls[0][3]).toBe(false);
+    await runner.run("q", spec(), "k2");
+    expect(vi.mocked(searchService.search).mock.calls[1][3]).toBeUndefined();
+  });
+
+  it("holds a panel as loading and keeps its rows only when asked", async () => {
+    vi.mocked(searchService.search).mockResolvedValue({ data: { hits: [{ x: 1 }] } } as never);
+    const runner = useAnalyticsSearch();
+    await runner.run("p", spec(), "k1");
+    runner.hold("p", "loading", true);
+    expect(runner.panel("p").value).toMatchObject({ status: "loading", rows: [{ x: 1 }] });
+    runner.hold("p", "loading");
+    expect(runner.panel("p").value).toMatchObject({ status: "loading", rows: [] });
+  });
+
   it("base64-encodes the SQL when the server asks for it", async () => {
     mockStore.state.zoConfig.sql_base64_enabled = true;
     vi.mocked(searchService.search).mockResolvedValue({ data: { hits: [] } } as never);
diff --git a/web/src/composables/rum/useAnalyticsSearch.ts b/web/src/composables/rum/useAnalyticsSearch.ts
index 6e853fdd22..d81b30c6d6 100644
--- a/web/src/composables/rum/useAnalyticsSearch.ts
+++ b/web/src/composables/rum/useAnalyticsSearch.ts
@@ -34,6 +34,8 @@ export interface SearchSpec {
   endUs: number;
   limit: number;
   sampled: SampleRatio;
+  /** False skips the server's result cache; omitted keeps the app-wide default. */
+  useCache?: boolean;
 }
 interface SearchError {
   code?: string;
@@ -149,6 +151,8 @@ export default function useAnalyticsSearch(
           signal: entry.controller?.signal,
         },
         "RUM",
+        false,
+        entry.spec.useCache,
       )) as SearchResponse;
       const data = res?.data ?? {};
       const partial = data.function_error || (data.is_partial ? "partial" : null);
@@ -209,10 +213,11 @@ export default function useAnalyticsSearch(
   };
 
   // Dropping the entry is what stops a run already in flight from settling onto the held panel.
-  const hold = (id: string, status: "idle" | "loading") => {
+  const hold = (id: string, status: "idle" | "loading", keepRows = false) => {
     entries.get(id)?.controller?.abort();
     entries.delete(id);
-    panel(id).value = { ...emptyPanel(), status };
+    const p = panel(id);
+    p.value = keepRows ? { ...p.value, status, error: null } : { ...emptyPanel(), status };
   };
 
   const rerunAborted = async (): Promise<void> => {
diff --git a/web/src/composables/rum/useRumOverviewData.spec.ts b/web/src/composables/rum/useRumOverviewData.spec.ts
new file mode 100644
index 0000000000..222dffd4ff
--- /dev/null
+++ b/web/src/composables/rum/useRumOverviewData.spec.ts
@@ -0,0 +1,455 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { ref } from "vue";
+import { flushPromises } from "@vue/test-utils";
+
+const mockSearch = vi.fn();
+
+vi.mock("vuex", () => ({
+  useStore: () => ({ state: { selectedOrganization: { identifier: "org" }, zoConfig: {} } }),
+}));
+vi.mock("@/services/search", () => ({
+  default: { search: (...a: unknown[]) => mockSearch(...a) },
+}));
+
+import useRumOverviewData from "./useRumOverviewData";
+
+type Hits = Record<string, unknown>[];
+type Responder = (sql: string) => Hits | Error | { status: number };
+
+const SCHEMA = new Set([
+  "service",
+  "env",
+  "version",
+  "session_id",
+  "view_id",
+  "view_url",
+  "view_error_count",
+  "view_largest_contentful_paint",
+  "view_interaction_to_next_paint",
+  "view_cumulative_layout_shift",
+  "user_agent_user_agent_family",
+  "user_agent_user_agent_major",
+  "geo_info_country",
+  "action_frustration_type",
+  "error_message",
+]);
+
+const HOUR_MS = 3_600_000;
+const START = new Date(1_700_000_000_000);
+const END = new Date(1_700_000_000_000 + 24 * HOUR_MS);
+
+const vitalsRow = (views: number) => ({
+  views,
+  lcp_p50: 1e9,
+  lcp_p75: 2e9,
+  lcp_p95: 3e9,
+  lcp_n: views,
+  lcp_good: views,
+  lcp_poor: 0,
+  inp_p50: 1e8,
+  inp_p75: 3e8,
+  inp_p95: 4e8,
+  inp_n: views,
+  inp_good: 0,
+  inp_poor: 0,
+  cls_p50: 0.01,
+  cls_p75: 0.02,
+  cls_p95: 0.03,
+  cls_n: views,
+  cls_good: views,
+  cls_poor: 0,
+});
+
+let responder: Responder;
+
+const setup = async (opts: { pagesVisible?: boolean; filters?: Record<string, string[]> } = {}) => {
+  mockSearch.mockImplementation(async (args: { query: { query: { sql: string } } }) => {
+    const out = responder(args.query.query.sql);
+    if (out instanceof Error) throw out;
+    if (!Array.isArray(out)) throw { response: { status: out.status, data: { message: "no" } } };
+    return { data: { hits: out } };
+  });
+  const data = useRumOverviewData(ref({ start_time: START, end_time: END }), ref(SCHEMA));
+  if (opts.filters) data.filters.value = { service: [], env: [], version: [], ...opts.filters };
+  if (opts.pagesVisible !== false) data.markPagesVisible();
+  await data.loadAll();
+  await flushPromises();
+  return data;
+};
+
+const sqls = () => mockSearch.mock.calls.map((c) => c[0].query.query.sql as string);
+const windowOf = (needle: string) =>
+  mockSearch.mock.calls
+    .filter((c) => c[0].query.query.sql.includes(needle))
+    .map((c) => [c[0].query.query.start_time, c[0].query.query.end_time]);
+
+const START_US = START.getTime() * 1000;
+const END_US = END.getTime() * 1000;
+const PREV_US = START_US - (END_US - START_US);
+
+const isVitals = (sql: string) => sql.includes("approx_percentile_cont(lcp, 0.5)");
+const isKpi = (sql: string) => sql.startsWith("WITH e AS (SELECT CASE WHEN _timestamp");
+const isSeries = (sql: string) => sql.includes("histogram");
+
+const kpiRows = (): Hits => [
+  { w: 1, gv: 1, sessions: 200, err_sessions: 20, errors: 40, unhandled: 10, rage: 7, dead: 3 },
+  { w: 0, gv: 1, sessions: 150, err_sessions: 10, errors: 30, unhandled: 5, rage: 2, dead: 1 },
+  {
+    w: 1,
+    gv: 0,
+    version: "2.0",
+    first_seen: 1_700_000_000_000_000 + 12 * HOUR_MS * 1000,
+    sessions: 100,
+    err_sessions: 10,
+  },
+  {
+    w: 1,
+    gv: 0,
+    version: "1.0",
+    first_seen: 1_700_000_000_000_000 + 1000,
+    sessions: 100,
+    err_sessions: 5,
+  },
+  { w: 1, gv: 0, version: "0.9", first_seen: 1_700_000_000_000_000, sessions: 3, err_sessions: 0 },
+  { w: 0, gv: 0, version: "3.0", first_seen: 1_699_990_000_000_000, sessions: 9, err_sessions: 0 },
+];
+
+const healthy: Responder = (sql) => {
+  if (isVitals(sql))
+    return [
+      { w: 1, ...vitalsRow(500) },
+      { w: 0, ...vitalsRow(400) },
+    ];
+  if (isKpi(sql)) return kpiRows();
+  if (isSeries(sql)) {
+    return [
+      { bucket: "2023-11-14 22:00:00", sessions: 10, err_sessions: 1, errors: 2, unhandled: 1 },
+      { bucket: "2023-11-15 00:00:00", sessions: 20, err_sessions: 2, errors: 4, unhandled: 2 },
+    ];
+  }
+  if (sql.includes("GROUP BY pg"))
+    return [{ pg: "/checkout", views: 300, lcp: 3e9, inp: 3e8, cls: 0.05, errors: 12, bad: 120 }];
+  return [];
+};
+
+describe("useRumOverviewData", () => {
+  beforeEach(() => {
+    mockSearch.mockReset();
+    responder = healthy;
+  });
+
+  it("derives ok statuses and maps both windows from one vitals and one KPI query", async () => {
+    const d = await setup();
+    expect(d.status.value.verdict).toBe("ok");
+    expect(d.vitals.value?.views).toBe(500);
+    expect(d.vitalsPrev.value?.views).toBe(400);
+    expect(d.vitals.value?.lcp.p75).toBe(2e9);
+    expect(d.status.value.kpis).toBe("ok");
+    expect(d.totals.value.cur).toEqual({ sessions: 200, errorFree: 90, errors: 40, unhandled: 10 });
+    expect(d.totals.value.prev?.sessions).toBe(150);
+    expect(d.frustration.value).toEqual({ cur: { rage: 7, dead: 3 }, prev: { rage: 2, dead: 1 } });
+    expect(d.pageState.value).toBe("ok");
+  });
+
+  it("issues eight requests per load, each scanning once", async () => {
+    await setup();
+    const all = sqls();
+    expect(all).toHaveLength(8);
+    expect(all.filter(isVitals)).toHaveLength(1);
+    expect(all.filter(isKpi)).toHaveLength(1);
+    expect(all.filter(isSeries)).toHaveLength(1);
+    expect(all.filter((q) => q.includes("GROUPING SETS ((s0_0, s0_1)"))).toHaveLength(1);
+    expect(all.filter((q) => q.includes("MIN(_timestamp) AS first_seen"))).toHaveLength(0);
+  });
+
+  it("spans the previous and current window in the vitals and KPI queries", async () => {
+    await setup();
+    expect(windowOf("approx_percentile_cont(lcp, 0.5)")).toEqual([[PREV_US, END_US]]);
+    expect(windowOf("WITH e AS (SELECT CASE WHEN _timestamp")).toEqual([[PREV_US, END_US]]);
+    expect(windowOf("histogram")).toEqual([[START_US, END_US]]);
+    expect(sqls().find(isKpi)).toContain(`CASE WHEN _timestamp >= ${START_US} THEN 1 ELSE 0 END`);
+  });
+
+  it("starts segments, pages and options only after the verdict and KPI queries return", async () => {
+    const gates: (() => void)[] = [];
+    mockSearch.mockImplementation(async (args: { query: { query: { sql: string } } }) => {
+      const sql = args.query.query.sql;
+      if (isVitals(sql) || isKpi(sql) || isSeries(sql)) {
+        await new Promise<void>((r) => gates.push(r));
+      }
+      return { data: { hits: healthy(sql) as Hits } };
+    });
+    const d = useRumOverviewData(ref({ start_time: START, end_time: END }), ref(SCHEMA));
+    d.markPagesVisible();
+    const done = d.loadAll();
+    await flushPromises();
+    expect(sqls()).toHaveLength(3);
+    gates.forEach((open) => open());
+    await done;
+    await flushPromises();
+    const later = sqls().slice(3);
+    expect(later.some((q) => q.includes("GROUP BY pg"))).toBe(true);
+    expect(later.some((q) => q.includes("GROUPING SETS ((s0_0"))).toBe(true);
+    expect(later.some((q) => q.includes("GROUP BY service, env, version"))).toBe(true);
+  });
+
+  it("waits for the pages panel to be seen before querying pages", async () => {
+    const d = await setup({ pagesVisible: false });
+    expect(sqls().some((q) => q.includes("GROUP BY pg"))).toBe(false);
+    expect(d.status.value.pages).toBe("loading");
+    d.markPagesVisible();
+    await flushPromises();
+    expect(sqls().filter((q) => q.includes("GROUP BY pg"))).toHaveLength(1);
+    expect(d.status.value.pages).toBe("ok");
+  });
+
+  it("reports low data under 100 views", async () => {
+    responder = (sql) => (isVitals(sql) ? [{ w: 1, ...vitalsRow(38) }] : healthy(sql));
+    const d = await setup();
+    expect(d.status.value.verdict).toBe("low");
+  });
+
+  it("reads a window with no rows as zeros, so an empty previous window is not usable", async () => {
+    responder = (sql) =>
+      isVitals(sql)
+        ? [{ w: 1, ...vitalsRow(500) }]
+        : isKpi(sql)
+          ? kpiRows().filter((r) => r.w === 1)
+          : healthy(sql);
+    const d = await setup();
+    expect(d.vitalsPrev.value?.views).toBe(0);
+    expect(d.totals.value.prev?.sessions).toBe(0);
+    expect(d.frustration.value.prev).toEqual({ rage: 0, dead: 0 });
+  });
+
+  it("shows one page-level empty state when there are no views or sessions", async () => {
+    responder = () => [];
+    const d = await setup();
+    expect(d.status.value.verdict).toBe("empty");
+    expect(d.status.value.kpis).toBe("empty");
+    expect(d.pageState.value).toBe("empty");
+  });
+
+  it("shows one page-level error only when every shown panel fails", async () => {
+    responder = () => new Error("boom");
+    const d = await setup();
+    expect(d.status.value.verdict).toBe("error");
+    expect(d.pageState.value).toBe("error");
+  });
+
+  it("reports forbidden separately from error, at panel and page level", async () => {
+    responder = () => ({ status: 403 });
+    const d = await setup();
+    expect(d.status.value.verdict).toBe("forbidden");
+    expect(d.pageState.value).toBe("forbidden");
+  });
+
+  it("keeps per-panel errors when only some panels fail", async () => {
+    responder = (sql) => (sql.includes("GROUP BY pg") ? new Error("boom") : healthy(sql));
+    const d = await setup();
+    expect(d.status.value.pages).toBe("error");
+    expect(d.status.value.verdict).toBe("ok");
+    expect(d.pageState.value).toBe("ok");
+  });
+
+  it("fills empty buckets with zero so the series has no gaps", async () => {
+    const d = await setup();
+    expect(d.series.value.map((p) => p.sessions)).toEqual([10, 0, 20]);
+  });
+
+  it("hands the chart the zero-filled series the table and sparklines use", async () => {
+    const d = await setup();
+    expect(d.chartHits.value).toEqual([
+      { x_axis_1: "2023-11-14T22:00:00", y_axis_1: 10, y_axis_2: 2 },
+      { x_axis_1: "2023-11-14T23:00:00", y_axis_1: 0, y_axis_2: 0 },
+      { x_axis_1: "2023-11-15T00:00:00", y_axis_1: 20, y_axis_2: 4 },
+    ]);
+    expect(d.status.value.chart).toBe("ok");
+  });
+
+  it("lets the chart render once the series is back, without waiting for the KPI scan", async () => {
+    let open: () => void = () => {};
+    mockSearch.mockImplementation(async (args: { query: { query: { sql: string } } }) => {
+      const sql = args.query.query.sql;
+      if (isKpi(sql)) await new Promise<void>((r) => (open = r));
+      return { data: { hits: healthy(sql) as Hits } };
+    });
+    const d = useRumOverviewData(ref({ start_time: START, end_time: END }), ref(SCHEMA));
+    const done = d.loadAll();
+    await flushPromises();
+    expect(d.status.value.chart).toBe("ok");
+    expect(d.status.value.kpis).toBe("loading");
+    open();
+    await done;
+  });
+
+  it("splits one segment query per dimension and shares against the window's views", async () => {
+    responder = (sql) =>
+      sql.includes("GROUPING SETS")
+        ? [
+            { s0_0: "Chrome", s0_1: "120", g0: 0, g1: 1, g2: 1, views: 100, inp: 1e8, lcp: 1e9 },
+            { s0_0: "Safari", s0_1: "17", g0: 0, g1: 1, g2: 1, views: 50, inp: 1e8, lcp: 1e9 },
+            { s1_0: "US", g0: 1, g1: 0, g2: 1, views: 125, inp: 1e8, lcp: 1e9 },
+            { g0: 1, g1: 0, g2: 1, views: 25, inp: 1e8, lcp: 1e9 },
+          ]
+        : healthy(sql);
+    const d = await setup();
+    expect(d.segments.value.browser?.map((r) => [r.label, r.share])).toEqual([
+      ["Chrome 120", 20],
+      ["Safari 17", 10],
+    ]);
+    expect(d.segments.value.country?.map((r) => [r.label, r.views])).toEqual([["US", 125]]);
+    expect(d.status.value.segments).toBe("ok");
+  });
+
+  it("resolves the release panel to empty with a single version", async () => {
+    responder = (sql) =>
+      isKpi(sql)
+        ? kpiRows().filter((r) => r.version !== "1.0" && r.version !== "0.9")
+        : healthy(sql);
+    const d = await setup();
+    expect(d.status.value.release).toBe("empty");
+  });
+
+  it("compares the two latest current-window versions from the KPI query", async () => {
+    responder = (sql) => (sql.includes("in_cur = 1") ? [{ new_errors: 3 }] : healthy(sql));
+    const d = await setup();
+    expect(d.status.value.release).toBe("ok");
+    expect(d.release.value?.cur.version).toBe("2.0");
+    expect(d.release.value?.prev.version).toBe("1.0");
+    expect(d.release.value?.newErrors).toBe(3);
+    expect(d.releaseMarker.value?.version).toBe("2.0");
+    expect(sqls().find((q) => q.includes("in_cur = 1"))).toContain("version IN ('2.0','1.0')");
+  });
+
+  it("queries release sessions separately when a version filter narrows the KPIs", async () => {
+    responder = (sql) =>
+      sql.includes("MIN(_timestamp) AS first_seen")
+        ? [
+            {
+              version: "2.0",
+              first_seen: 1_700_000_000_000_000 + 12 * HOUR_MS * 1000,
+              sessions: 100,
+              err_sessions: 10,
+            },
+            {
+              version: "1.0",
+              first_seen: 1_700_000_000_000_000 + 1000,
+              sessions: 100,
+              err_sessions: 5,
+            },
+          ]
+        : isKpi(sql)
+          ? kpiRows().filter((r) => r.gv === 1)
+          : healthy(sql);
+    const d = await setup({ filters: { version: ["2.0"] } });
+    const kpi = sqls().find(isKpi)!;
+    expect(kpi).toContain("version IN ('2.0')");
+    expect(kpi).not.toContain("GROUPING SETS");
+    const rel = sqls().find((q) => q.includes("MIN(_timestamp) AS first_seen"))!;
+    expect(rel).not.toContain("version IN ('2.0')");
+    expect(d.release.value?.cur.version).toBe("2.0");
+    expect(d.status.value.release).toBe("ok");
+  });
+
+  it("keeps every answered panel on screen, marked busy, while a reload runs", async () => {
+    const d = await setup();
+    let open: () => void = () => {};
+    mockSearch.mockImplementation(async (args: { query: { query: { sql: string } } }) => {
+      await new Promise<void>((r) => (open = r));
+      return { data: { hits: healthy(args.query.query.sql) as Hits } };
+    });
+    const done = d.loadAll();
+    await flushPromises();
+    expect(d.status.value.verdict).toBe("ok");
+    expect(d.status.value.kpis).toBe("ok");
+    expect(d.status.value.pages).toBe("ok");
+    expect(d.vitals.value?.views).toBe(500);
+    expect(d.pages.value).toHaveLength(1);
+    expect(d.busy.value.verdict).toBe(true);
+    expect(d.busy.value.pages).toBe(true);
+    open();
+    void done;
+  });
+
+  it("shows a skeleton on a first load with nothing answered yet", async () => {
+    mockSearch.mockImplementation(() => new Promise(() => {}));
+    const d = useRumOverviewData(ref({ start_time: START, end_time: END }), ref(SCHEMA));
+    void d.loadAll();
+    await flushPromises();
+    expect(d.status.value.verdict).toBe("loading");
+    expect(d.status.value.chart).toBe("loading");
+  });
+
+  it("leaves out the bucket that still contains now from the series and the chart", async () => {
+    const hour = 3_600_000;
+    const nowHour = Math.floor(Date.now() / hour) * hour;
+    const label = (ms: number) => new Date(ms).toISOString().slice(0, 19);
+    const end = new Date(nowHour + hour);
+    const start = new Date(end.getTime() - 24 * hour);
+    responder = (sql) =>
+      isSeries(sql)
+        ? [
+            { bucket: label(nowHour - hour), sessions: 1500 },
+            { bucket: label(nowHour), sessions: 400 },
+          ]
+        : healthy(sql);
+    mockSearch.mockImplementation(async (args: { query: { query: { sql: string } } }) => ({
+      data: { hits: responder(args.query.query.sql) as Hits },
+    }));
+    const d = useRumOverviewData(ref({ start_time: start, end_time: end }), ref(SCHEMA));
+    await d.loadAll();
+    await flushPromises();
+    expect(d.series.value.map((p) => p.sessions)).toEqual([1500]);
+    expect(d.chartHits.value).toEqual([
+      { x_axis_1: label(nowHour - hour), y_axis_1: 1500, y_axis_2: 0 },
+    ]);
+  });
+
+  it("reads the series without the server's result cache", async () => {
+    await setup();
+    const series = mockSearch.mock.calls.filter((c) => isSeries(c[0].query.query.sql));
+    expect(series).toHaveLength(1);
+    expect(series[0][3]).toBe(false);
+    expect(
+      mockSearch.mock.calls
+        .filter((c) => !isSeries(c[0].query.query.sql))
+        .every((c) => c[3] === undefined),
+    ).toBe(true);
+  });
+
+  it("starts no second wave after an abort", async () => {
+    let open: () => void = () => {};
+    mockSearch.mockImplementation(async (args: { query: { query: { sql: string } } }) => {
+      const sql = args.query.query.sql;
+      if (isVitals(sql)) await new Promise<void>((r) => (open = r));
+      return { data: { hits: healthy(sql) as Hits } };
+    });
+    const d = useRumOverviewData(ref({ start_time: START, end_time: END }), ref(SCHEMA));
+    d.markPagesVisible();
+    const done = d.loadAll();
+    await flushPromises();
+    d.abortAll();
+    open();
+    await done;
+    await flushPromises();
+    expect(
+      sqls().some((q) => q.includes("GROUP BY pg") || q.includes("GROUPING SETS ((s0_0")),
+    ).toBe(false);
+  });
+});
diff --git a/web/src/composables/rum/useRumOverviewData.ts b/web/src/composables/rum/useRumOverviewData.ts
new file mode 100644
index 0000000000..eb3570db77
--- /dev/null
+++ b/web/src/composables/rum/useRumOverviewData.ts
@@ -0,0 +1,493 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { computed, reactive, ref, type Ref } from "vue";
+import useAnalyticsSearch, { type PanelState } from "@/composables/rum/useAnalyticsSearch";
+import type { RumTabDateTime } from "@/composables/rum/useRumPerformanceTab";
+import {
+  bucketInterval,
+  chartSql,
+  dropOpenBucket,
+  fillBuckets,
+  intervalFromKey,
+  intervalMicros,
+  filterOptionsSql,
+  isLowData,
+  kpiSql,
+  mapPages,
+  mapSegments,
+  mapVitals,
+  pagesSql,
+  previousWindow,
+  releaseNewErrorsSql,
+  releaseRowsFromKpi,
+  releaseSessionsSql,
+  releaseVitalsSql,
+  segmentColumns,
+  segmentDims,
+  segmentsSql,
+  seriesSql,
+  splitSegments,
+  toNum,
+  vitalsSql,
+  windowRow,
+  biggestDifference,
+  versionPredatesRange,
+  type OverviewFilters,
+  type QueryCtx,
+  type SegmentDim,
+  type SegmentRow,
+} from "@/utils/rum/performanceOverview";
+
+type Row = Record<string, unknown>;
+export type WidgetStatus = "loading" | "error" | "forbidden" | "empty" | "low" | "ok" | "hidden";
+export type WidgetGroup =
+  "verdict" | "kpis" | "chart" | "pages" | "segments" | "release" | "frustration";
+
+const ID = {
+  vitals: "ov-vitals",
+  kpi: "ov-kpi",
+  series: "ov-series",
+  pages: "ov-pages",
+  segments: "ov-segments",
+  relSessions: "ov-rel-sessions",
+  relVitals: "ov-rel-vitals",
+  relNew: "ov-rel-new",
+  options: "ov-options",
+};
+
+const toMicros = (v: Date | number | null | undefined): number =>
+  v instanceof Date ? v.getTime() * 1000 : typeof v === "number" ? v * 1000 : 0;
+
+const bucketLabel = (us: number): string => new Date(us / 1000).toISOString().slice(0, 19);
+
+// histogram() buckets arrive as UTC strings without a zone suffix.
+const bucketMicros = (v: unknown): number => {
+  if (typeof v === "number") return v;
+  const raw = String(v ?? "");
+  const ms = Date.parse(/Z|[+-]\d\d:?\d\d$/.test(raw) ? raw : `${raw.replace(" ", "T")}Z`);
+  return Number.isNaN(ms) ? 0 : ms * 1000;
+};
+
+const EMPTY: PanelState<Row> = {
+  status: "idle",
+  rows: [],
+  error: null,
+  partial: null,
+  key: null,
+  sampled: 1,
+};
+
+const emptyFilters = (): OverviewFilters => ({ service: [], env: [], version: [] });
+
+export default function useRumOverviewData(
+  dateTime: Ref<RumTabDateTime | undefined>,
+  schema: Ref<Set<string> | null>,
+) {
+  const search = useAnalyticsSearch();
+  const filters = ref<OverviewFilters>(emptyFilters());
+  const range = ref<{ startUs: number; endUs: number } | null>(null);
+
+  const rows = (id: string): PanelState<Row> => search.panel<Row>(id).value ?? EMPTY;
+  // Panels that have shown an answer keep it on screen while a reload is in flight.
+  const answered = reactive(new Set<string>());
+  const pending = (id: string) => ["idle", "loading", "aborted"].includes(rows(id).status);
+  const statusOf = (ids: string[]): "loading" | "error" | "forbidden" | "ok" => {
+    const s = ids.map((id) => rows(id).status);
+    if (s.includes("error")) return "error";
+    if (s.includes("forbidden")) return "forbidden";
+    if (ids.some(pending)) return ids.every((id) => answered.has(id)) ? "ok" : "loading";
+    return "ok";
+  };
+  // A window with no rows aggregates to zeros, as a query without GROUP BY would return.
+  const windowOf = (id: string, w: 0 | 1): Row | undefined => {
+    const p = rows(id);
+    if (!p.rows.length) return p.status === "ok" ? {} : undefined;
+    return windowRow(p.rows, w) ?? {};
+  };
+
+  const ctx = (): QueryCtx => ({ schema: schema.value ?? new Set(), filters: filters.value });
+
+  // A version filter must not narrow the release pick, so release sessions then need their own query.
+  const releaseViaKpi = () => !filters.value.version.length;
+  const releaseSource = () => (releaseViaKpi() ? ID.kpi : ID.relSessions);
+  const releaseRows = (): Row[] =>
+    releaseViaKpi() ? releaseRowsFromKpi(rows(ID.kpi).rows) : rows(ID.relSessions).rows;
+
+  const track = (id: string, p: PanelState<Row>) => {
+    if (p.status === "ok") answered.add(id);
+    else if (p.status === "error" || p.status === "forbidden") answered.delete(id);
+  };
+  const runOnce = (
+    id: string,
+    sql: string,
+    w: { startUs: number; endUs: number },
+    limit: number,
+    useCache?: boolean,
+  ) => search.run<Row>(id, { sql, ...w, limit, sampled: 1, useCache }, `${id}:${sql}`);
+  const exec = (
+    id: string,
+    sql: string | null,
+    w: { startUs: number; endUs: number },
+    limit = 20,
+  ) => {
+    if (!sql) {
+      answered.delete(id);
+      search.hold(id, "idle");
+      return Promise.resolve();
+    }
+    return runOnce(id, sql, w, limit).then((p) => track(id, p));
+  };
+
+  const bothWindows = (w: { startUs: number; endUs: number }) => ({
+    startUs: previousWindow(w.startUs, w.endUs).startUs,
+    endUs: w.endUs,
+  });
+
+  let runSeq = 0;
+  const pagesDue = ref(false);
+  const pagesSeen = ref(false);
+
+  const loadVerdict = () => {
+    const w = range.value;
+    if (!w) return Promise.resolve();
+    return exec(ID.vitals, vitalsSql(ctx(), w.startUs), bothWindows(w), 2);
+  };
+
+  let releaseRun = 0;
+  const loadReleaseDetails = async () => {
+    const w = range.value;
+    if (!w) return;
+    const [cur, prev] = releaseRows().map((r) => String(r.version));
+    await Promise.all([
+      exec(ID.relVitals, releaseVitalsSql(ctx(), [cur, prev].filter(Boolean)), w, 2),
+      exec(ID.relNew, cur && prev ? releaseNewErrorsSql(ctx(), cur, prev) : null, w, 1),
+    ]);
+  };
+  const loadReleaseSessions = async () => {
+    const w = range.value;
+    if (!w) return;
+    const run = ++releaseRun;
+    await exec(ID.relSessions, releaseSessionsSql(ctx()), w, 2);
+    if (run === releaseRun) await loadReleaseDetails();
+  };
+
+  // Release details chain off the KPI scan but must not hold back the second wave.
+  const loadKpi = () => {
+    const w = range.value;
+    if (!w) return Promise.resolve();
+    const withRelease = releaseViaKpi() && !!schema.value?.has("version");
+    return exec(ID.kpi, kpiSql(ctx(), w.startUs, withRelease), bothWindows(w), 1000).then(() => {
+      if (withRelease && rows(ID.kpi).status === "ok") void loadReleaseDetails();
+    });
+  };
+  const loadSeries = () => {
+    const w = range.value;
+    if (!w) return Promise.resolve();
+    const sql = seriesSql(ctx(), bucketInterval(w.startUs, w.endUs));
+    // The server's histogram result cache has returned missing buckets and 400s for reused ranges, so the chart reads fresh.
+    return runOnce(ID.series, sql, w, 500, false).then((p) => track(ID.series, p));
+  };
+  const loadKpis = () => Promise.all([loadKpi(), loadSeries()]);
+  const loadPages = () =>
+    range.value ? exec(ID.pages, pagesSql(ctx()), range.value, 200) : Promise.resolve();
+  const loadSegments = () =>
+    range.value ? exec(ID.segments, segmentsSql(ctx()), range.value, 1000) : Promise.resolve();
+  const loadRelease = () => {
+    if (!releaseViaKpi()) return loadReleaseSessions();
+    return rows(ID.kpi).status === "ok" ? loadReleaseDetails() : loadKpi();
+  };
+
+  // Pages is the costliest scan, so it waits for its panel to be on screen as well as for wave two.
+  const maybeLoadPages = () => {
+    if (!pagesDue.value || !pagesSeen.value) return;
+    pagesDue.value = false;
+    void loadPages();
+  };
+  const markPagesVisible = () => {
+    pagesSeen.value = true;
+    maybeLoadPages();
+  };
+
+  const loaders: Record<WidgetGroup, () => Promise<unknown>> = {
+    verdict: loadVerdict,
+    kpis: loadKpis,
+    chart: loadSeries,
+    pages: loadPages,
+    segments: loadSegments,
+    release: loadRelease,
+    frustration: loadKpi,
+  };
+
+  // The server runs one query per core, so the verdict and KPI scans go alone before the rest.
+  const loadAll = async () => {
+    const startUs = toMicros(dateTime.value?.start_time);
+    const endUs = toMicros(dateTime.value?.end_time);
+    if (!startUs || !endUs || !schema.value) return;
+    range.value = { startUs, endUs };
+    const run = ++runSeq;
+    pagesDue.value = false;
+    releaseRun++;
+    for (const id of [ID.pages, ID.segments, ID.relSessions, ID.relVitals, ID.relNew]) {
+      search.hold(id, "loading", true);
+    }
+    await Promise.all([loadVerdict(), loadKpis()]);
+    if (run !== runSeq) return;
+    pagesDue.value = true;
+    maybeLoadPages();
+    await Promise.all([
+      loadSegments(),
+      releaseViaKpi() ? Promise.resolve() : loadReleaseSessions(),
+      exec(ID.options, filterOptionsSql(schema.value), range.value, 500),
+    ]);
+  };
+
+  const abortAll = () => {
+    runSeq++;
+    releaseRun++;
+    pagesDue.value = false;
+    search.abortAll();
+  };
+
+  const retry = (group: WidgetGroup) => loaders[group]();
+
+  const vitals = computed(() => mapVitals(windowOf(ID.vitals, 1)));
+  const vitalsPrev = computed(() => mapVitals(windowOf(ID.vitals, 0)));
+
+  const verdictStatus = computed<WidgetStatus>(() => {
+    const s = statusOf([ID.vitals]);
+    if (s !== "ok") return s;
+    const v = vitals.value;
+    if (!v || v.views === 0) return "empty";
+    return isLowData(v.views) ? "low" : "ok";
+  });
+
+  const totals = computed(() => {
+    const cur = windowOf(ID.kpi, 1);
+    const prev = windowOf(ID.kpi, 0);
+    const shape = (r?: Row) =>
+      r
+        ? {
+            sessions: toNum(r.sessions),
+            errorFree: toNum(r.sessions)
+              ? ((toNum(r.sessions) - toNum(r.err_sessions)) / toNum(r.sessions)) * 100
+              : null,
+            errors: toNum(r.errors),
+            unhandled: toNum(r.unhandled),
+          }
+        : null;
+    return { cur: shape(cur), prev: shape(prev) };
+  });
+
+  const series = computed(() => {
+    const pts = rows(ID.series).rows.map((r) => ({
+      ts: bucketMicros(r.bucket),
+      sessions: toNum(r.sessions),
+      errSessions: toNum(r.err_sessions),
+      errors: toNum(r.errors),
+      unhandled: toNum(r.unhandled),
+    }));
+    const interval = intervalFromKey(rows(ID.series).key);
+    const step = interval ? intervalMicros(interval) : 0;
+    const filled = fillBuckets(pts, step, (ts) => ({
+      ts,
+      sessions: 0,
+      errSessions: 0,
+      errors: 0,
+      unhandled: 0,
+    }));
+    return dropOpenBucket(filled, step, Date.now() * 1000);
+  });
+
+  // The chart draws the same zero-filled points as the table and sparklines, under its own axis aliases.
+  const chartHits = computed(() =>
+    series.value.map((p) => ({
+      x_axis_1: bucketLabel(p.ts),
+      y_axis_1: p.sessions,
+      y_axis_2: p.errors,
+    })),
+  );
+
+  const chartStatus = computed<WidgetStatus>(() => {
+    const s = statusOf([ID.series]);
+    if (s !== "ok") return s;
+    return chartHits.value.length ? "ok" : "empty";
+  });
+
+  const kpiStatus = computed<WidgetStatus>(() => {
+    const s = statusOf([ID.kpi, ID.series]);
+    if (s !== "ok") return s;
+    return (totals.value.cur?.sessions ?? 0) === 0 ? "empty" : "ok";
+  });
+
+  const chartInterval = computed(() =>
+    range.value ? bucketInterval(range.value.startUs, range.value.endUs) : null,
+  );
+  const chartQuery = computed(() =>
+    chartInterval.value ? chartSql(ctx(), chartInterval.value) : null,
+  );
+
+  const pages = computed(() => mapPages(rows(ID.pages).rows));
+  const pagesStatus = computed<WidgetStatus>(() => {
+    const s = statusOf([ID.pages]);
+    if (s !== "ok") return s;
+    return pages.value.length ? "ok" : "empty";
+  });
+
+  const segments = computed(() => {
+    const c = ctx();
+    const byDim = splitSegments(c, rows(ID.segments).rows);
+    const out: Partial<Record<SegmentDim, SegmentRow[]>> = {};
+    for (const d of segmentDims(c)) {
+      out[d] = mapSegments(d, segmentColumns(c, d), byDim[d] ?? [], vitals.value?.views);
+    }
+    return out;
+  });
+  const segmentsStatus = computed<WidgetStatus>(() => {
+    const dims = segmentDims(ctx());
+    if (!dims.length) return "hidden";
+    const s = statusOf([ID.segments]);
+    if (s !== "ok") return s;
+    return dims.some((d) => (segments.value[d] ?? []).length) ? "ok" : "empty";
+  });
+  const difference = computed(() => biggestDifference(segments.value));
+
+  const bucketSpan = computed(() => {
+    const pts = series.value;
+    return pts.length > 1 ? pts[1].ts - pts[0].ts : 0;
+  });
+
+  const release = computed(() => {
+    const [cur, prev] = releaseRows();
+    if (!cur || !prev || !range.value) return null;
+    const vit = new Map(rows(ID.relVitals).rows.map((r) => [String(r.ver), r]));
+    const shape = (r: Row) => ({
+      version: String(r.version),
+      firstSeen: toNum(r.first_seen),
+      predates: versionPredatesRange(
+        toNum(r.first_seen),
+        range.value!.startUs,
+        range.value!.endUs,
+        series.value[0]?.ts ?? null,
+        bucketSpan.value,
+      ),
+      sessions: toNum(r.sessions),
+      errorFree: toNum(r.sessions)
+        ? ((toNum(r.sessions) - toNum(r.err_sessions)) / toNum(r.sessions)) * 100
+        : null,
+      lcp: vit.get(String(r.version))?.lcp ?? null,
+      inp: vit.get(String(r.version))?.inp ?? null,
+    });
+    const newRow = rows(ID.relNew).rows[0];
+    return {
+      cur: shape(cur),
+      prev: shape(prev),
+      newErrors: newRow ? toNum(newRow.new_errors) : null,
+    };
+  });
+  const releaseStatus = computed<WidgetStatus>(() => {
+    if (!schema.value?.has("version")) return "hidden";
+    const first = statusOf([releaseSource()]);
+    if (first !== "ok") return first;
+    if (releaseRows().length < 2) return "empty";
+    const second = statusOf([ID.relVitals]);
+    return second === "ok" ? "ok" : second;
+  });
+
+  const releaseMarker = computed(() => {
+    const cur = release.value?.cur;
+    return cur && !cur.predates ? { version: cur.version, ts: cur.firstSeen } : null;
+  });
+
+  const frustration = computed(() => {
+    const shape = (r?: Row) => (r ? { rage: toNum(r.rage), dead: toNum(r.dead) } : null);
+    return { cur: shape(windowOf(ID.kpi, 1)), prev: shape(windowOf(ID.kpi, 0)) };
+  });
+  const frustrationStatus = computed<WidgetStatus>(() => {
+    if (!schema.value?.has("action_frustration_type")) return "hidden";
+    return statusOf([ID.kpi]);
+  });
+
+  const filterOptions = computed(() => {
+    const out: Record<keyof OverviewFilters, string[]> = { service: [], env: [], version: [] };
+    for (const r of rows(ID.options).rows) {
+      for (const k of Object.keys(out) as (keyof OverviewFilters)[]) {
+        const v = r[k];
+        if (v && !out[k].includes(String(v))) out[k].push(String(v));
+      }
+    }
+    return out;
+  });
+
+  const status = computed<Record<WidgetGroup, WidgetStatus>>(() => ({
+    verdict: verdictStatus.value,
+    kpis: kpiStatus.value,
+    chart: chartStatus.value,
+    pages: pagesStatus.value,
+    segments: segmentsStatus.value,
+    release: releaseStatus.value,
+    frustration: frustrationStatus.value,
+  }));
+
+  const busy = computed<Record<WidgetGroup, boolean>>(() => {
+    const any = (ids: string[]) => ids.some(pending);
+    return {
+      verdict: any([ID.vitals]),
+      kpis: any([ID.kpi, ID.series]),
+      chart: any([ID.series]),
+      pages: any([ID.pages]) && !pagesDue.value,
+      segments: any([ID.segments]),
+      release: any([releaseSource(), ID.relVitals]),
+      frustration: any([ID.kpi]),
+    };
+  });
+
+  // One page-level state beats a wall of identical per-panel ones; pages not yet requested do not count.
+  const pageState = computed<"error" | "forbidden" | "empty" | "ok">(() => {
+    const shown = (Object.entries(status.value) as [WidgetGroup, WidgetStatus][])
+      .filter(([g, x]) => x !== "hidden" && !(g === "pages" && pagesDue.value))
+      .map(([, x]) => x);
+    if (shown.length && shown.every((x) => x === "error")) return "error";
+    if (shown.length && shown.every((x) => x === "forbidden")) return "forbidden";
+    const { verdict, kpis } = status.value;
+    return verdict === "empty" && kpis === "empty" ? "empty" : "ok";
+  });
+
+  return {
+    pageState,
+    chartInterval,
+    chartQuery,
+    filters,
+    filterOptions,
+    range,
+    status,
+    vitals,
+    vitalsPrev,
+    totals,
+    series,
+    pages,
+    segments,
+    difference,
+    release,
+    releaseMarker,
+    frustration,
+    chartHits,
+    busy,
+    loadAll,
+    retry,
+    markPagesVisible,
+    abortAll,
+  };
+}
diff --git a/web/src/composables/rum/useRumPerformanceTab.spec.ts b/web/src/composables/rum/useRumPerformanceTab.spec.ts
index 2e259848f8..7d0e0ae6d2 100644
--- a/web/src/composables/rum/useRumPerformanceTab.spec.ts
+++ b/web/src/composables/rum/useRumPerformanceTab.spec.ts
@@ -64,7 +64,7 @@ vi.mock("@/utils/dashboard/convertDashboardSchemaVersion", () => ({
   convertDashboardSchemaVersion: (d: unknown) => d,
 }));
 
-import useRumPerformanceTab, { type RumTabDateTime } from "./useRumPerformanceTab";
+import useRumPerformanceTab, { rangeFromPage, type RumTabDateTime } from "./useRumPerformanceTab";
 
 // ── fixtures ─────────────────────────────────────────────────────────────────
 
@@ -277,13 +277,40 @@ describe("useRumPerformanceTab", () => {
       // Act
       await tab.ensureRumSchema();
 
-      // Assert — inconclusive schema renders the full dashboard rather than an empty tab
+      // Assert — the failure is surfaced so the tab can show an error state, not swallowed
       expect(tab.schemaResolved.value).toBe(true);
+      expect(tab.schemaError.value).toBe(true);
       expect(tab.showEmptyState.value).toBe(false);
       expect(titlesOf(tab)).toHaveLength(3);
     });
   });
 
+  describe("schema forbidden", () => {
+    it("flags a 403 as forbidden rather than a retryable error", async () => {
+      mockGetStream.mockRejectedValue(
+        Object.assign(new Error("no"), { response: { status: 403 } }),
+      );
+      const { tab } = mountTab();
+      await tab.ensureRumSchema();
+      expect(tab.schemaForbidden.value).toBe(true);
+      expect(tab.schemaError.value).toBe(false);
+    });
+  });
+
+  describe("schema error", () => {
+    it("clears the error flag when a retry succeeds", async () => {
+      mockGetStream.mockRejectedValueOnce(new Error("boom"));
+      const { tab } = mountTab();
+      await tab.ensureRumSchema();
+      expect(tab.schemaError.value).toBe(true);
+
+      mockGetStream.mockResolvedValue({ schema: [{ name: "service" }] });
+      await tab.ensureRumSchema();
+
+      expect(tab.schemaError.value).toBe(false);
+    });
+  });
+
   describe("empty state", () => {
     it("reports empty when every panel is gated out", async () => {
       // Arrange — a dashboard of nothing but mobile panels, on a browser-only stream
@@ -329,3 +356,25 @@ describe("useRumPerformanceTab", () => {
     });
   });
 });
+
+describe("rangeFromPage", () => {
+  it("converts the page's microsecond-in-Date wrapper to real millisecond Dates", () => {
+    const startUs = 1_700_000_000_000_000;
+    const endUs = startUs + 3_600_000_000;
+    const r = rangeFromPage({
+      __global: { start_time: new Date(startUs), end_time: new Date(endUs) },
+    });
+    expect((r?.start_time as Date).getTime()).toBe(1_700_000_000_000);
+    expect((r?.end_time as Date).getTime()).toBe(1_700_003_600_000);
+  });
+
+  it("passes a flat range of real Dates through", () => {
+    const flat = { start_time: new Date(1000), end_time: new Date(2000) };
+    expect(rangeFromPage(flat)).toBe(flat);
+  });
+
+  it("is undefined for an empty or unset range", () => {
+    expect(rangeFromPage({})).toBeUndefined();
+    expect(rangeFromPage(undefined)).toBeUndefined();
+  });
+});
diff --git a/web/src/composables/rum/useRumPerformanceTab.ts b/web/src/composables/rum/useRumPerformanceTab.ts
index bb54850695..bffc790fb3 100644
--- a/web/src/composables/rum/useRumPerformanceTab.ts
+++ b/web/src/composables/rum/useRumPerformanceTab.ts
@@ -60,11 +60,30 @@ const toMicros = (value: Date | number | null | undefined): number => {
   return typeof value === "number" && Number.isFinite(value) ? value * 1000 : 0;
 };
 
+// The page wraps picker microseconds in Dates, so its __global getTime() is already microseconds.
+export const rangeFromPage = (dateTime: unknown): RumTabDateTime | undefined => {
+  const dt = dateTime as { __global?: RumTabDateTime } & RumTabDateTime;
+  const wrapped = dt?.__global;
+  if (!wrapped) return dt?.start_time && dt?.end_time ? dt : undefined;
+  const fromUs = (v: Date | number | null | undefined) =>
+    v instanceof Date
+      ? new Date(v.getTime() / 1000)
+      : typeof v === "number"
+        ? new Date(v / 1000)
+        : null;
+  const start_time = fromUs(wrapped.start_time);
+  const end_time = fromUs(wrapped.end_time);
+  return start_time && end_time ? { start_time, end_time } : undefined;
+};
+
 export interface RumPerformanceTab {
   /** The schema-migrated, capability-filtered dashboard to hand to RenderDashboardCharts. */
   dashboardData: ComputedRef<RumDashboard>;
   /** True once the `_rumdata` schema has been read (or a fetch was attempted). */
   schemaResolved: Ref<boolean>;
+  schemaError: Ref<boolean>;
+  schemaForbidden: Ref<boolean>;
+  presentFields: ComputedRef<Set<string> | null>;
   /** True only when the schema is known and every panel was filtered out. */
   showEmptyState: ComputedRef<boolean>;
   /** True when at least one panel was dropped — e.g. to hide browser-oriented section labels. */
@@ -94,6 +113,8 @@ const useRumPerformanceTab = (
   const baseDashboard = convertDashboardSchemaVersion(rawDashboard) as RumDashboard;
 
   const schemaResolved = ref(false);
+  const schemaError = ref(false);
+  const schemaForbidden = ref(false);
 
   const rumSchemaMap = computed(() => performanceState.data.streams?.[RUM_STREAM]?.schema ?? null);
   const presentFields = computed(() => presentFieldsFromSchemaMap(rumSchemaMap.value));
@@ -144,6 +165,8 @@ const useRumPerformanceTab = (
   );
 
   const ensureRumSchema = async (): Promise<void> => {
+    schemaError.value = false;
+    schemaForbidden.value = false;
     try {
       if (presentFields.value) return;
 
@@ -153,9 +176,11 @@ const useRumPerformanceTab = (
         schemaMap[field.name] = field;
       });
       performanceState.data.streams[RUM_STREAM] = { schema: schemaMap, name: RUM_STREAM };
-    } catch {
-      // Inconclusive schema — leave presentFields null so the full dashboard renders
-      // rather than hiding panels from a browser user on a transient error.
+    } catch (e) {
+      const err = e as { response?: { status?: number }; status?: number };
+      // A retry cannot fix a missing permission, so a 403 gets its own state.
+      if ((err?.response?.status ?? err?.status) === 403) schemaForbidden.value = true;
+      else schemaError.value = true;
     } finally {
       schemaResolved.value = true;
     }
@@ -164,6 +189,9 @@ const useRumPerformanceTab = (
   return {
     dashboardData,
     schemaResolved,
+    schemaError,
+    schemaForbidden,
+    presentFields,
     showEmptyState,
     wasFiltered,
     platforms,
diff --git a/web/src/composables/rum/useRumPlatforms.spec.ts b/web/src/composables/rum/useRumPlatforms.spec.ts
new file mode 100644
index 0000000000..1df7fc190b
--- /dev/null
+++ b/web/src/composables/rum/useRumPlatforms.spec.ts
@@ -0,0 +1,105 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockSearch = vi.fn();
+const mockGetStream = vi.fn();
+
+vi.mock("vuex", () => ({
+  useStore: () => ({
+    state: { selectedOrganization: { identifier: "org" }, zoConfig: {} },
+  }),
+}));
+vi.mock("@/services/search", () => ({
+  default: { search: (...a: unknown[]) => mockSearch(...a) },
+}));
+vi.mock("@/composables/useStreams", () => ({ default: () => ({ getStream: mockGetStream }) }));
+vi.mock("@/types/i18n", () => ({ useI18nTyped: () => ({ t: (k: string) => k }) }));
+
+import useRumPlatforms from "./useRumPlatforms";
+
+const schemaOf = (...names: string[]) => ({ schema: names.map((name) => ({ name })) });
+let n = 0;
+const range = () => ({ startTime: ++n * 1000, endTime: n * 1000 + 500 });
+
+describe("useRumPlatforms probe", () => {
+  beforeEach(() => {
+    mockSearch.mockReset();
+    mockGetStream.mockReset();
+    useRumPlatforms().resetRumPlatforms();
+  });
+
+  it("returns exactly the schema answer, even both-false, when there is no source column", async () => {
+    mockGetStream.mockResolvedValue(schemaOf("service", "view_id"));
+
+    const result = await useRumPlatforms().detectPlatforms(range());
+
+    expect(mockSearch).not.toHaveBeenCalled();
+    expect(result.hasBrowser).toBe(false);
+    expect(result.hasMobile).toBe(false);
+    expect(result.viaFallback).toBe(true);
+  });
+
+  it("reads the stream schema once per detection", async () => {
+    mockGetStream.mockResolvedValue(schemaOf("source", "view_largest_contentful_paint"));
+    mockSearch.mockRejectedValue(new Error("400"));
+
+    await useRumPlatforms().detectPlatforms(range());
+
+    expect(mockGetStream).toHaveBeenCalledTimes(1);
+  });
+
+  it("infers mobile from the schema when there is no source column", async () => {
+    mockGetStream.mockResolvedValue(schemaOf("view_slow_frames_rate", "error_is_crash"));
+
+    const result = await useRumPlatforms().detectPlatforms(range());
+
+    expect(mockSearch).not.toHaveBeenCalled();
+    expect(result.hasMobile).toBe(true);
+    expect(result.hasBrowser).toBe(false);
+  });
+
+  it("still probes by source when the column exists, detecting mobile", async () => {
+    mockGetStream.mockResolvedValue(schemaOf("source"));
+    mockSearch.mockResolvedValue({ data: { hits: [{ source: "ios" }, { source: "" }] } });
+
+    const result = await useRumPlatforms().detectPlatforms(range());
+
+    expect(mockSearch).toHaveBeenCalledTimes(1);
+    expect(result.hasMobile).toBe(true);
+    expect(result.hasBrowser).toBe(true);
+  });
+
+  it("falls back to the schema when the probe fails on a stream that has source", async () => {
+    mockGetStream.mockResolvedValue(schemaOf("source", "view_largest_contentful_paint"));
+    mockSearch.mockRejectedValue(new Error("400"));
+
+    const result = await useRumPlatforms().detectPlatforms(range());
+
+    expect(result.viaFallback).toBe(true);
+    expect(result.hasBrowser).toBe(true);
+  });
+
+  it("probes when the schema cannot be read", async () => {
+    mockGetStream.mockRejectedValue(new Error("down"));
+    mockSearch.mockResolvedValue({ data: { hits: [{ source: "android" }] } });
+
+    const result = await useRumPlatforms().detectPlatforms(range());
+
+    expect(mockSearch).toHaveBeenCalledTimes(1);
+    expect(result.hasMobile).toBe(true);
+  });
+});
diff --git a/web/src/composables/rum/useRumPlatforms.ts b/web/src/composables/rum/useRumPlatforms.ts
index 07361fc0f8..57eaa23de5 100644
--- a/web/src/composables/rum/useRumPlatforms.ts
+++ b/web/src/composables/rum/useRumPlatforms.ts
@@ -50,7 +50,7 @@ const BROWSER_SOURCE = "browser";
  * Columns only the browser SDK emits — used by the schema fallback to infer `hasBrowser`.
  * Kept deliberately small: any one present means browser data has been ingested.
  */
-const BROWSER_ONLY_FIELDS = [
+export const BROWSER_ONLY_FIELDS = [
   "view_largest_contentful_paint",
   "view_cumulative_layout_shift",
   "view_interaction_to_next_paint",
@@ -60,7 +60,7 @@ const BROWSER_ONLY_FIELDS = [
 ];
 
 /** Columns only the mobile SDKs emit — used by the schema fallback to infer `hasMobile`. */
-const MOBILE_ONLY_FIELDS = [
+export const MOBILE_ONLY_FIELDS = [
   "view_slow_frames_rate",
   "view_freeze_rate",
   "view_frozen_frame_count",
@@ -180,17 +180,21 @@ const useRumPlatforms = () => {
     );
   };
 
-  // Fallback: infer from which columns exist in the stream schema.
-  const probeBySchema = async (): Promise<RumPlatformResult> => {
-    const stream = await getStream(RUM_STREAM, "logs", true);
-    const names = new Set((stream?.schema ?? []).map((field: any) => field?.name));
+  const schemaNames = async (): Promise<Set<string> | null> => {
+    try {
+      const stream = await getStream(RUM_STREAM, "logs", true);
+      return new Set<string>((stream?.schema ?? []).map((field: any) => field?.name));
+    } catch {
+      return null;
+    }
+  };
+
+  // Schema-only inference never learns which mobile platform, only that mobile data exists.
+  const resultFromSchema = (names: Set<string>): RumPlatformResult => {
     const hasBrowser = BROWSER_ONLY_FIELDS.some((f) => names.has(f));
     const hasMobile = MOBILE_ONLY_FIELDS.some((f) => names.has(f));
-    const platforms: string[] = [];
-    if (hasBrowser) platforms.push(BROWSER_SOURCE);
-    // Schema can't tell which mobile platform, only that mobile data exists.
     return {
-      platforms,
+      platforms: hasBrowser ? [BROWSER_SOURCE] : [],
       hasBrowser,
       hasMobile,
       mobilePlatforms: [],
@@ -208,16 +212,15 @@ const useRumPlatforms = () => {
     state.loading = false;
   };
 
+  // Without a `source` column the probe would 400, so the schema answers instead.
   const runDetection = async (dateTime: RumDateTime): Promise<RumPlatformResult> => {
+    const names = await schemaNames();
+    if (names && !names.has("source")) return resultFromSchema(names);
     try {
       return await probeBySource(dateTime);
     } catch (probeError) {
       state.error = probeError;
-      try {
-        return await probeBySchema();
-      } catch {
-        return DEFAULT_RESULT;
-      }
+      return names ? resultFromSchema(names) : DEFAULT_RESULT;
     }
   };
 
diff --git a/web/src/composables/shared/useManagementRoutes.spec.ts b/web/src/composables/shared/useManagementRoutes.spec.ts
index fb1c4b51c2..a0c8348327 100644
--- a/web/src/composables/shared/useManagementRoutes.spec.ts
+++ b/web/src/composables/shared/useManagementRoutes.spec.ts
@@ -659,9 +659,9 @@ describe("useManagementRoutes", () => {
       expect(orgMgmtRoute.component).toBeDefined();
     });
 
-    it("should have exactly 12 children routes when cloud is enabled", () => {
+    it("should have exactly 13 children routes when cloud is enabled", () => {
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(12); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 1 cloud
+      expect(routes[0].children).toHaveLength(13); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 2 cloud
     });
   });
 
@@ -676,9 +676,9 @@ describe("useManagementRoutes", () => {
       expect(routes[0].children.length).toBeGreaterThan(10);
     });
 
-    it("should have exactly 26 children routes when both enterprise and cloud are enabled", () => {
+    it("should have exactly 27 children routes when both enterprise and cloud are enabled", () => {
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(26); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 14 enterprise (incl. passwordPolicy, announcements + editor, telephonySettings) + 1 cloud
+      expect(routes[0].children).toHaveLength(27); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 14 enterprise (incl. passwordPolicy, announcements + editor, telephonySettings) + 2 cloud
     });
 
     it("should have all enterprise routes when both are enabled", () => {
diff --git a/web/src/composables/shared/useManagementRoutes.ts b/web/src/composables/shared/useManagementRoutes.ts
index d74c20f59d..8662b59b4b 100644
--- a/web/src/composables/shared/useManagementRoutes.ts
+++ b/web/src/composables/shared/useManagementRoutes.ts
@@ -343,6 +343,17 @@ const useManagementRoutes = () => {
             routeGuard(to, from, next);
           },
         },
+        {
+          path: "org_domain_mapping",
+          name: "orgDomainMapping",
+          component: () => import("@/components/settings/OrgDomainManagement.vue"),
+          meta: {
+            titleKey: "routeTitles.orgDomainMapping",
+          },
+          beforeEnter(to: any, from: any, next: any) {
+            routeGuard(to, from, next);
+          },
+        },
       ],
     );
   }
diff --git a/web/src/composables/synthetics/syntheticResultsSchema.ts b/web/src/composables/synthetics/syntheticResultsSchema.ts
index da41882517..c16318c9f1 100644
--- a/web/src/composables/synthetics/syntheticResultsSchema.ts
+++ b/web/src/composables/synthetics/syntheticResultsSchema.ts
@@ -290,7 +290,8 @@ export interface RecordedStep {
 
 export interface StepExecution {
   step_id: string;
-  status: "ok" | "fail" | "skipped";
+  /** `unknown`: a status string this UI does not recognise; never shown as a pass. */
+  status: "ok" | "fail" | "skipped" | "unknown";
   duration_ms: number;
   error: string | null;
   start_time: number;
@@ -1847,7 +1848,13 @@ export function mapRun(rawHit: Record<string, unknown>): SyntheticRun {
 
 function normaliseStepStatus(status: unknown): StepExecution["status"] {
   if (status === "ok" || status === "passed") return "ok";
-  return status === "skipped" ? "skipped" : "fail";
+  if (status === "skipped") return "skipped";
+  // An absent status keeps the historical reading (the step did not finish),
+  // but a value we do not recognise is shown as unknown, not folded into fail.
+  if (typeof status === "string" && status !== "" && status !== "fail" && status !== "failed") {
+    return "unknown";
+  }
+  return "fail";
 }
 
 /** `start_load` arrives nested on an attempt or as a JSON string on the record; both map here. */
diff --git a/web/src/composables/useAlertForm.ts b/web/src/composables/useAlertForm.ts
index a1ad211205..cb031faedb 100644
--- a/web/src/composables/useAlertForm.ts
+++ b/web/src/composables/useAlertForm.ts
@@ -205,6 +205,8 @@ export const defaultAlertValue: any = () => {
     recovery_destinations: [],
     // Seconds the condition must stay clear before recovering. 0 = immediately.
     keep_firing_for: 0,
+    // Off by default: on, a still-firing alert sends nothing until its state changes.
+    suppress_repeats: false,
     // Feature 2 (PT-1/PT-6). `null` (not 0) is unset — 0 is not a valid
     // priority id, and the payload layer drops null so pre-Feature-2 alerts
     // serialize unchanged.
@@ -787,7 +789,6 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
     condition: false,
     rules: false,
     compare: false,
-    dedup: false,
     advanced: false,
   });
   const chartCollapsed = ref(false);
@@ -857,8 +858,7 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
       2: t("alerts.stepCaptions.conditions"),
       3: t("alerts.stepCaptions.compareWithPast"),
       4: t("alerts.stepCaptions.alertSettings"),
-      5: t("alerts.stepCaptions.deduplication"),
-      6: t("alerts.stepCaptions.advanced"),
+      5: t("alerts.stepCaptions.advanced"),
     };
     return captions[wizardStep.value] || "";
   });
@@ -867,7 +867,7 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
     if (formData.value.is_real_time === "anomaly") {
       return wizardStep.value === 3;
     }
-    return wizardStep.value === 6;
+    return wizardStep.value === 5;
   });
 
   const getFormattedDestinations = computed(() => {
@@ -1553,7 +1553,6 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
       condition: false,
       rules: false,
       compare: false,
-      dedup: false,
       advanced: false,
     };
 
@@ -1685,7 +1684,7 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
   // scalars directly by nested `name=`, so their update:* emits no-op in
   // descendant mode; these handlers still route the out-of-form widget values
   // (SQL/PromQL/VRL editors) and the bare wizard steps B (Advanced /
-  // CompareWithPast / Deduplication) into the form via setFieldValue.
+  // CompareWithPast) into the form via setFieldValue.
   const updateSqlQuery = (value: any) => setF("query_condition.sql", value);
   const updatePromqlQuery = (value: any) => setF("query_condition.promql", value);
   const updateVrlFunction = (value: any) => setF("query_condition.vrl_function", value);
@@ -1698,7 +1697,6 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
   const updateDescription = (value: any) => setF("description", value);
   const updateRowTemplate = (value: any) => setF("row_template", value);
   const updateRowTemplateType = (value: any) => setF("row_template_type", value);
-  const updateDeduplication = (value: any) => setF("deduplication", value);
 
   const handleGoToSqlEditor = () => {
     setF("query_condition.type", "sql");
@@ -1962,8 +1960,6 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
     if (formData.value.is_real_time === "true") {
       if (wizardStep.value === 2) {
         wizardStep.value = 4;
-      } else if (wizardStep.value === 4) {
-        wizardStep.value = 6;
       } else {
         wizardStep.value = wizardStep.value + 1;
       }
@@ -1982,9 +1978,7 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
       return;
     }
     if (formData.value.is_real_time === "true") {
-      if (wizardStep.value === 6) {
-        wizardStep.value = 4;
-      } else if (wizardStep.value === 4) {
+      if (wizardStep.value === 4) {
         wizardStep.value = 2;
       } else {
         wizardStep.value = wizardStep.value - 1;
@@ -2625,7 +2619,7 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
         }
       }
 
-      lastValidStep.value = 6;
+      lastValidStep.value = 5;
 
       if (data.is_real_time !== "composite" && !data.trigger_condition?.timezone) {
         if (data.tz_offset === 0) {
@@ -3117,7 +3111,7 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
         setF("stream_type", data.stream_type);
         if (data.folder_id) activeFolderId.value = data.folder_id;
         anomalyEditMode.value = true;
-        lastValidStep.value = 6;
+        lastValidStep.value = 5;
 
         // The stream is only known NOW. initializeFormData already ran its
         // updateStreams, but at that point stream_type was empty, so it
@@ -3340,7 +3334,6 @@ export function useAlertForm(props: AlertFormProps, emit: AlertFormEmit) {
     updateDescription,
     updateRowTemplate,
     updateRowTemplateType,
-    updateDeduplication,
     validateInputs,
     validateSqlQuery,
     validateConditionsAgainstUDS,
diff --git a/web/src/composables/useLogs/logsAutoRun.spec.ts b/web/src/composables/useLogs/logsAutoRun.spec.ts
index a39bf673ad..9bdee3ac2b 100644
--- a/web/src/composables/useLogs/logsAutoRun.spec.ts
+++ b/web/src/composables/useLogs/logsAutoRun.spec.ts
@@ -779,3 +779,65 @@ describe("item 1: scan consent in the signature, the Stop guard and G1 inputs",
     );
   });
 });
+
+describe("recent searches: settled runs", () => {
+  const dispatch = (reason: "run" | "refresh") => {
+    let generation: { id: number } | null = null;
+    run().setExecutors({
+      logs: (ctx: { generation: { id: number } }) => {
+        generation = ctx.generation;
+      },
+    });
+    run().engine.requestRun(reason);
+    return generation as unknown as { id: number };
+  };
+  const hitsOf = (generationId: number, extra: Record<string, unknown> = {}) => ({
+    traceId: "t-hits",
+    type: "search",
+    generationId,
+    queryReq: { query: { start_time: 10, end_time: 20 } },
+    ...extra,
+  });
+
+  it("reports the first page of a run with its reasons and request window", () => {
+    const settled = vi.fn();
+    run().onRunSettled(settled);
+    const hits = hitsOf(dispatch("run").id);
+    run().bindPayload(hits);
+    run().onPayloadComplete(hits);
+    expect(settled).toHaveBeenCalledTimes(1);
+    expect(settled.mock.calls[0][0]).toMatchObject({
+      reasons: ["run"],
+      startUs: 10,
+      endUs: 20,
+      partial: false,
+      error: null,
+    });
+  });
+
+  it("reports a failed search with its error", () => {
+    const settled = vi.fn();
+    run().onRunSettled(settled);
+    const hits = hitsOf(dispatch("run").id);
+    run().bindPayload(hits);
+    run().onPayloadError(hits, { code: 20001, message: "syntax" });
+    expect(settled.mock.calls[0][0].error).toEqual({ code: 20001, message: "syntax" });
+  });
+
+  it("never reports a page fetch, a histogram or a run after unsubscribing", () => {
+    const settled = vi.fn();
+    const stop = run().onRunSettled(settled);
+    const id = dispatch("run").id;
+    const page = hitsOf(id, { isPagination: true });
+    run().bindPayload(page);
+    run().onPayloadComplete(page);
+    run().onPayloadComplete({ traceId: "t-h", type: "histogram", generationId: id });
+    expect(settled).not.toHaveBeenCalled();
+
+    stop();
+    const hits = hitsOf(dispatch("run").id);
+    run().bindPayload(hits);
+    run().onPayloadComplete(hits);
+    expect(settled).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/composables/useLogs/logsAutoRun.ts b/web/src/composables/useLogs/logsAutoRun.ts
index a471b91e89..de70953476 100644
--- a/web/src/composables/useLogs/logsAutoRun.ts
+++ b/web/src/composables/useLogs/logsAutoRun.ts
@@ -50,6 +50,7 @@ import { sqlSources } from "@/utils/logs/sqlSources";
 import { freeTextGateFlags } from "@/utils/logs/freeTextScan";
 import { notePageCancelled } from "@/composables/useLogs/logsRowNav";
 import { noteUserScopeChange } from "@/composables/useLogs/useLogPermalink";
+import type { RunError } from "@/utils/queryHistory/recentSearches";
 
 export interface TransportPayload {
   traceId: string;
@@ -59,6 +60,17 @@ export interface TransportPayload {
   generationId?: number;
 }
 
+/** A Logs grid search that finished or failed, for the recent-searches recorder. */
+export interface LogsRunSettled {
+  reasons: RunReason[];
+  signature: LogsSignature;
+  startUs: number;
+  endUs: number;
+  partial: boolean;
+  /** Null when the search finished. */
+  error: RunError | null;
+}
+
 export interface PanelConfigReader {
   (surface: "visualize" | "build"): unknown;
 }
@@ -136,6 +148,16 @@ function searchModeOf(toggle: string | undefined): SearchMode {
   return MODES[toggle ?? "logs"] ?? "logs";
 }
 
+function requestWindow(queryReq: unknown): WindowUs | null {
+  const query = (queryReq as { query?: { start_time?: unknown; end_time?: unknown } } | null)
+    ?.query;
+  const startUs = Number(query?.start_time);
+  const endUs = Number(query?.end_time);
+  return Number.isFinite(startUs) && Number.isFinite(endUs) && endUs > 0
+    ? { startUs, endUs }
+    : null;
+}
+
 function toList(value: unknown): string[] {
   if (Array.isArray(value)) return value.map(String);
   if (value && typeof value === "object") return Object.values(value).map(String);
@@ -222,6 +244,8 @@ function createLogsAutoRun() {
   const generationEpoch = new Map<number, number>();
   const pendingLaunches = new Map<number, number>();
   const hitsDone = new Set<number>();
+  const runReasons = new Map<number, RunReason[]>();
+  const runSettledListeners = new Set<(run: LogsRunSettled) => void>();
 
   const nowUs = () => Date.now() * 1000;
   const streamList = () => (searchObj().data.streamResults?.list ?? []) as { name: string }[];
@@ -234,7 +258,13 @@ function createLogsAutoRun() {
     getOrgId: () => searchObj().organizationIdentifier || "",
     estimate: (signature) => estimateSignature(signature, streamList(), nowUs()),
     executors: {
-      logs: (ctx) => executors.logs(ctx),
+      logs: (ctx) => {
+        if (ctx.op === "full") {
+          runReasons.clear();
+          runReasons.set(ctx.generation.id, [...ctx.reasons]);
+        }
+        return executors.logs(ctx);
+      },
       patterns: (ctx) => executors.patterns(ctx),
       histogram: (ctx) => executors.histogram(ctx),
       visualize: (ctx) => executors.visualize(ctx),
@@ -361,16 +391,56 @@ function createLogsAutoRun() {
   function onPayloadComplete(payload: TransportPayload): void {
     const generationId = generationOf(payload);
     if (generationId === null || generationId === undefined) return;
-    if (payload.type === "search") engine.recordComplete(generationId, payload.traceId);
+    if (payload.type !== "search") return;
+    emitRunSettled(payload, generationId, null);
+    engine.recordComplete(generationId, payload.traceId);
   }
 
-  function onPayloadError(payload: TransportPayload): void {
+  function onPayloadError(payload: TransportPayload, error: RunError | null = null): void {
     const generationId = generationOf(payload);
     if (generationId === null || generationId === undefined) return;
-    if (payload.type === "search") engine.recordFailure(generationId, payload.traceId);
+    if (payload.type === "search") {
+      emitRunSettled(payload, generationId, error ?? {});
+      engine.recordFailure(generationId, payload.traceId);
+    }
     finishPayload(payload);
   }
 
+  // Only the first page of a full grid search counts; paging and histogram requests never do.
+  function emitRunSettled(
+    payload: TransportPayload,
+    generationId: number,
+    error: RunError | null,
+  ): void {
+    const reasons = runReasons.get(generationId);
+    runReasons.delete(generationId);
+    if (payload.isPagination || !reasons || !runSettledListeners.size) return;
+    const gen = engine.currentGeneration("grid");
+    if (!gen || gen.id !== generationId || gen.surface !== "logs") return;
+    const window = requestWindow(payload.queryReq) ?? signatureWindow(gen.signature, nowUs());
+    if (!window) return;
+    const run: LogsRunSettled = {
+      reasons,
+      signature: gen.signature,
+      startUs: window.startUs,
+      endUs: window.endUs,
+      partial: error === null && searchObj().data.queryResults?.is_partial === true,
+      error,
+    };
+    runSettledListeners.forEach((listener) => {
+      try {
+        listener(run);
+      } catch (err) {
+        console.warn("autoRun: run-settled listener failed", err);
+      }
+    });
+  }
+
+  function onRunSettled(listener: (run: LogsRunSettled) => void): () => void {
+    runSettledListeners.add(listener);
+    return () => runSettledListeners.delete(listener);
+  }
+
   function finishPayload(payload: TransportPayload): void {
     const generationId = generationOf(payload);
     traceGeneration.delete(payload.traceId);
@@ -546,6 +616,7 @@ function createLogsAutoRun() {
     onPayloadData,
     onPayloadComplete,
     onPayloadError,
+    onRunSettled,
     finishPayload,
     trackLaunch,
     finishDispatch,
diff --git a/web/src/composables/useLogs/useSearchStream.history.spec.ts b/web/src/composables/useLogs/useSearchStream.history.spec.ts
new file mode 100644
index 0000000000..d00851b006
--- /dev/null
+++ b/web/src/composables/useLogs/useSearchStream.history.spec.ts
@@ -0,0 +1,172 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { reactive } from "vue";
+import { useSearchStream } from "@/composables/useLogs/useSearchStream";
+import {
+  resetLogsAutoRunForTests,
+  useLogsAutoRun,
+  type LogsRunSettled,
+} from "@/composables/useLogs/logsAutoRun";
+import { logsRunResult } from "@/utils/queryHistory/logs";
+
+interface StreamCallbacks {
+  onError: (payload: object, error: object) => void;
+  onComplete: (payload: object) => void;
+}
+
+const { fake, connection } = vi.hoisted(() => ({
+  fake: { searchObj: null as Record<string, unknown> | null },
+  connection: {
+    getDataThroughStream: vi.fn(),
+    cleanupConnection: vi.fn(),
+    buildWebSocketPayload: vi.fn(),
+    initializeSearchConnection: vi.fn(),
+  },
+}));
+
+vi.mock("vuex", () => ({ useStore: () => ({ state: { zoConfig: {} } }) }));
+vi.mock("vue-router", () => ({
+  useRouter: () => ({ currentRoute: { value: { name: "logs", query: {} } }, push: vi.fn() }),
+}));
+vi.mock("@/composables/useLogs/searchState", () => ({
+  searchState: () => ({
+    searchObj: fake.searchObj,
+    resetQueryData: vi.fn(),
+    notificationMsg: { value: "" },
+    searchPartitionMap: {},
+  }),
+}));
+vi.mock("@/composables/useLogs/logsUtils", () => ({
+  logsUtils: () => ({ addTraceId: vi.fn(), removeTraceId: vi.fn() }),
+}));
+vi.mock("@/services/product_analytics", () => ({ default: { track: vi.fn() } }));
+vi.mock("@/composables/useNotifications", () => ({
+  default: () => ({ showErrorNotification: vi.fn() }),
+}));
+vi.mock("@/composables/useLogs/useSearchQuery", () => ({
+  default: () => ({ getQueryReq: () => ({ query: { start_time: 10, end_time: 20 } }) }),
+}));
+vi.mock("@/composables/useLogs/useSearchConnection", () => ({ default: () => connection }));
+vi.mock("@/composables/useLogs/useSearchResponseHandler", () => ({
+  default: () => ({ handleSearchError: vi.fn(), handleSearchResponse: vi.fn() }),
+}));
+vi.mock("@/composables/useLogs/useSearchHistogramManager", () => ({
+  default: () => ({ processHistogramRequest: vi.fn() }),
+}));
+vi.mock("@/composables/useLogs/useSearchPagination", () => ({ default: () => ({}) }));
+vi.mock("@/aws-exports", () => ({ default: { isEnterprise: "false", isCloud: "false" } }));
+
+const makeSearchObj = () =>
+  reactive({
+    organizationIdentifier: "org1",
+    loading: false,
+    loadingHistogram: false,
+    meta: {
+      sqlMode: true,
+      quickMode: false,
+      liveMode: false,
+      refreshInterval: 0,
+      showTransformEditor: false,
+      useUserDefinedSchemas: "user_defined_schema",
+      logsVisualizeToggle: "logs",
+      regions: [],
+      clusters: [],
+    },
+    data: {
+      query: 'SELECT * FROM "app" WHERE method == "GET"',
+      tempFunctionContent: "",
+      datetime: { type: "relative", relativeTimePeriod: "15m" },
+      stream: {
+        selectedStream: ["app"],
+        streamLists: [{ label: "app", value: "app" }],
+        streamType: "logs",
+        interestingFieldList: [],
+      },
+      resultGrid: { currentPage: 1, hitsSettled: true },
+      searchRequestTraceIds: [],
+      queryResults: { hits: [] },
+      histogram: { xData: [], yData: [] },
+      streamResults: { list: [] },
+    },
+  });
+
+const startRun = async () => {
+  const autoRun = useLogsAutoRun();
+  const stream = useSearchStream((key: string) => key);
+  autoRun.setExecutors({
+    logs: (ctx) => stream.getDataThroughStream(false, ctx.generation.id),
+  });
+  autoRun.engine.requestRun("run");
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  const [queryReq, , callbacks, generationId] = connection.getDataThroughStream.mock.calls.at(-1)!;
+  const payload = { traceId: "t1", type: "search", generationId, queryReq };
+  autoRun.bindPayload(payload);
+  return { callbacks: callbacks as StreamCallbacks, payload };
+};
+
+const settled = (): LogsRunSettled[] => {
+  const runs: LogsRunSettled[] = [];
+  useLogsAutoRun().onRunSettled((run) => runs.push(run));
+  return runs;
+};
+
+describe("Logs run status from the search stream", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    fake.searchObj = makeSearchObj();
+    resetLogsAutoRunForTests();
+  });
+
+  it("records a streamed schema error (HTTP 400 in `code`) as failed", async () => {
+    const runs = settled();
+    const { callbacks, payload } = await startRun();
+    callbacks.onError(payload, {
+      type: "error",
+      content: {
+        code: 400,
+        message: 'Search field not found: Schema error: No field named "GET".',
+        error_detail: "",
+        trace_id: "t1",
+      },
+    });
+    expect(runs).toHaveLength(1);
+    expect(logsRunResult(runs[0])).toEqual({
+      status: "error",
+      error: 'Search field not found: Schema error: No field named "GET".',
+    });
+  });
+
+  it("records a refused request (HTTP status plus search code) as failed", async () => {
+    const runs = settled();
+    const { callbacks, payload } = await startRun();
+    callbacks.onError(payload, {
+      type: "error",
+      content: { status: 400, code: 20001, message: "Search SQL not valid", trace_id: "t1" },
+    });
+    expect(logsRunResult(runs[0])?.status).toBe("error");
+  });
+
+  it("records a streamed timeout as ok with a warning", async () => {
+    const runs = settled();
+    const { callbacks, payload } = await startRun();
+    callbacks.onError(payload, {
+      type: "error",
+      content: { code: 408, message: "Search query timed out", trace_id: "t1" },
+    });
+    expect(logsRunResult(runs[0])).toEqual({ status: "ok", warning: "Search query timed out" });
+  });
+});
diff --git a/web/src/composables/useLogs/useSearchStream.ts b/web/src/composables/useLogs/useSearchStream.ts
index 04396860b1..aa55277907 100644
--- a/web/src/composables/useLogs/useSearchStream.ts
+++ b/web/src/composables/useLogs/useSearchStream.ts
@@ -35,12 +35,18 @@ import type { TranslateFn } from "@/types/i18n";
 import analytics from "@/services/product_analytics";
 import { flushEditorSuggestSummary } from "@/utils/query/editorSuggestStats";
 import { useLogsAutoRun } from "@/composables/useLogs/logsAutoRun";
+import { toRunError, type RunError } from "@/utils/queryHistory/recentSearches";
 import {
   failPendingPageNavigation,
   notePageLoad,
   notifyHitsComplete,
 } from "@/composables/useLogs/logsRowNav";
 
+const runErrorOf = (error: unknown): RunError =>
+  toRunError(
+    (error as { content?: { code?: unknown; message?: unknown; status?: unknown } })?.content ?? {},
+  );
+
 export const useSearchStream = (t: TranslateFn) => {
   const { showErrorNotification } = useNotifications();
 
@@ -66,7 +72,7 @@ export const useSearchStream = (t: TranslateFn) => {
       autoRun.finishPayload(payload);
       return;
     }
-    autoRun.onPayloadError(payload);
+    autoRun.onPayloadError(payload, runErrorOf(error));
     responseProcessor.handleSearchError(payload, error);
   };
 
diff --git a/web/src/composables/useStreams.ts b/web/src/composables/useStreams.ts
index 693b2a1415..9f7e235256 100644
--- a/web/src/composables/useStreams.ts
+++ b/web/src/composables/useStreams.ts
@@ -294,10 +294,13 @@ const useStreams = (t: TranslateFn) => {
                 updateStreamsInStore(streamType, streamList);
               } catch (err: any) {
                 return reject(
-                  new Error(
-                    t("logStream.errorWhileFetchingSchema", {
-                      message: err?.message || t("search.unknownError"),
-                    }),
+                  withResponse(
+                    new Error(
+                      t("logStream.errorWhileFetchingSchema", {
+                        message: err?.message || t("search.unknownError"),
+                      }),
+                    ),
+                    err,
                   ),
                 );
               }
diff --git a/web/src/composables/useTraces.ts b/web/src/composables/useTraces.ts
index c61c809163..46b5f5a613 100644
--- a/web/src/composables/useTraces.ts
+++ b/web/src/composables/useTraces.ts
@@ -170,6 +170,7 @@ const defaultObject = {
     streamResults: <any>[],
     histogram: <any>{},
     editorValue: "",
+    appliedEditorValue: null as string | null,
     datetime: {
       startTime: 0,
       endTime: 0,
diff --git a/web/src/layouts/MainLayout.vue b/web/src/layouts/MainLayout.vue
index 42624d0494..c7f379b875 100644
--- a/web/src/layouts/MainLayout.vue
+++ b/web/src/layouts/MainLayout.vue
@@ -176,9 +176,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 @open="firstDataNotice.open"
                 @dismiss="firstDataNotice.dismiss"
               />
+              <!-- Enter-only fade; the body's slide lives in OPageLayout so the header stays put. -->
               <router-view v-slot="{ Component }">
                 <keep-alive :include="KEPT_ALIVE_VIEWS">
-                  <component :is="Component" class="h-full" @sendToAiChat="sendToAiChat" />
+                  <component
+                    :is="Component"
+                    :class="[ENTER_FADE, 'h-full']"
+                    @sendToAiChat="sendToAiChat"
+                  />
                 </keep-alive>
               </router-view>
             </div>
@@ -256,6 +261,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import { configFullQuery } from "@/services/config.queries";
 import { orgSettingsQuery } from "@/services/organizations.queries";
 import ONavbar from "@/lib/core/Navbar/ONavbar.vue";
+import { ENTER_FADE } from "@/lib/styles/motion";
 import type { NavItem } from "@/lib/core/Navbar/ONavbar.types";
 import { checkFeatureAccess, buildFeatureGateContext } from "@/utils/enterpriseFeatures";
 import AppHeader from "../components/Header.vue";
@@ -1729,6 +1735,7 @@ export default defineComponent({
       zoBackendUrl,
       isLoading,
       KEPT_ALIVE_VIEWS,
+      ENTER_FADE,
       getImageURL,
       updateOrganization,
       setSelectedOrganization,
diff --git a/web/src/lib/core/Badge/badgeGroups.ts b/web/src/lib/core/Badge/badgeGroups.ts
index e57d1dd1d9..51ac4fad4e 100644
--- a/web/src/lib/core/Badge/badgeGroups.ts
+++ b/web/src/lib/core/Badge/badgeGroups.ts
@@ -535,6 +535,9 @@ export const BADGE_GROUPS = {
       offline: { variant: "error-soft", labelKey: "components.badge.serviceStatus.offline" },
       failed: { variant: "error-soft", labelKey: "components.badge.serviceStatus.failed" },
       down: { variant: "error-soft", labelKey: "components.badge.serviceStatus.down" },
+      // Synthetics infrastructure error (backend status 4): the probe could not
+      // run, which is not the same as the target failing.
+      error: { variant: "error-soft", labelKey: "components.badge.serviceStatus.error" },
       unknown: { variant: "default-soft", labelKey: "common.unknown" },
     },
   },
diff --git a/web/src/lib/core/EmptyState/presets.ts b/web/src/lib/core/EmptyState/presets.ts
index eb6cc49803..20cb19c9cc 100644
--- a/web/src/lib/core/EmptyState/presets.ts
+++ b/web/src/lib/core/EmptyState/presets.ts
@@ -1058,6 +1058,60 @@ export const emptyStatePresets = {
       },
     ],
   },
+  "no-linked-domains": {
+    illustration: "connect",
+    variant: "create",
+    titleKey: "emptyState.noLinkedDomains.title",
+    descriptionKey: "emptyState.noLinkedDomains.description",
+    actions: [
+      {
+        id: "dns",
+        icon: "dns",
+        titleKey: "emptyState.noLinkedDomains.dns",
+        descriptionKey: "emptyState.noLinkedDomains.dnsDesc",
+      },
+      {
+        id: "request",
+        icon: "send",
+        titleKey: "emptyState.noLinkedDomains.request",
+        descriptionKey: "emptyState.noLinkedDomains.requestDesc",
+      },
+    ],
+  },
+  "no-domain-mappings": {
+    illustration: "users",
+    variant: "create",
+    titleKey: "emptyState.noDomainMappings.title",
+    descriptionKey: "emptyState.noDomainMappings.description",
+    actions: [
+      {
+        id: "create",
+        icon: "add",
+        titleKey: "emptyState.noDomainMappings.action",
+        descriptionKey: "emptyState.noDomainMappings.actionDesc",
+      },
+    ],
+  },
+  "no-blocked-users": {
+    illustration: "users",
+    variant: "create",
+    titleKey: "emptyState.noBlockedUsers.title",
+    descriptionKey: "emptyState.noBlockedUsers.description",
+    actions: [
+      {
+        id: "create",
+        icon: "block",
+        titleKey: "emptyState.noBlockedUsers.action",
+        descriptionKey: "emptyState.noBlockedUsers.actionDesc",
+      },
+    ],
+  },
+  "no-domain-requests": {
+    illustration: "check",
+    variant: "neutral",
+    titleKey: "emptyState.noDomainRequests.title",
+    descriptionKey: "emptyState.noDomainRequests.description",
+  },
 } satisfies Record<string, EmptyStatePreset>;
 
 export type EmptyStatePresetName = keyof typeof emptyStatePresets;
@@ -1117,4 +1171,8 @@ export const presetNouns: Partial<Record<EmptyStatePresetName, string>> = {
   "no-synthetic-monitors": "emptyState.nouns.monitors",
   "no-model-pricing": "emptyState.nouns.modelPricing",
   "no-saved-funnels": "emptyState.nouns.savedFunnels",
+  "no-linked-domains": "emptyState.nouns.linkedDomains",
+  "no-domain-mappings": "emptyState.nouns.domainMappings",
+  "no-domain-requests": "emptyState.nouns.domainRequests",
+  "no-blocked-users": "emptyState.nouns.blockedUsers",
 };
diff --git a/web/src/lib/core/Icon/OIcon.icons.ts b/web/src/lib/core/Icon/OIcon.icons.ts
index 7ae6f2e624..606f0302bc 100644
--- a/web/src/lib/core/Icon/OIcon.icons.ts
+++ b/web/src/lib/core/Icon/OIcon.icons.ts
@@ -194,6 +194,8 @@ import PhotoCamera from "~icons/material-symbols/photo-camera-outline";
 import AddCircleIcon from "~icons/material-symbols/add-circle-outline";
 import AdsClickIcon from "~icons/material-symbols/ads-click";
 import AnalyticsIcon from "~icons/material-symbols/analytics-outline";
+import DoNotDisturbOnIcon from "~icons/material-symbols/do-not-disturb-on-outline";
+import LibraryAddIcon from "~icons/material-symbols/library-add-outline";
 import ArrowBackIosIcon from "~icons/material-symbols/arrow-back-ios";
 import ArrowForwardIosIcon from "~icons/material-symbols/arrow-forward-ios";
 import ArrowRightIcon from "~icons/material-symbols/arrow-right";
@@ -577,6 +579,8 @@ export const iconRegistry = {
   "add-circle": AddCircleIcon,
   "add-circle-outline": AddCircleIcon,
   "ads-click": AdsClickIcon,
+  "do-not-disturb-on": DoNotDisturbOnIcon,
+  "library-add": LibraryAddIcon,
   analytics: AnalyticsIcon,
   "arrow-back-ios": ArrowBackIosIcon,
   "arrow-forward-ios": ArrowForwardIosIcon,
diff --git a/web/src/lib/core/PageLayout/OPageLayout.spec.ts b/web/src/lib/core/PageLayout/OPageLayout.spec.ts
new file mode 100644
index 0000000000..55bf46da97
--- /dev/null
+++ b/web/src/lib/core/PageLayout/OPageLayout.spec.ts
@@ -0,0 +1,42 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi } from "vitest";
+import { mount } from "@vue/test-utils";
+import { createI18n } from "vue-i18n";
+import OPageLayout from "./OPageLayout.vue";
+
+vi.mock("vue-router", () => ({ useRouter: () => ({ push: vi.fn(), back: vi.fn() }) }));
+
+const i18n = createI18n({ legacy: false, locale: "en", missingWarn: false, fallbackWarn: false });
+
+const mountLayout = () =>
+  mount(OPageLayout, {
+    props: { title: "Page" },
+    slots: { default: '<div data-test="page-body-content" />' },
+    global: { plugins: [i18n] },
+  });
+
+describe("OPageLayout entrance", () => {
+  it("slides the body in while the header stays still", () => {
+    const wrapper = mountLayout();
+    const body = wrapper.find('[data-test="page-body-content"]').element.parentElement!;
+
+    expect(body.className).toContain("motion-safe:slide-in-from-bottom-1");
+    expect(wrapper.find("header, [data-test*='header']").classes()).not.toContain(
+      "motion-safe:slide-in-from-bottom-1",
+    );
+  });
+});
diff --git a/web/src/lib/core/PageLayout/OPageLayout.vue b/web/src/lib/core/PageLayout/OPageLayout.vue
index 0051405774..7c72245d76 100644
--- a/web/src/lib/core/PageLayout/OPageLayout.vue
+++ b/web/src/lib/core/PageLayout/OPageLayout.vue
@@ -113,7 +113,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       <OContent
         :bleed="bleed"
         :y="padY"
-        class="flex min-h-0 w-full flex-1 flex-col overflow-hidden"
+        :class="[BODY_ENTER, 'flex min-h-0 w-full flex-1 flex-col overflow-hidden']"
       >
         <slot />
       </OContent>
@@ -140,7 +140,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       unit="px"
       :limits="splitterLimits"
       :horizontal="false"
-      class="min-h-0 flex-1 overflow-hidden"
+      :class="[BODY_ENTER, 'min-h-0 flex-1 overflow-hidden']"
     >
       <template #before>
         <div
@@ -165,7 +165,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     </OSplitter>
 
     <!-- ── Body: fixed-width sidebar + main ─────────────────────── -->
-    <div v-else-if="!!slots.sidebar" class="flex min-h-0 flex-1">
+    <div v-else-if="!!slots.sidebar" :class="[BODY_ENTER, 'flex min-h-0 flex-1']">
       <aside
         class="border-border-default flex h-full shrink-0 flex-col overflow-hidden border-e"
         :style="{ width: sidebarWidth + 'px' }"
@@ -178,7 +178,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     </div>
 
     <!-- ── Body: constrained reading column (no sidebar) ────────── -->
-    <ConstrainedPage v-else-if="constrained" :size="contentSize" class="min-h-0 flex-1">
+    <ConstrainedPage
+      v-else-if="constrained"
+      :size="contentSize"
+      :class="[BODY_ENTER, 'min-h-0 flex-1']"
+    >
       <slot />
     </ConstrainedPage>
 
@@ -187,9 +191,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       v-else
       :bleed="bleed"
       :y="padY"
-      :class="
-        scroll ? 'min-h-0 flex-1 overflow-auto' : 'flex min-h-0 flex-1 flex-col overflow-hidden'
-      "
+      :class="[
+        BODY_ENTER,
+        scroll ? 'min-h-0 flex-1 overflow-auto' : 'flex min-h-0 flex-1 flex-col overflow-hidden',
+      ]"
     >
       <slot />
     </OContent>
@@ -200,6 +205,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 import { useI18nTyped, type I18nText } from "@/types/i18n";
 import { ref, computed, watch, useSlots, provide } from "vue";
 import { useRouter } from "vue-router";
+// The route view already fades the whole page in, so the body takes only the slide and the header stays still.
+import { ENTER_SLIDE as BODY_ENTER } from "@/lib/styles/motion";
 import OSplitter from "@/lib/core/Splitter/OSplitter.vue";
 import ConstrainedPage from "@/components/common/ConstrainedPage.vue";
 import OPageHeader from "@/lib/core/PageHeader/OPageHeader.vue";
diff --git a/web/src/lib/core/RefreshButton/ORefreshButton.spec.ts b/web/src/lib/core/RefreshButton/ORefreshButton.spec.ts
index e92878f3d4..d41be79d8d 100644
--- a/web/src/lib/core/RefreshButton/ORefreshButton.spec.ts
+++ b/web/src/lib/core/RefreshButton/ORefreshButton.spec.ts
@@ -123,6 +123,19 @@ describe("ORefreshButton", () => {
     expect(wrapper.emitted("click")).toBeUndefined();
   });
 
+  // --- accessible name ---
+
+  it("names the button Refresh, with the age once it has run", () => {
+    const never = mount(ORefreshButton, { global: globalConfig });
+    expect(never.find("button").attributes("aria-label")).toBe("Refresh");
+
+    const ran = mount(ORefreshButton, {
+      props: { layout: "inline", lastRunAt: Date.now() - 57_000 },
+      global: globalConfig,
+    });
+    expect(ran.find("button").attributes("aria-label")).toBe("Refresh, last refreshed 57s ago");
+  });
+
   // --- layout="inline" ---
 
   describe("size", () => {
diff --git a/web/src/lib/core/RefreshButton/ORefreshButton.vue b/web/src/lib/core/RefreshButton/ORefreshButton.vue
index c89c4cd83b..df27d7e35a 100644
--- a/web/src/lib/core/RefreshButton/ORefreshButton.vue
+++ b/web/src/lib/core/RefreshButton/ORefreshButton.vue
@@ -63,6 +63,13 @@ const dotTitle = computed(() => {
   return t("refreshButton.dataStale");
 });
 
+// The age alone is the inline label, so the name leads with the action a screen reader should announce.
+const buttonName = computed(() =>
+  props.lastRunAt
+    ? t("refreshButton.refreshWithAge", { age: relativeTime.value || t("refreshButton.justNow") })
+    : t("refreshButton.refresh"),
+);
+
 const exactTime = computed(() => {
   if (!props.lastRunAt) return t("refreshButton.notYetRefreshed");
   return t("refreshButton.lastRefreshed", {
@@ -98,6 +105,7 @@ function handleClick(e: MouseEvent) {
     :loading="loading"
     :disabled="disabled"
     :data-test="dataTest"
+    :aria-label="buttonName"
     @click="handleClick"
   >
     <!-- The age drops below md so a toolbar keeps search, columns and refresh on one phone row. -->
@@ -137,6 +145,7 @@ function handleClick(e: MouseEvent) {
       :loading="loading"
       :disabled="disabled"
       :data-test="dataTest"
+      :aria-label="buttonName"
       @click="handleClick"
     >
       <OTooltip :content="exactTime" :shortcut-id="shortcutId" />
diff --git a/web/src/lib/core/Table/OTable.spec.ts b/web/src/lib/core/Table/OTable.spec.ts
index 9409d4685c..e70096283c 100644
--- a/web/src/lib/core/Table/OTable.spec.ts
+++ b/web/src/lib/core/Table/OTable.spec.ts
@@ -3602,3 +3602,33 @@ describe("OTable sort header button", () => {
     expect((wrapper.vm as any).table.getState().sorting).toEqual([]);
   });
 });
+
+describe("OTable row entrance", () => {
+  let wrapper: VueWrapper;
+
+  afterEach(() => {
+    wrapper?.unmount();
+  });
+
+  it("fades the body in when rows replace the loading skeleton", async () => {
+    vi.useFakeTimers();
+    wrapper = mount(OTable, { props: { data: [], columns: makeColumns(), loading: true } });
+    await wrapper.setProps({ data: makeRows(3), loading: false });
+    // The skeleton holds for a minimum time before the body replaces it.
+    await vi.runAllTimersAsync();
+    vi.useRealTimers();
+
+    const body = wrapper.find('[data-test="o2-table-body"]');
+    expect(body.exists()).toBe(true);
+    expect(body.classes()).toContain("motion-safe:animate-in");
+  });
+
+  it("keeps the same body element across a re-sort, so the fade does not replay", async () => {
+    wrapper = mount(OTable, { props: { data: makeRows(3), columns: makeColumns() } });
+    const before = wrapper.find('[data-test="o2-table-body"]').element;
+    await wrapper.setProps({ data: makeRows(3).reverse() });
+    await flushPromises();
+
+    expect(wrapper.find('[data-test="o2-table-body"]').element).toBe(before);
+  });
+});
diff --git a/web/src/lib/core/Table/sub-components/OTableBody.vue b/web/src/lib/core/Table/sub-components/OTableBody.vue
index e153d58e8e..46f69f4cb3 100644
--- a/web/src/lib/core/Table/sub-components/OTableBody.vue
+++ b/web/src/lib/core/Table/sub-components/OTableBody.vue
@@ -4,6 +4,8 @@
 import type { Row, Table } from "@tanstack/vue-table";
 import { computed, ref, watch, useSlots } from "vue";
 import OTableBodyRow from "./OTableBodyRow.vue";
+// Rows fade only when the body mounts, i.e. when they replace the skeleton or empty state, never on sort or paging.
+import { ENTER_FADE } from "@/lib/styles/motion";
 import { VueDraggableNext } from "vue-draggable-next";
 
 const props = defineProps<{
@@ -225,6 +227,7 @@ const headingColspan = computed(
     v-model="draggableModel"
     :item-key="rowKey || 'id'"
     tag="tbody"
+    :class="ENTER_FADE"
     handle="[data-test='o2-table-row-drag-handle']"
     :animation="200"
     ghost-class="table-drag-ghost"
@@ -284,7 +287,7 @@ const headingColspan = computed(
 
   <!-- Normal (non-virtual, non-draggable) body. One loop over heading-or-row
        items, so sectioned and unsectioned bodies share the row markup. -->
-  <tbody v-else-if="!isVirtual()" data-test="o2-table-body">
+  <tbody v-else-if="!isVirtual()" :class="ENTER_FADE" data-test="o2-table-body">
     <slot name="body-start" />
     <template v-for="item in plainBodyItems" :key="item.itemKey">
       <!-- Spans every visible column: a heading is about the run below it, not
@@ -351,7 +354,7 @@ const headingColspan = computed(
   <!-- Virtual scroll body: rows stay in flow; top/bottom spacer rows
        reserve the offset above first and below last visible row so cells
        inherit the parent table's column layout (same as non-virtual). -->
-  <tbody v-else data-test="o2-table-body">
+  <tbody v-else :class="ENTER_FADE" data-test="o2-table-body">
     <slot name="body-start" />
     <tr v-if="virtualRows && virtualRows.length && virtualRows[0].start > 0" aria-hidden="true">
       <td
diff --git a/web/src/lib/core/Typography/OTruncatedText.spec.ts b/web/src/lib/core/Typography/OTruncatedText.spec.ts
index f942e45693..293e39ea55 100644
--- a/web/src/lib/core/Typography/OTruncatedText.spec.ts
+++ b/web/src/lib/core/Typography/OTruncatedText.spec.ts
@@ -99,6 +99,24 @@ describe("OTruncatedText", () => {
     expect(tooltipBubble()?.textContent).toContain("Payment service (production)");
   });
 
+  it("should give the tooltip bubble the requested classes, keeping the text's line breaks", async () => {
+    vi.useFakeTimers();
+    const text = "SELECT *\n  FROM k8s\n WHERE a = 1";
+    wrapper = mount(OTruncatedText, {
+      props: { lines: 2, tooltipClass: "whitespace-pre-wrap font-mono" },
+      slots: { default: () => text },
+      attachTo: document.body,
+    });
+    const root = wrapper.find('[data-test="o-truncated-text"]').element;
+    setWidths(root, 310, 200);
+
+    await hoverPastDelay(root);
+
+    expect(tooltipBubble()?.className).toContain("whitespace-pre-wrap");
+    expect(tooltipBubble()?.className).toContain("font-mono");
+    expect(tooltipBubble()?.textContent).toContain(text);
+  });
+
   it("should render no tooltip at all when tooltip is false", () => {
     wrapper = mount(OTruncatedText, { props: { tooltip: false }, slots: { default: "x" } });
     expect(wrapper.findComponent(OTooltip).exists()).toBe(false);
diff --git a/web/src/lib/core/Typography/OTruncatedText.types.ts b/web/src/lib/core/Typography/OTruncatedText.types.ts
index c913267051..634b91b191 100644
--- a/web/src/lib/core/Typography/OTruncatedText.types.ts
+++ b/web/src/lib/core/Typography/OTruncatedText.types.ts
@@ -10,6 +10,8 @@ export interface TruncatedTextProps {
   lines?: TruncatedTextLines;
   /** Tooltip text when cut (defaults to the element's own text); `false` when the full value is visible nearby. */
   tooltip?: I18nText | false;
+  /** Classes for the tooltip bubble, e.g. `whitespace-pre-wrap` to keep the text's line breaks. */
+  tooltipClass?: string;
 }
 
 export interface TruncatedTextSlots {
diff --git a/web/src/lib/core/Typography/OTruncatedText.vue b/web/src/lib/core/Typography/OTruncatedText.vue
index e9cbf9a19a..e89a57d597 100644
--- a/web/src/lib/core/Typography/OTruncatedText.vue
+++ b/web/src/lib/core/Typography/OTruncatedText.vue
@@ -11,6 +11,7 @@ const props = withDefaults(defineProps<TruncatedTextProps>(), {
   as: "span",
   lines: 1,
   tooltip: undefined,
+  tooltipClass: undefined,
 });
 
 defineSlots<TruncatedTextSlots>();
@@ -38,7 +39,12 @@ const tooltipContent = computed(() => (props.tooltip === false ? undefined : pro
     :data-o-tooltip-off="tooltip === false ? '' : undefined"
   >
     <!-- First child on purpose: with no element before it, the tooltip attaches to this root. -->
-    <OTooltip v-if="tooltip !== false" overflow-only :content="tooltipContent" />
+    <OTooltip
+      v-if="tooltip !== false"
+      overflow-only
+      :content="tooltipContent"
+      :class="tooltipClass"
+    />
     <slot />
   </component>
 </template>
diff --git a/web/src/lib/feedback/Toast/useToast.spec.ts b/web/src/lib/feedback/Toast/useToast.spec.ts
index 3050e19444..ba84743dbc 100644
--- a/web/src/lib/feedback/Toast/useToast.spec.ts
+++ b/web/src/lib/feedback/Toast/useToast.spec.ts
@@ -21,6 +21,12 @@ describe("toast()", () => {
     expect(typeof dismiss).toBe("function");
   });
 
+  it("carries the id of its record, whatever the message became", () => {
+    const dismiss = toast({ variant: "success", message: "deleted x" });
+    expect(toastRecords[0].message).toBe("Deleted x");
+    expect(dismiss.id).toBe(toastRecords[0].id);
+  });
+
   it("calling DismissFn() sets open: false on the record", () => {
     const dismiss = toast({ variant: "success", message: "Done" });
     expect(toastRecords[0].open).toBe(true);
diff --git a/web/src/lib/feedback/Toast/useToast.ts b/web/src/lib/feedback/Toast/useToast.ts
index 4e15142145..0603d633e7 100644
--- a/web/src/lib/feedback/Toast/useToast.ts
+++ b/web/src/lib/feedback/Toast/useToast.ts
@@ -80,7 +80,10 @@ if (typeof document !== "undefined") {
 
 // ── Public dismiss-function type ─────────────────────────────────────────────
 
-type DismissFn = (replacement?: Pick<ToastOptions, "variant" | "message" | "title">) => void;
+/** Closes the toast; `id` is its record's id, the same one a collapsed duplicate returns. */
+type DismissFn = ((replacement?: Pick<ToastOptions, "variant" | "message" | "title">) => void) & {
+  readonly id: string;
+};
 
 // ── Core toast() function ────────────────────────────────────────────────────
 
@@ -188,7 +191,7 @@ function updateToast(
 }
 
 function makeDismissFn(id: string, position: ToastPosition): DismissFn {
-  return (replacement) => {
+  const close = (replacement?: Pick<ToastOptions, "variant" | "message" | "title">) => {
     dismiss(id);
     if (replacement) {
       toast({
@@ -199,6 +202,7 @@ function makeDismissFn(id: string, position: ToastPosition): DismissFn {
       });
     }
   };
+  return Object.assign(close, { id });
 }
 
 function dismiss(id: string): void {
diff --git a/web/src/lib/overlay/Popover/OPopover.spec.ts b/web/src/lib/overlay/Popover/OPopover.spec.ts
index f24e51f0ad..41f4cbd037 100644
--- a/web/src/lib/overlay/Popover/OPopover.spec.ts
+++ b/web/src/lib/overlay/Popover/OPopover.spec.ts
@@ -153,4 +153,22 @@ describe("OPopover", () => {
     content.vm.$emit("open-auto-focus", event);
     expect(wrapper.emitted("open-auto-focus")?.[0]).toEqual([event]);
   });
+
+  it("forwards outside pointerdown and focus so a consumer can keep it open for a panel it owns", () => {
+    const wrapper = mount(OPopover, {
+      props: { open: true },
+      slots: {
+        trigger: "<button>Open</button>",
+        default: '<div data-testid="content">Body</div>',
+      },
+    });
+    const content = wrapper.findAllComponents(PopoverContent).at(-1)!;
+    const down = new Event("pointerdown", { cancelable: true });
+    const focus = new Event("focusin", { cancelable: true });
+    content.vm.$emit("pointer-down-outside", down);
+    content.vm.$emit("focus-outside", focus);
+    expect(wrapper.emitted("pointer-down-outside")?.[0]).toEqual([down]);
+    expect(wrapper.emitted("focus-outside")?.[0]).toEqual([focus]);
+    expect(down.defaultPrevented).toBe(false);
+  });
 });
diff --git a/web/src/lib/overlay/Popover/OPopover.vue b/web/src/lib/overlay/Popover/OPopover.vue
index 229ea5fdd7..44de03e182 100644
--- a/web/src/lib/overlay/Popover/OPopover.vue
+++ b/web/src/lib/overlay/Popover/OPopover.vue
@@ -84,6 +84,10 @@ const emit = defineEmits<{
   "update:open": [boolean];
   /** Forwards reka's initial-focus event so a consumer can redirect it (call `preventDefault()` to opt out of the default first-tabbable focus). */
   "open-auto-focus": [Event];
+  /** Forwards reka's outside pointerdown; `preventDefault()` keeps the popover open, e.g. for a panel it owns outside its content. */
+  "pointer-down-outside": [Event];
+  /** Forwards reka's outside focus; `preventDefault()` keeps the popover open. */
+  "focus-outside": [Event];
 }>();
 
 // Vue boolean-casts an absent `open` prop to `false`, which would lock
@@ -175,11 +179,13 @@ function handlePointerDownOutside(event: Event) {
   if (nestedOverlayCount.value > 0 || withinNestedCloseGrace()) {
     event.preventDefault();
   }
+  emit("pointer-down-outside", event);
 }
 function handleFocusOutside(event: Event) {
   if (nestedOverlayCount.value > 0 || withinNestedCloseGrace()) {
     event.preventDefault();
   }
+  emit("focus-outside", event);
 }
 
 // Close on ancestor scroll so the portal never floats detached from its trigger.
diff --git a/web/src/lib/styles/motion.ts b/web/src/lib/styles/motion.ts
new file mode 100644
index 0000000000..6f48252ed8
--- /dev/null
+++ b/web/src/lib/styles/motion.ts
@@ -0,0 +1,21 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Fades start at 40% opacity so an entering element never paints a blank frame.
+export const ENTER_FADE =
+  "motion-safe:animate-in motion-safe:fade-in-40 motion-safe:duration-200 motion-safe:ease-out";
+
+export const ENTER_SLIDE =
+  "motion-safe:animate-in motion-safe:slide-in-from-bottom-1 motion-safe:duration-200 motion-safe:ease-out";
diff --git a/web/src/locales/languages/ar-SA.json b/web/src/locales/languages/ar-SA.json
index e41cde75b2..ef015e77e7 100644
--- a/web/src/locales/languages/ar-SA.json
+++ b/web/src/locales/languages/ar-SA.json
@@ -486,7 +486,11 @@
       "monitors": "المراقِبات",
       "modelPricing": "تعريفات تسعير النماذج",
       "variables": "المتغيرات",
-      "experiments": "التجارب"
+      "experiments": "التجارب",
+      "linkedDomains": "النطاقات المرتبطة",
+      "domainMappings": "تعيينات النطاقات",
+      "domainRequests": "طلبات الربط",
+      "blockedUsers": "المستخدمون المحظورون"
     },
     "demo": {
       "pageTitle": "الولايات الفارغة — المجموعة الكاملة للمراجعة",
@@ -572,6 +576,30 @@
       "action": "مهمة جديدة",
       "actionDesc": "وجه OpenObserve عند نقطة النهاية واختبر الاتصال."
     },
+    "noLinkedDomains": {
+      "title": "لا توجد نطاقات مرتبطة بعد",
+      "description": "اربط نطاق بريد إلكتروني تملكه لتعيين مستخدميه إلى مؤسساتك والتحكم في من يمكنه تسجيل الدخول.",
+      "dns": "إضافة سجل DNS",
+      "dnsDesc": "تحقق من الملكية باستخدام سجل TXT",
+      "request": "طلب ربط",
+      "requestDesc": "اطلب من OpenObserve ربط النطاق نيابةً عنك"
+    },
+    "noDomainMappings": {
+      "title": "لا توجد تعيينات نطاقات بعد",
+      "description": "أضف المستخدمين الذين يسجّلون الدخول بنطاق موثّق إلى هذه المؤسسة أو أعضاء مجموعة التصنيف الخاصة بها تلقائيًا.",
+      "action": "إضافة تعيين",
+      "actionDesc": "اختر نطاقًا ومؤسسة ودورًا"
+    },
+    "noBlockedUsers": {
+      "title": "لا يوجد مستخدمون محظورون",
+      "description": "يمكن لكل مستخدم من نطاقاتك الموثّقة الانضمام. احظر مستخدمين محددين لمنعهم من ذلك.",
+      "action": "حظر المستخدمين",
+      "actionDesc": "اختر نطاقًا وعناوين البريد الإلكتروني المراد حظرها"
+    },
+    "noDomainRequests": {
+      "title": "لا توجد طلبات ربط",
+      "description": "تظهر هنا الطلبات الواردة من المؤسسات لربط نطاق."
+    },
     "noDowntimes": {
       "title": "لا توجد فترات صيانة بعد",
       "description": "تُبقي فترة الصيانة التنبيهات واكتشافات الشذوذ والفحوصات الاصطناعية قيد التشغيل وتوقف إشعاراتها خلال نافذة زمنية تجدولها.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "إيقاف التشغيل التلقائي",
     "autoRefreshWithValue": "تحديث تلقائي: {value}",
     "searchHistory": "سجل البحث",
+    "usageCostHistory": "سجل الاستخدام والتكلفة",
     "createScheduledSearch": "إنشاء البحث المجدول",
     "listScheduledSearch": "البحث المجدول في القائمة",
     "scheduleSearchJob": "جدولة مهمة بحث",
@@ -1355,6 +1384,8 @@
     "scanSize": "حجم المسح",
     "deltaScanSize": "حجم دلتا سكان",
     "scannedSoFar": "تم فحص {size}",
+    "quickModeHiddenFields": "الوضع السريع مفعّل. يعرض هذا الصف {shown} من {total} حقلًا.",
+    "turnOffQuickMode": "إيقاف الوضع السريع",
     "resultsProgressLabel": "تقدم البحث",
     "histogramTitleError": "خطأ أثناء إنشاء عنوان المدرج التكراري.",
     "selectLogStream": "اختر تدفق السجلات",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "لا توجد بيانات شبكة لهذا العرض",
     "apiEmptyDescription": "التدفق المختار لا يحتوي على طلبات موارد أو شبكة خلال هذا النطاق الزمني. تظهر مقاييس الشبكة بمجرد أن يقوم التطبيق بأدوات استدعاءات HTTP الخاصة به.",
     "skipInactivity": "تخطي الجمود",
+    "fullScreen": "ملء الشاشة",
+    "exitFullScreen": "الخروج من ملء الشاشة",
     "error": "خطأ",
     "errorCount": "عدد الأخطاء",
     "all": "الجميع",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "أضف خطوة ثانية لإضافة هذا القمع إلى لوحة معلومات",
         "snapshot": "تحتفظ اللوحة بهذه الخطوات وعوامل التصفية وقواعد الأحداث المسماة كما هي الآن."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "نظرة عامة على الأداء",
+      "filterService": "الخدمة",
+      "filterEnv": "البيئة",
+      "filterVersion": "الإصدار",
+      "filterAll": "الكل",
+      "verdictPass": "اجتياز Core Web Vitals",
+      "verdictFail": "Core Web Vitals تحتاج إلى انتباه",
+      "verdictAllPass": "الكل ناجح",
+      "verdictNeedWork": "{count} من {total} بحاجة إلى تحسين | {count} من {total} بحاجة إلى تحسين",
+      "percentileLabel": "المئين",
+      "bandGood": "جيد",
+      "bandNeeds": "بحاجة إلى تحسين",
+      "bandPoor": "ضعيف",
+      "bandGoodPct": "{n}% جيد",
+      "bandNeedsPct": "{n}% بحاجة إلى تحسين",
+      "bandPoorPct": "{n}% ضعيف",
+      "bandAria": "{good}% جيد، {needs}% بحاجة إلى تحسين، {poor}% ضعيف",
+      "vitalLcp": "أكبر رسم للمحتوى",
+      "vitalInp": "التفاعل حتى الرسم التالي",
+      "vitalCls": "التحول التراكمي للتخطيط",
+      "deltaFaster": "{v} أسرع",
+      "deltaSlower": "{v} أبطأ",
+      "deltaNone": "لا تغيير",
+      "deltaNoPrev": "لا توجد بيانات سابقة كافية",
+      "kpiSessions": "الجلسات",
+      "kpiErrorFree": "جلسات بلا أخطاء",
+      "kpiErrors": "إجمالي الأخطاء",
+      "kpiUnhandled": "أخطاء غير معالجة",
+      "kpiRegion": "المؤشرات الرئيسية",
+      "sparkAria": "اتجاه {label} خلال النطاق المحدد",
+      "chartTitle": "الجلسات والأخطاء",
+      "chartInterval": "لكل فترة",
+      "legendSessions": "الجلسات",
+      "legendErrors": "الأخطاء",
+      "releaseMarker": "{version} شوهد لأول مرة في {time}",
+      "chartTableToggle": "إظهار جدول البيانات",
+      "chartTableHide": "إخفاء جدول البيانات",
+      "chartTime": "الوقت",
+      "pagesTitle": "الصفحات التي يجب إصلاحها أولاً",
+      "pagesHint": "مرتبة حسب التأثير: حركة المرور مرجحة بنسبة المشاهدات التي تجاوز فيها أحد المؤشرات حدّه أو التي حدث فيها خطأ. انقر على صفحة لعرض جلساتها، أو على عدد الأخطاء لفتح تتبع الأخطاء.",
+      "pagesColPage": "الصفحة",
+      "pagesColViews": "المشاهدات",
+      "pagesColErrors": "الأخطاء",
+      "pagesColImpact": "التأثير",
+      "pagesLegend": "▲ بحاجة إلى تحسين · ■ ضعيف · غير المعلَّم جيد. الصفحات التي تقل مشاهداتها عن {n} مخفية.",
+      "pagesOpenSessions": "فتح جلسات {path}",
+      "pagesOpenErrors": "{count} خطأ، فتح تتبع الأخطاء | {count} خطأ، فتح تتبع الأخطاء",
+      "pagesImpactAria": "التأثير {n} من 100",
+      "markNeeds": "بحاجة إلى تحسين",
+      "markPoor": "ضعيف",
+      "diffTitle": "أكبر فرق",
+      "diffBody": "قيمة INP p75 هي {inp}، أي {ratio}× مقارنةً بالشرائح الأخرى. ارتباط يستدعي التحقيق، وليس سببًا مثبتًا.",
+      "diffNone": "لا تبرز أي شريحة عن غيرها في هذا النطاق.",
+      "diffLink": "عرض الجلسات المتأثرة",
+      "segmentLabel": "الشريحة",
+      "segBrowser": "المتصفح",
+      "segDevice": "الجهاز",
+      "segCountry": "الدولة",
+      "segInp": "INP {v}",
+      "segShare": "{n}% من المشاهدات",
+      "segNone": "لا توجد بيانات لهذه الشريحة.",
+      "releaseTitle": "مقارنة الإصدارات",
+      "releaseHint": "{cur} مقابل {prev}. بداية الإصدار هي أول مرة يظهر فيها الإصدار.",
+      "releaseMetric": "المقياس",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "بدون أخطاء",
+      "releaseSessions": "الجلسات",
+      "releaseLink": "الأخطاء في {version}",
+      "frustrationTitle": "إحباط المستخدم",
+      "frustrationHint": "مشكلات لا تلتقطها المؤشرات الأساسية",
+      "rageClicks": "النقرات الغاضبة",
+      "deadClicks": "النقرات الميتة",
+      "stateLoading": "جارٍ تحميل {panel}…",
+      "stateEmptyTitle": "لا توجد مشاهدات صفحات في هذا النطاق",
+      "stateEmptyBody": "وسّع النطاق الزمني، أو أزل أحد الفلاتر، أو تحقق من أن SDK المتصفح يرسل أحداث المشاهدة.",
+      "stateEmptyAction": "إعداد SDK",
+      "stateLowTitle": "فقط {count} مشاهدة صفحة | فقط {count} مشاهدات صفحة",
+      "stateLowBody": "المئينات غير موثوقة عند أقل من {min} مشاهدة، لذا أُخفيت النتيجة. القيم معروضة للرجوع إليها.",
+      "stateErrorTitle": "تعذر تحميل {panel}",
+      "stateErrorBody": "فشل الاستعلام أو انتهت مهلة الانتظار. اللوحات الأخرى غير متأثرة.",
+      "retry": "إعادة المحاولة",
+      "panelVitals": "مؤشرات الويب الأساسية",
+      "panelKpis": "المؤشرات الرئيسية",
+      "panelPages": "الصفحات",
+      "panelSegments": "الشرائح",
+      "panelRelease": "مقارنة الإصدارات",
+      "panelFrustration": "إحباط المستخدم",
+      "schemaErrorTitle": "تعذر تحميل مخطط RUM",
+      "schemaErrorBody": "تعذرت قراءة حقول التدفق، لذا لا يمكن للنظرة العامة تحديد اللوحات التي يجب عرضها.",
+      "pagesShowAll": "عرض جميع الصفحات ({n})",
+      "pagesShowFewer": "عرض صفحات أقل",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "مؤشرات الويب الأساسية",
+      "pagesEmptyTitle": "لا توجد صفحات بمشاهدات كافية",
+      "pagesEmptyBody": "تحتاج الصفحات إلى {n} مشاهدة على الأقل في هذا النطاق لتُرتّب.",
+      "segEmptyTitle": "لا توجد بيانات شرائح",
+      "segEmptyBody": "لم تُسجّل أي قيم للمتصفح أو الجهاز أو نظام التشغيل أو الدولة أو الاتصال لهذه المشاهدات.",
+      "releaseEmptyTitle": "يلزم إصداران",
+      "releaseEmptyBody": "تتطلب مقارنة الإصدارات إصدارين ظهرا في هذا النطاق على الأقل.",
+      "releaseBefore": "{version} كان مباشرًا بالفعل قبل هذا النطاق، لذا لا يُعرض وقت أول ظهور له.",
+      "pageErrorTitle": "تعذر تحميل النظرة العامة على الأداء",
+      "pageErrorBody": "فشلت الاستعلامات أو انتهت مهلتها. أعد المحاولة لتحميل كل اللوحات مجددًا.",
+      "verdictOver": "{vital} يتجاوز الحد الجيد البالغ {threshold} لدى {pct}% من مشاهدات الصفحة.",
+      "verdictAllThree": "تنجح مؤشرات الويب الأساسية الثلاثة جميعها عند p75.",
+      "verdictAllSome": "تنجح جميع مؤشرات الويب الأساسية المقيَّمة وعددها {n} عند p75.",
+      "releaseNewErrors": "{count} خطأ جديد في هذا الإصدار | {count} أخطاء جديدة في هذا الإصدار",
+      "verdictNoData": "لا توجد بيانات لمؤشرات الويب الأساسية",
+      "verdictNoDataLead": "لم تُبلِغ أي من {count} مشاهدة صفحة في هذا النطاق عن LCP أو INP أو CLS. | لم تُبلِغ أي من {count} مشاهدات الصفحة في هذا النطاق عن LCP أو INP أو CLS.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}، {band}، {delta}. فتح الجلسات.",
+      "pagesTableLabel": "الصفحات مرتبة حسب التأثير",
+      "verdictSessions": "{count} جلسة ضمن النطاق. | {count} جلسات ضمن النطاق.",
+      "verdictCompare": "مقارنةً بالفترة السابقة.",
+      "deltaLower": "{v} أقل",
+      "deltaHigher": "{v} أعلى",
+      "forbiddenTitle": "لا تملك صلاحية عرض {panel}",
+      "forbiddenBody": "اطلب من أحد المسؤولين الوصول إلى تدفق بيانات RUM.",
+      "pageForbiddenTitle": "لا تملك صلاحية عرض النظرة العامة على الأداء",
+      "asideLabel": "أين وماذا تغيّر",
+      "pagesAbout": "حول هذا الترتيب",
+      "chartPerFiveMinutes": "كل 5 دقائق",
+      "chartPerThirtyMinutes": "كل 30 دقيقة",
+      "chartPerHour": "كل ساعة",
+      "chartPerSixHours": "كل 6 ساعات",
+      "chartPerDay": "كل يوم",
+      "chartIntervalOther": "لكل فترة تجميع",
+      "chartTableCaption": "الجلسات والأخطاء لكل فترة تجميع",
+      "deltaChange": "{delta} مقابل الفترة السابقة",
+      "deltaChangePts": "{delta} نقطة مقابل الفترة السابقة",
+      "deltaFlat": "لا تغيير مقابل الفترة السابقة",
+      "deltaNewMsg": "جديد مقابل الفترة السابقة",
+      "verdictP75Note": "يستخدم الحكم دائمًا p75؛ بينما p50 وp95 يغيّران القيم فقط.",
+      "releaseNote": "يقارن أحدث إصدارين، بغض النظر عما يقوله فلتر الإصدار.",
+      "kpiEmptyTitle": "لا توجد جلسات في هذا النطاق",
+      "kpiEmptyBody": "وسّع النطاق الزمني أو امسح فلترًا.",
+      "releaseImproved": "تحسّن",
+      "releaseWorse": "تراجع",
+      "segOs": "نظام التشغيل",
+      "segConnection": "الاتصال",
+      "pagesAllLink": "كل الصفحات",
+      "pagesAllLinkAria": "كل الصفحات في تحليلات المنتج",
+      "frustrationReplayLink": "شاهد إعادة تشغيل",
+      "frustrationReplayHint": "يفتح الجلسات المحبطة في هذا النطاق؛ وتتوفّر إعادة تشغيل للجلسات التي جرى تسجيلها.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "لم يُسجَّل أي شيء في هذا النطاق. وسّع النطاق الزمني، أو أعدّ SDK المتصفح إذا لم يرسل هذا التطبيق بيانات بعد.",
+      "stateEmptyFiltered": "لا شيء يطابق هذه الفلاتر في هذا النطاق. امسح الفلاتر لرؤية كل خدمة وبيئة وإصدار.",
+      "clearFilters": "مسح الفلاتر",
+      "stateRefreshing": "جارٍ تحديث {panel}",
+      "tileOpenSessions": "{label}: {value}. فتح الجلسات",
+      "tileOpenErrors": "{label}: {value}. فتح تتبع الأخطاء",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "تحتسب هذه النظرة العامة جلسات المتصفح فقط. مقاييس تطبيق الجوال أدناه.",
+      "mixedMobileNote": "تُطبّق الفلاتر أدناه على مقاييس تطبيق الجوال فقط."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "حذف",
     "confirmDeleteHead": "حذف المستخدم",
     "confirmDeleteMsg": "هل أنت متأكد من أنك تريد حذف المستخدم {name}؟",
+    "block": "حظر",
+    "confirmBlockHead": "حظر المستخدم",
+    "confirmBlockMsg": "{email} انضم عبر نطاقك الموثّق. يؤدي الحظر إلى إضافته إلى قيود النطاق الخاصة بهذه المؤسسة وإزالته منها. تتم إزالته من المؤسسات المعيّنة الأخرى عند تسجيل دخوله التالي.",
     "cancel": "إلغاء",
     "save": "حفظ",
     "ok": "حسنا",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "إلغاء الدعوة",
     "revokeInvitationMsg": "هل أنت متأكد أنك تريد إلغاء الدعوة لـ {email}؟",
     "deleteUsersTitle": "حذف المستخدمين",
-    "deleteUsersMsg": "هل أنت متأكد أنك تريد حذف {count} مستخدم؟ | هل أنت متأكد أنك تريد حذف {count} من المستخدمين؟"
+    "deleteUsersMsg": "هل أنت متأكد أنك تريد حذف {count} مستخدم؟ | هل أنت متأكد أنك تريد حذف {count} من المستخدمين؟",
+    "deleteUsersBlockNote": "{count} منهم انضموا عبر نطاقك الموثّق وسيتم حظرهم بدلًا من حذفهم."
   },
   "invitation": {
     "pendingInvitations": "الدعوات المعلقة",
@@ -3403,8 +3597,6 @@
       },
       "show": "عرض",
       "searchPermissions": "البحث في الأذونات",
-      "filterModules": "تصفية الوحدات",
-      "noModuleMatch": "لا توجد وحدة تطابق التصفية",
       "moduleScopeAll": "الكل",
       "moduleScopeGranted": "المحدد",
       "noGrantedModule": "لم يتم تحديد أي وحدة بعد",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "منحة | منح",
       "summaryReachSome": "{count} من {total}",
       "summaryEmptyTitle": "لا يمنح هذا الدور أي شيء بعد",
-      "summaryEmptyDescription": "اختر وحدة من اليسار، أو ابدأ من إعداد مسبق.",
+      "summaryEmptyDescription": "ابدأ من إعداد مسبق، أو اختر وحدات من القائمة.",
       "presetReadonlyTitle": "للقراءة فقط",
       "presetReadonlyDescription": "سرد وجلب على كل وحدة",
       "presetDbmTitle": "عارض مراقبة قواعد البيانات",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "لا يوجد أي من تدفقات مقاييس Kubernetes البالغ عددها {total} في هذه المؤسسة بعد، لذا لم يتم تحديد أي شيء مسبقًا.",
       "rumPresetSeeded": "تم تحديد وصول القراءة مسبقًا على {matched} من أصل {total} من تدفقات RUM، بالإضافة إلى خرائط المصدر وأي منحة لتحليلات منتج RUM. راجع قبل الحفظ.",
       "rumPresetNoMatch": "لا يوجد أي من تدفقات RUM البالغ عددها {total} في هذه المؤسسة بعد، لذلك لم يتم تحديد أي شيء مسبقًا عليها؛ لا تزال خرائط المصدر وأي منح لتحليلات منتج RUM مجهزة.",
-      "moduleGroupFleet": "الأسطول"
+      "moduleGroupFleet": "الأسطول",
+      "filterModulesTasks": "تصفية الوحدات",
+      "noModuleMatchQuery": "لا توجد وحدة تطابق «{query}»",
+      "noModuleMatchHint": "ابحث حسب الوحدة أو المجموعة أو المهمة، مثل slack أو panel أو token.",
+      "presetAlertManagerTitle": "مدير التنبيهات",
+      "presetAlertManagerDescription": "إنشاء التنبيهات وإدارتها، ووجهات إرسالها، ورسائلها",
+      "presetAlertViewerTitle": "عارض التنبيهات",
+      "presetAlertViewerDescription": "عرض التنبيهات والوجهات والقوالب دون تغييرها",
+      "presetDashboardEditorTitle": "محرر لوحات المعلومات",
+      "presetDashboardEditorDescription": "إنشاء لوحات المعلومات وتعديلها، مع وصول للقراءة إلى البيانات التي تستعلم عنها",
+      "presetDashboardViewerTitle": "عارض لوحات المعلومات",
+      "presetDashboardViewerDescription": "فتح لوحات المعلومات وقراءة البيانات التي تستند إليها لوحاتها",
+      "presetPipelineEditorTitle": "محرر مسارات المعالجة",
+      "presetPipelineEditorDescription": "إنشاء مسارات المعالجة والدوال، مع وصول للقراءة إلى التدفقات وجداول الإثراء",
+      "presetApplied": "{title}: تمت إضافة {permissions}. راجع التغييرات قبل الحفظ.",
+      "presetPermissionCount": "{count} إذن | الأذونات: {count}",
+      "companionReasonAlertStreams": "لحفظ التنبيهات. يتحقق الخادم من الوصول إلى التدفقات عند الحفظ",
+      "companionReasonAlertDestinations": "لاختيار وجهة إرسال التنبيهات",
+      "companionReasonDestinationTemplates": "لاختيار قالب الرسالة الذي تتطلبه كل وجهة",
+      "companionReasonDashboardStreams": "لتحميل بيانات اللوحات",
+      "presetsTitle": "الإعدادات المسبقة",
+      "presetsClose": "إغلاق الإعدادات المسبقة",
+      "presetsShow": "إظهار الإعدادات المسبقة",
+      "presetsSubtitle": "أضف منح إعداد مسبق إلى هذا الدور. لا تتم إزالة أي شيء.",
+      "presetsSectionBuiltin": "مضمّنة",
+      "presetsSectionJob": "حسب الوظيفة",
+      "presetAddsTooltip": "يضيف {count} إذن | يضيف الأذونات: {count}",
+      "presetInRole": "في الدور",
+      "presetInRoleTooltip": "يحتوي هذا الدور بالفعل على كل ما في هذا الإعداد المسبق",
+      "presetBack": "كل الإعدادات المسبقة",
+      "presetModuleCount": "{count} وحدة | الوحدات: {count}",
+      "presetSummaryAdds": "يضيف {permissions} ({modules}).",
+      "presetSummaryWrite": "صلاحية الكتابة في: {modules}.",
+      "presetSummaryViewOnly": "عرض فقط: لا يمكن إنشاء أي شيء أو تعديله أو حذفه.",
+      "presetSummaryHasAll": "يحتوي هذا الدور بالفعل على كل ما في هذا الإعداد المسبق.",
+      "presetSummarySkipped": "تم تخطي {count} إذن موجود بالفعل في هذا الدور. | تم تخطي الأذونات الموجودة بالفعل في هذا الدور: {count}.",
+      "presetStillMissing": "لا يزال ناقصًا بعد الإضافة: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "لن ينقص أي شيء بعد إضافته.",
+      "neededBy": "مطلوب من {modules}",
+      "stillNeededBy": "لا يزال مطلوبًا من {modules}",
+      "presetReadsEveryStream": "يقرأ كل التدفقات في هذه المؤسسة، بما في ذلك التدفقات الجديدة.",
+      "presetAddButton": "إضافة {count} إذن | إضافة الأذونات ({count})",
+      "presetNothingToAdd": "لا شيء لإضافته",
+      "presetApplyNote": "تصبح المنح المضافة تغييرات غير محفوظة. راجعها قبل الحفظ.",
+      "presetLoadingStreams": "جارٍ تحميل التدفقات",
+      "presetNoMatchingStreams": "لا توجد تدفقات مطابقة في هذه المؤسسة بعد.",
+      "reviewMissingTooltip": "تنقص {count} وحدة لكي يعمل هذا الدور | الوحدات الناقصة لكي يعمل هذا الدور: {count}",
+      "notAddedYetTitle": "لم تُضف بعد · {modules}",
+      "companionAdd": "إضافة",
+      "companionAddItem": "إضافة {item}",
+      "companionAddAll": "إضافة الكل",
+      "companionOpenStreams": "فتح التدفقات",
+      "companionOpenStreamsTooltip": "اختر التدفقات التي يمكن لهذا الدور قراءتها",
+      "companionNeeds": "تحتاج وحدة {module} إليه {reason}.",
+      "companionNeedsThis": "تحتاج وحدة {module} إلى هذا الإذن {reason}.",
+      "companionStillNeedsThis": "لا تزال وحدة {module} تحتاج إلى هذا الإذن {reason}.",
+      "yourChanges": "تغييراتك",
+      "yourChangesCount": "{changes} ({modules})",
+      "yourChangesNone": "لا شيء بعد",
+      "changeCount": "{count} تغيير | التغييرات: {count}",
+      "changeOtherGroup": "أخرى",
+      "saveSuccessCounts": "تم حفظ {changes} ({modules}).",
+      "effectCan": "يمكن {actions} {target}.",
+      "effectCannot": "لم يعد بالإمكان {actions} {target}.",
+      "effectCanLoadDestinations": "يمكن تحميل قائمة الوجهات.",
+      "effectCannotLoadDestinations": "لم يعد بالإمكان تحميل قائمة الوجهات.",
+      "effectCanLoadTemplates": "يمكن تحميل قائمة القوالب.",
+      "effectCannotLoadTemplates": "لم يعد بالإمكان تحميل قائمة القوالب.",
+      "verbView": "عرض",
+      "verbSeeListOf": "رؤية قائمة",
+      "verbList": "سرد",
+      "verbOpen": "فتح",
+      "verbCreate": "إنشاء",
+      "verbEdit": "تعديل",
+      "verbDelete": "حذف",
+      "targetEveryStream": "كل التدفقات (السجلات والمقاييس والتتبعات والفهارس)، بما في ذلك الجديدة",
+      "targetTypeStreams": "كل تدفقات {type}",
+      "targetOneStream": "تدفق {type} المسمى {name}",
+      "targetAlertsEveryFolder": "التنبيهات في كل المجلدات، بما في ذلك المجلدات الجديدة",
+      "targetAlertsInFolder": "التنبيهات في المجلد {name}",
+      "targetOneAlert": "التنبيه {name}",
+      "targetDashboardsEveryFolder": "لوحات المعلومات في كل المجلدات، بما في ذلك المجلدات الجديدة",
+      "targetDashboardsInFolder": "لوحات المعلومات في المجلد {name}",
+      "targetOneDashboard": "لوحة المعلومات {name}",
+      "targetReportsEveryFolder": "التقارير في كل المجلدات، بما في ذلك المجلدات الجديدة",
+      "targetReportsInFolder": "التقارير في المجلد {name}",
+      "targetOneReport": "التقرير {name}",
+      "targetEveryDestination": "كل وجهات التنبيه (Slack والبريد الإلكتروني وwebhooks)، بما في ذلك الجديدة",
+      "targetOneDestination": "الوجهة {name}",
+      "targetEveryTemplate": "كل قوالب الإشعارات، بما في ذلك الجديدة",
+      "targetOneTemplate": "القالب {name}",
+      "targetAllOf": "كل {module}، بما في ذلك الجديدة",
+      "targetItemIn": "{name} في {module}",
+      "noteDestinationsFiltered": "لا يرون إلا الوجهات التي يمكنهم فتحها أيضًا. أضف «الحصول على» هنا، أو على وجهات فردية، لاختيار أيٍّ منها.",
+      "noteTemplatesFiltered": "لا يرون إلا القوالب التي يمكنهم فتحها أيضًا. أضف «الحصول على» هنا، أو على قوالب فردية، لاختيار أيٍّ منها.",
+      "presetStreamsFailed": "تعذر تحميل قائمة التدفقات.",
+      "presetRetry": "إعادة المحاولة",
+      "presetRestored": "{title}: تمت استعادة {permissions}. راجع التغييرات قبل الحفظ.",
+      "presetSummaryRestores": "يحتفظ بـ {count} إذن حدّدته للإزالة. | يحتفظ بالأذونات التي حدّدتها للإزالة: {count}.",
+      "presetRestoreButton": "الاحتفاظ بـ {count} إذن | الاحتفاظ بالأذونات ({count})",
+      "effectStillAllowed": "لا تغيير في الوصول: لا يزال منح أوسع يسمح بذلك."
     },
     "rolesPage": {
       "subtitle": "تقوم الأدوار بتجميع الأذونات — تعيينها للمستخدمين أو حسابات الخدمة أو المجموعات لمنح الوصول.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "تم تحديث المستخدم بنجاح.",
       "userDeletedSuccess": "تم حذف المستخدم بنجاح.",
       "errorDeletingUser": "خطأ أثناء حذف المستخدم.",
+      "userBlockedSuccess": "تم حظر المستخدم بنجاح.",
+      "errorBlockingUser": "حدث خطأ أثناء حظر المستخدم.",
+      "blockedButNotRemoved": "تم حظر المستخدم، ولكن تعذّرت إزالته من هذه المؤسسة.",
+      "blockedUsersSuccess": "تم حظر {count} مستخدم بنجاح | تم حظر {count} مستخدمين بنجاح",
+      "blockedUsersPartial": "تم حظر {count} مستخدم وإزالته، ولكن تعذّرت إزالة {failed} من هذه المؤسسة | تم حظر {count} مستخدمين وإزالتهم، ولكن تعذّرت إزالة {failed} من هذه المؤسسة",
+      "blockedUsersNotRemoved": "تم حظر {count} مستخدم، ولكن تعذّرت إزالته من هذه المؤسسة | تم حظر {count} مستخدمين، ولكن تعذّرت إزالتهم من هذه المؤسسة",
       "pleaseWait": "يرجى الانتظار...",
       "invitationRevokedSuccess": "تم إلغاء الدعوة بنجاح.",
       "errorRevokingInvitation": "خطأ أثناء إلغاء الدعوة.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "تُلتقط التتبعات باستخدام eBPF: لا حاجة إلى تغييرات في الشيفرة أو إلى SDK. لا يُنقل سياق التتبع بين الخدمات إلا عبر HTTP بنص عادي (وعبر HTTPS أيضًا لتطبيقات Go، إلا على العُقد التي تفعّل kernel lockdown). تُتتبَّع أي عملية تطابق أيًّا من المنافذ أو مسار الملف التنفيذي أو سطر الأوامر؛ لا يمكن أن تحتوي أنماط glob على `,` أو `{'{'}` أو `{'}'}`، ويطابق المنفذ أي عملية لديها مقبس عليه. يتطلب Helm 3.14+ ومشغّل OpenTelemetry v0.142.0+؛ إذا كان مشغّلك أقدم، فرقِّه أولًا باستخدام `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. إذا كان eBPF مفعّلًا بالفعل على مشغّل أقدم، فأعد تنفيذ الأمر مع `--force` (`--force-replace` في Helm 4). تؤدي إعادة تنفيذ أمر التثبيت أعلاه إلى إعادة تعيين الإصدار وإيقاف eBPF، لذا أعد تنفيذ هذا الأمر بعد ذلك. يجب أن تسمح مساحة الأسماء `openobserve-collector` بحاويات Pod ذات الامتيازات، ويجب أن تعمل العُقد بنظام Linux على amd64 أو arm64 بنواة 5.8+ (أو RHEL-family 4.18 مع backports لـ eBPF) مع BTF. لا تختر تطبيقات ترسل تتبعاتها بنفسها بالفعل، ولا حاويات Pod تستخدم الحاوية الجانبية `inject-go` الخاصة بـ Go.",
       "k8sEbpfVariant": "eBPF (أي لغة، دون تغيير الشيفرة)",
       "k8sLibrariesVariant": "مكتبات اللغات (القياس التلقائي)",
+      "k8sNetworkFlowsDesc": "يسجّل DaemonSet الخاص بـ eBPF التابع للمجمّع **البايتات المرسلة بين أحمال العمل عبر أي بروتوكول TCP أو UDP** على كل عقدة Linux، بما في ذلك قواعد البيانات وذاكرات التخزين المؤقت والخدمات الأخرى غير المتتبعة. وتصل تلك البايتات كمقياس `obi_network_flow_bytes`، موسومة بمالك المصدر والوجهة (Deployment، StatefulSet، Node، …) ومساحة الأسماء. ويعمل مع تتبع eBPF أو بدونه.",
+      "k8sNetworkFlowsNote": "يتطلب Helm 3.14+ ومشغّل OpenTelemetry الإصدار v0.142.0+. يجب أن يسمح النطاق `openobserve-collector` بحاويات pod ذات امتيازات، ويجب أن تشغّل العقد Linux على amd64 أو arm64 بنواة 5.8+ (أو عائلة RHEL 4.18 مع backports الخاصة بـ eBPF) وBTF. تعمل حاويات eBPF pod على شبكة المضيف، وتستمع مقاييس المجمّع نفسه على `127.0.0.1:8888` في كل عقدة، لذا يجب أن يكون هذا المنفذ حرًا هناك. تُحفظ محددات تتبع eBPF التي عيّنتها بالفعل. إعادة تشغيل أمر التثبيت أعلاه تعيد تعيين الإصدار وتعطّل هذا، لذا شغّل هذا الأمر مرة أخرى بعد ذلك. قد تُبلَّغ البايتات نفسها أكثر من مرة: حركة المرور بين عقدتين من قِبل كلتا العقدتين، واتصال بخدمة Service يُبلَّغ عنه لكل من الخدمة وحمل العمل الذي يقف خلفها. يوضّح دليل تدفقات شبكة eBPF كيفية الاستعلام عنها دون احتساب مزدوج.",
+      "k8sNetworkFlowsTitle": "اطّلع على أحمال العمل التي تتواصل فيما بينها: تدفقات شبكة eBPF",
       "k8sInstallerNote": "يثبّت هذا cert-manager وOpenTelemetry operator ومجمّع OpenObserve تلقائيًا.",
       "k8sInternalEndpointNote": "استخدم هذا عندما يعمل OpenObserve في نفس المجموعة — لا تغادر حركة المرور أبدا.",
       "k8sTroubleAnnotationA": "يحدث الحقن عند إنشاء الكبسة، لذا لا تتأثر الكبسولات الموجودة حتى تعيد التشغيل — شغل `kubectl rollout restart deployment -n my-namespace`. تأكد من أن التعليق وصل إلى `kubectl get ns my-namespace -o yaml`، وتحقق من أن القيمة تطابق `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "فشل التثبيت بسبب خطأ في واجهة القبول",
       "linuxAgentFixBody": "يقوم المثبت بتشغيل الوكيل كخدمة systemd. إذا لم يصل شيء، تأكد من أنه يعمل واقرأ سجلاته بحثا عن خطأ في المصادقة أو الاتصال:",
       "linuxTracesNote": "تُلتقط التتبعات باستخدام eBPF: لا حاجة إلى تغييرات في الشيفرة أو إلى SDK. تُتتبَّع أي عملية تطابق أيًّا من المنافذ أو مسار الملف التنفيذي أو سطر الأوامر؛ لا يمكن أن تحتوي أنماط glob على `,` أو `{'{'}` أو `{'}'}`. يتطلب التتبع Linux 5.8+ (أو RHEL-family 4.18 مع backports لـ eBPF) مع BTF؛ ثم يعمل الوكيل بصلاحيات الجذر. إذا تعذّر على المضيف التتبع، يتوقف التثبيت ويترك الوكيل العامل دون تغيير. إذا فشل الوكيل بعد ذلك في البدء مع تفعيل التتبع، يُعطَّل — وكذلك السجلات والمقاييس — إلى أن تعيد تنفيذ أمر **السجلات والمقاييس**، أو تُصلح السبب وتعيد التنفيذ مع التتبع. تضيف التطبيقات المتتبعة ترويسة W3C `traceparent` إلى طلبات HTTP النصية الصادرة. يغطي دليل تتبع eBPF أدناه HTTPS والأعلام المتكررة.",
+      "linuxNetworkFlowsDesc": "شغّل المثبّت مع `--network-flows` للإبلاغ عن **البايتات التي يرسلها هذا المضيف ويستقبلها عبر أي بروتوكول TCP أو UDP**، كمقياس `obi_network_flow_bytes`. يُوسم كل تدفق بـ `src_cidr` و`dst_cidr` باستخدام الشبكات التي تسردها، لذا أعطِ كل مضيف القائمة نفسها: إدخال `/32` واحد لكل مضيف يمنحك خريطة من مضيف إلى مضيف.",
+      "linuxNetworkFlowsNote": "يتطلب Linux 5.8+ (أو عائلة RHEL 4.18 مع backports الخاصة بـ eBPF) مع BTF؛ يعمل الوكيل حينها بصلاحيات root. يعمل مع التتبع أو دونه، لكن كل تشغيل للمثبّت يستبدل إعداد الوكيل: لإبقاء التتبع مفعّلًا، أضف الرايتين `--trace-*` و`--service-name` من أمر **السجلات والمقاييس وتتبعات eBPF**. إذا تعذّر على المضيف تشغيل eBPF، يتوقف التثبيت ويترك الوكيل العامل دون تغيير. إذا فشل بدء التقاط الشبكة بعد ذلك، يُعطَّل الوكيل — وكذلك السجلات والمقاييس — إلى أن تعيد تشغيل أمر **السجلات والمقاييس**، أو تصلح السبب وتعيد التشغيل مع `--network-flows`. تُبلّغ كل من المضيفين عن حركة المرور بينهما إذا كان كلاهما يشغّل الوكيل، وتُحتسب حركة المرور العائدة (loopback) ما لم يكن للطرفين العنوان نفسه. يوضّح دليل تدفقات شبكة eBPF أدناه التسميات وكيفية الاستعلام عنها دون احتساب مزدوج.",
+      "linuxNetworkFlowsTitle": "اطّلع على المضيفين الذين يتواصلون فيما بينهم: تدفقات شبكة eBPF",
       "linuxTracesVerifyNote": "عند تفعيل التتبع، تظهر التتبعات بمجرد أن يعالج تطبيق متتبَّع طلبًا.",
+      "ebpfNetworkFlowsGuideLink": "دليل تدفقات شبكة eBPF",
       "ebpfTracingGuideLink": "دليل تتبع eBPF",
       "logsMetricsTracesVariant": "السجلات والمقاييس وتتبعات eBPF",
       "logsMetricsVariant": "السجلات والمقاييس",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "وجه أي مصدر OpenTelemetry إلى OpenObserve — سواء كان جامعا أو SDK، HTTP أو gRPC. نقطة النهاية والرمز الخاص بك معبأان أدناه.",
       "taglineWindows": "قم بتثبيت وكيل OpenObserve على أي مضيف ويندوز — سجل الأحداث، عدادات الأداء، ومقاييس المضيف.",
       "testAgain": "اختبر مرة أخرى",
+      "networkFlowsHelp": "إدخالات CIDR أو CIDR=NAME، مفصولة بفواصل دون مسافات؛ يحتاج كل CIDR إلى طول بادئة، مثل 10.0.1.5/32، ولا يجوز أن تحتوي الأسماء إلا على حروف وأرقام والنقطة (.) والشرطة السفلية (_) والشرطة (-). تُترك العناوين التي لا يطابقها أي إدخال دون وسم؛ الإدخال 0.0.0.0/0=other يسمّي بقية IPv4، والإدخال ::/0=other6 يسمّي بقية IPv6.",
+      "networkFlowsLabel": "الشبكات المراد وسمها",
+      "networkFlowsRequired": "اذكر شبكة واحدة على الأقل: تُوسم التدفقات بالشبكات التي تذكرها.",
       "traceCmdHelp": "لتطبيقات Python وNode.js وJava.",
       "traceCmdLabel": "سطر الأوامر",
       "traceExeLabel": "مسار الملف التنفيذي",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "إخفاء الخلايا الأقل من",
     "heatmapHideBelowTooltip": "تبقى الخلايا ذات القيمة الأقل من ذلك فارغة.",
     "heatmapHideBelowNote": "الخلايا التي تقل عن {value} مخفية",
+    "boxplotWhisker": "الشعيرات",
+    "boxplotWhiskerMinMax": "من الأدنى إلى الأعلى",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "حقل الرسالة",
+    "logsLevelField": "حقل المستوى",
+    "logsTimeField": "حقل الوقت",
+    "htmlPanelFieldTooltip": "اتركه فارغًا لاكتشاف العمود من نتائج الاستعلام",
+    "logsOrder": "الترتيب",
+    "logsOrderNewest": "الأحدث أولًا",
+    "logsOrderOldest": "الأقدم أولًا",
+    "logsOrderTooltip": "يرتب الصفوف التي يعيدها الاستعلام. يُجلب الاستعلام الابتدائي غير المعدَّل بهذا الترتيب أيضًا، فيعرض خيار الأقدم أولًا أقدم السجلات.",
+    "logsShowTime": "إظهار الوقت",
+    "logsWrap": "التفاف الأسطر",
+    "logsPrettifyJson": "تنسيق JSON",
     "distributionBucketCount": "عدد الفئات",
     "distributionBucketSize": "حجم الفئة",
     "distributionBucketSizeTooltip": "عرض كل فئة بوحدات الحقل. عند تعيينه يحل محل عدد الفئات.",
@@ -7822,6 +8145,8 @@
       "gauge": "المقياس",
       "html": "HTML",
       "markdown": "ماركداون",
+      "boxplot": "مخطط صندوقي",
+      "logs": "السجلات",
       "barGauge": "مقياس شريطي",
       "distribution": "التوزيع",
       "treemap": "مخطط شجري",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: الوسيطة المطلوبة مفقودة في الموقع {index}",
       "fieldNotAllowedForMetric": "{label} الحقل غير مسموح به في رسم بياني للقياس",
       "rawValueSampled": "استنادًا إلى أول {count} صف",
+      "addAtMostOneFieldFor": "أضف حقلاً واحداً على الأكثر لـ {label}",
+      "boxplotMin": "الحد الأدنى",
+      "boxplotMax": "الحد الأقصى",
+      "boxplotLowerWhisker": "الشعيرة السفلى",
+      "boxplotUpperWhisker": "الشعيرة العليا",
+      "boxplotMedian": "الوسيط",
+      "boxplotSamples": "العينات",
+      "boxplotOutlier": "قيمة شاذة",
       "fieldNotAllowedForDistribution": "الحقل {label} غير مسموح به في مخطط التوزيع",
       "distributionCount": "العدد",
       "addAtLeastOneFieldFor": "أضف على الأقل حقل واحد لـ {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "لا توجد صلاحية وصول",
       "urlHiddenHint": "لا يمكنك عرض لوحة المعلومات الخاصة بهذا الرابط، لذا تم إخفاء عنوان URL العام الخاص به.",
       "orgDisabledHint": "تم إيقاف الروابط العامة لهذه المؤسسة",
+      "orgDisabledBanner": "تم إيقاف الروابط العامة لهذه المؤسسة، لذا لا يتم تقديم أي رابط. يمكن للمسؤول إعادة تشغيلها.",
+      "disabledPaused": "معطّل · موقوف مؤقتًا",
       "takeOver": "تولّي الرابط",
       "takeOverTitle": "هل تريد تولّي هذا الرابط؟",
       "takeOverBody": "ستصبح أنت الناشر. ستعرض الصفحة العامة ما يُسمح لك برؤيته، وقد يكون أكثر أو أقل من السابق. يحتفظ كل من لديه عنوان URL بإمكانية الوصول، ويصبح الرابط نشطًا الآن.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "المجموعة",
     "wellSubgroup": "المجموعة الفرعية",
     "wellSize": "الحجم",
+    "wellCategory": "الفئة",
     "value": "القيمة"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "حرّك قيمة الإطلاق بعيدًا عن الحالة المستقرة المرصودة.",
       "lengthenEvaluationWindow": "إطالة نافذة التقييم",
       "lengthenEvaluationWindowDesc": "وسّع الفترة حتى لا تؤدي القفزة القصيرة إلى تفعيل التنبيه.",
-      "enableDeduplication": "تفعيل إزالة التكرار",
-      "enableDeduplicationDesc": "اجمع مرات الإطلاق المتكررة داخل نافذة إزالة التكرار.",
+      "enableDeduplication": "تفعيل كتم التكرارات",
+      "enableDeduplicationDesc": "إشعار مرة واحدة عند كل تغيير في الحالة بدلًا من كل تقييم.",
       "reviewForDeletion": "مراجعة للحذف",
       "reviewForDeletionDesc": "تأكد من أن الاستعلام ما زال يطابق الواقع قبل الاستغناء عن التنبيه.",
       "fixAlertQuery": "إصلاح استعلام التنبيه",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "معرف المؤسسة",
     "alertCreationTitle": "إنشاء التنبيه",
     "noAlertsFound": "لم يتم العثور على أي تنبيهات",
-    "suppressedByDeduplication": "تم قمعها بواسطة إزالة التكرار",
-    "occurrence": "{count} تكرار | مرات الحدوث: {count}",
     "groupedNotification": "إشعارات مجمعة",
     "alertsBatchedTogether": "تنبيهات متراكمة معا",
-    "notificationSent": "تم إرسال الإشعار",
-    "occurrencesDeduplicated": "تم إلغاء تكرار الظواهر",
     "alertExecutionDetails": "تفاصيل تنفيذ التنبيه",
     "evaluationTime": "وقت التقييم",
     "queryTime": "وقت الاستعلام",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "إلى: {time}",
     "serviceGraphTooltipTemporalCorrelation": "الارتباط الزمني",
     "serviceGraphTooltipServiceDependency": "الاعتماد على الخدمة",
-    "totalAlerts": "تنبيهات شاملة",
-    "usingDeduplication": "استخدام إزالة التكرار",
-    "deduplicationConfiguredTooltip": "تنبيهات مع إزالة التكرار معدة",
-    "suppressionRate24h": "معدل القمع (24 ساعة)",
     "suppressed": "مكبوت /",
-    "total": "الإجمالي",
-    "passedLabel": "تم تمريرها:",
-    "pendingBatches": "الدفعات المعلقة",
-    "pendingBatchesTooltip": "تنبيهات تنتظر أن تجمع معا",
     "historyTimeline": {
       "firing": "قيد الإطلاق",
       "ok": "حسنا",
@@ -10089,7 +10413,8 @@
     "endTime": "وقت الانتهاء",
     "duration": "المدة",
     "retries": "إعادة المحاولات",
-    "dedup": "إزالة التكرار",
+    "suppression": "الكتم",
+    "suppressedAsRepeat": "مكتوم كتكرار",
     "validation": {
       "streamTypeRequired": "نوع التدفق مطلوب.",
       "streamNameRequired": "اسم التدفق مطلوب.",
@@ -10281,15 +10606,6 @@
     "all": "الجميع",
     "history": "تاريخ التنبيه",
     "searcHistory": "أدخل اسم التنبيه",
-    "deduplication": {
-      "fingerprintFields": "تجميع تنبيهات مماثلة بواسطة",
-      "fingerprintFieldsHint": "اختر الحقول التي تجعل التنبيهات متشابهة (مثل hostname وservice). اتركه فارغًا للاكتشاف التلقائي بناءً على استعلامك.",
-      "fingerprintFieldsTooltip": "اختر الحقول التي يجب أن تتطابق لتُعتبر التنبيهات مكررة. على سبيل المثال، اختيار 'hostname' يعني أن التنبيهات من نفس المضيف ستُجمع معًا. أنواع التنبيهات المختلفة (مثل High CPU مقابل High Memory) لا تُجمع أبدًا، حتى لو جاءت من نفس المضيف. اتركه فارغًا للاكتشاف التلقائي بناءً على نوع الاستعلام.",
-      "timeWindow": "فكر في التنبيهات المتشابهة",
-      "timeWindowHint": "فترة زمنية لتجميع تنبيهات مماثلة. اترك التنبيهات فارغة لتتناسب مع فترة الفحص الخاصة بك.",
-      "timeWindowTooltip": "كم من الوقت يجب تذكر التنبيهات الأخيرة للتجميع. إذا حدث تنبيه مشابه خلال هذه الفترة، فلن يتم إرساله مرة أخرى. اترك التنبيه فارغا لاستخدام فترة فحص التنبيه.",
-      "fingerprintFieldsHelp": "اترك فارغا للكشف التلقائي بناء على الاستعلام (SQL: أعمدة GROUP BY، PromQL: تسميات، حقول Custom: condition)"
-    },
     "summary": {
       "scrollToBottom": "التمرير إلى الأسفل",
       "title": "الملخص",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "أبلغني عندما تتحقق الشروط المهيأة"
       }
     },
-    "correlation": {
-      "title": "ارتباط التنبيه",
-      "description": "قم بتكوين كيفية ربط التنبيهات وإزالة النسخ عبر المؤسسة. سيتم تجميع التنبيهات التي تحتوي على قيم بصمة أصابع متطابقة معا.",
-      "semanticFieldNote": "ملاحظة: يتم تكوين تعيينات الحقول الدلالية في تبويب هوية الخدمة.",
-      "enableOrgLevel": "تمكين إزالة التكرار على مستوى المؤسسة",
-      "enableOrgLevelTooltip": "تفعيل ميزات إزالة التكرار والارتباط لجميع التنبيهات في هذه المؤسسة",
-      "enableCrossAlert": "تمكين إزالة التكرار عبر التنبيه",
-      "enableCrossAlertTooltip": "السماح للتنبيهات المختلفة بإزالة تكرار بعضها البعض عندما تشترك في نفس البصمة",
-      "fingerprintGroups": "مجموعات بصمات الإصبع المتقاطعة",
-      "fingerprintGroupsTooltip": "اختر المجموعات الدلالية التي ستستخدمها لبصمة التنبيهات المتقاطعة. سيتم إلغاء تكرار التنبيهات إذا كانت تشترك في نفس القيم لهذه الأبعاد.",
-      "fingerprintGroupsHint": "اختر على الأقل مجموعة دلالية واحدة لإزالة التكرار عبر التنبيه",
-      "fingerprintGroupsRequired": "يجب اختيار مجموعة دلالية واحدة على الأقل",
-      "defaultWindow": "نافذة الارتباط الافتراضية (دقائق)",
-      "defaultWindowTooltip": "في غياب تطابق المجال الدلالي، تعتبر التنبيهات والبيانات من المدة المعينة مرتبطة",
-      "defaultWindowDescription": "في غياب تطابق المجال الدلالي، تعتبر التنبيهات والبيانات من المدة المعينة مرتبطة",
-      "defaultWindowPlaceholder": "استخدم فترة التنبيه بشكل افتراضي",
-      "cancelButton": "إلغاء",
-      "saveButton": "حفظ",
-      "settingsSaved": "تم حفظ إعدادات إزالة التكرار للمؤسسة بنجاح",
-      "settingsSaveError": "فشل في حفظ الإعدادات"
-    },
     "placeholders": {
       "typeSomething": "اكتب شيئا",
       "value": "القيمة",
       "selectColumn": "اختر عمودًا",
       "savedFunctions": "الدوال المحفوظة",
-      "autoUsesCheckInterval": "أوتوماتيكي (يستخدم فاصل الفحص)",
       "addTag": "أضف علامة واضغط Enter"
     },
     "steps": {
       "compareWithPast": "قارن مع الماضي",
-      "deduplication": "إزالة التكرار",
       "advanced": "متقدمة"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "ما الذي يجب أن يثير التنبيه",
       "compareWithPast": "قارن النتائج الحالية مع بيانات من فترة زمنية أخرى",
       "alertSettings": "حدد قواعد التنبيه واختر كيف ترغب في أن يتم إعلامك.",
-      "deduplication": "تجنب إرسال نفس التنبيه عدة مرات عن طريق تجميع تنبيهات متشابهة معا.",
       "advanced": "متغيرات السياق، الوصف، وقالب الصف"
     },
     "failedToFetchHistory": "فشل في جلب سجل التنبيه",
@@ -10399,8 +10691,6 @@
         "closeActions": "إغلاق الإجراءات",
         "viewAlertHistory": "عرض تاريخ التنبيهات",
         "actionsFor": "إجراءات من أجل:",
-        "configureDedup": "تكوين Dedup",
-        "configureDedupTooltip": "تكوين إزالة التكرار لهذا التنبيه",
         "editAlert": "تعديل التنبيه",
         "editAlertTooltip": "تعديل تكوين التنبيه",
         "viewHistory": "عرض التاريخ",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "رسالة \"تم الحل\" جديدة",
       "keepFiringFor": "الاستمرار في الإطلاق لمدة",
       "keepFiringForTooltip": "انتظر هذه المدة بعد زوال الشرط قبل التعافي. القيمة 0 تعني التعافي فورًا.",
+      "suppressRepeats": "كتم التكرارات",
+      "suppressRepeatsTooltip": "إشعار مرة واحدة عندما يبدأ التنبيه في الإطلاق أو يتغير مستواه، وليس عند كل تقييم. اتركه معطّلًا لمواصلة تلقّي التذكيرات بعد كل فترة كتم.",
       "keepFiringForInvalid": "أدخل 0 ثانية أو أكثر",
       "keepFiringForTooLong": "أدخل 86400 ثانية (24 ساعة) كحد أقصى"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "تم إضافة هذا البريد الإلكتروني بالفعل",
     "confirmRemoveEmail": "هل أنت متأكد من أنك تريد إزالة البريد الإلكتروني {email}؟",
     "domainNeedsEmails": "يجب أن يكون للنطاق '{domain}' على الأقل عنوان بريد إلكتروني واحد عند عدم السماح لجميع المستخدمين",
+    "noAllowedEmailsDenyAll": "لم يُسمح بأي عناوين بريد إلكتروني بعد، لذا يُرفض كل مستخدم من {domain}.",
     "domainSettingsSaved": "تم حفظ إعدادات النطاق بنجاح",
     "errorSavingDomainSettings": "خطأ في حفظ إعدادات النطاق",
     "noDomainMessage": "لا توجد نطاقات مهيأة. أضف نطاقات أعلاه لتقييد الوصول.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "قم بتكوين مجموعة هوية واحدة على الأقل قبل الحفظ.",
       "discoveredServicesTab": "الخدمات المكتشفة",
       "serviceDiscoveryTab": "قواعد الكشف",
-      "alertCorrelationTab": "تجميع التنبيهات",
       "fieldAliasesTab": "خرائط الميدان",
       "fieldAliasesSaved": "تم حفظ أسماء مستعارة الحقل بنجاح",
       "fieldAliasesSaveError": "فشل في حفظ أسماء مستعارة الحقول",
@@ -14079,27 +14371,144 @@
     "runsIn": "تشغيل في",
     "recommendedByFieldCoverage": "موصى به بناءً على تغطية الحقول في التدفقات الخاصة بك.",
     "listConjunctionAndTwo": "{first} و {last}",
-    "domainOrgMappings": {
-      "title": "تعيينات النطاق إلى المؤسسة",
-      "subtitle": "يُضاف المستخدمون الجدد الذين يسجّلون الدخول بنطاق بريد إلكتروني مطابق إلى المؤسسة تلقائيًا.",
+    "orgDomainMapping": {
+      "tabLabel": "إدارة النطاقات",
+      "tabDesc": "اربط نطاقات بريدك الإلكتروني، وعيّن مستخدميها إلى المؤسسات، وتحكم في من يمكنه الانضمام منها.",
+      "loadFailed": "تعذّر تحميل إعدادات المؤسسة",
       "addMapping": "إضافة تعيين",
       "editMapping": "تعديل التعيين",
-      "empty": "لا توجد تعيينات بعد. استخدم «{addLabel}» لإضافة تعيين.",
       "domain": "نطاق البريد الإلكتروني",
-      "domainHelp": "الجزء الذي يلي {at_sign} في عنوان البريد الإلكتروني للمستخدم.",
+      "domainHelp": "الجزء الذي يلي {at_sign} في عنوان البريد الإلكتروني للمستخدم. النطاق مرتبط بهذه المؤسسة ويجب التحقق منه عبر DNS.",
+      "domainHelpRequest": "الجزء الذي يلي {at_sign} في عنوان البريد الإلكتروني للمستخدم. يُربط النطاق بهذه المؤسسة بمجرد موافقة OpenObserve على الطلب.",
       "organization": "المؤسسة",
-      "organizationPlaceholder": "معرّف المؤسسة",
-      "organizationHelp": "معرّف المؤسسة التي يُضاف إليها المستخدمون المطابقون.",
+      "organizationHelp": "هذه المؤسسة أو أحد أعضاء مجموعة التصنيف الخاصة بها.",
       "organizationRequired": "المؤسسة مطلوبة",
       "baseRole": "الدور الأساسي",
-      "baseRoleHelp": "الدور الذي يُمنح للمستخدمين المطابقين في تلك المؤسسة.",
+      "baseRoleHelp": "الدور الممنوح عند إضافة مستخدم إلى تلك المؤسسة. يحتفظ الأعضاء الحاليون بأدوارهم الحالية.",
       "roleClaimName": "مطالبة الدور",
       "roleClaimNamePlaceholder": "اسم المطالبة، مثل groups",
-      "roleClaimNameHelp": "اختياري. مطالبة الرمز التي تسرد الأدوار المخصصة للمستخدم؛ عند كل تسجيل دخول تتم مزامنة أدواره المخصصة في تلك المؤسسة معها.",
-      "createMissingRoles": "إنشاء الأدوار الواردة في المطالبة غير الموجودة في المؤسسة",
-      "duplicateDomain": "يوجد تعيين لهذا النطاق بالفعل",
-      "confirmRemove": "هل أنت متأكد من أنك تريد حذف التعيين الخاص بـ {name}؟",
-      "deleteTitle": "حذف التعيين"
+      "roleClaimNameHelp": "اختياري. مطالبة رمز SSO التي تسرد الأدوار المخصصة للمستخدم. عند كل تسجيل دخول عبر SSO، تُستبدل أدواره المخصصة في تلك المؤسسة بالأدوار المطالب بها؛ تُتخطى الأدوار المطالب بها غير الموجودة ما لم يتم إنشاؤها.",
+      "createMissingRoles": "إنشاء الأدوار المطالب بها غير الموجودة في المؤسسة",
+      "verifyNow": "تحقق الآن",
+      "details": "التفاصيل",
+      "detailsDialogTitle": "تفاصيل ربط {domain}",
+      "approvedLinkInfo": "تم الربط بواسطة OpenObserve بعد طلب ربط. لا حاجة إلى سجل DNS.",
+      "pendingRequestInfo": "يراجع OpenObserve هذا الطلب. لا يلزم اتخاذ أي إجراء حتى تتم الموافقة عليه.",
+      "rejectedRequestInfo": "رفض OpenObserve هذا الطلب.",
+      "verifyDialogTitle": "التحقق من {domain}",
+      "recordDialogTitle": "سجل DNS لـ {domain}",
+      "lastCheckFailed": "فشل آخر فحص: {reason}",
+      "state": {
+        "pending": "قيد الانتظار",
+        "verified": "تم التحقق",
+        "failed": "فشل",
+        "requested": "بانتظار الموافقة",
+        "approved": "تمت الموافقة",
+        "rejected": "مرفوض"
+      },
+      "saved": "تم حفظ تعيين النطاق",
+      "saveFailed": "فشل حفظ الإعدادات",
+      "linkFailed": "فشل ربط النطاق",
+      "unlinkFailed": "فشل إلغاء ربط النطاق",
+      "verifyFailed": "فشل التحقق",
+      "deleted": "تمت إزالة التعيين",
+      "deleteTitle": "إزالة التعيين؟",
+      "deleteMappingBody": "لن يُضاف المستخدمون من {domain} إلى {org} بعد الآن عند تسجيل الدخول.",
+      "recordInstructions": "أضف سجل DNS TXT هذا لدى مزوّد DNS الخاص بك:",
+      "txtNameLabel": "اسم السجل",
+      "txtValueLabel": "قيمة السجل",
+      "copyTxtName": "انسخ اسم السجل",
+      "copyTxtValue": "انسخ قيمة السجل",
+      "txtNameCopied": "تم نسخ اسم السجل",
+      "txtValueCopied": "تم نسخ قيمة السجل",
+      "verifyHint": "يتم التحقق تلقائيًا كل {minutes} دقيقة. يمكنك أيضًا التحقق الآن.",
+      "alreadyLinked": "هذا النطاق مرتبط بالفعل بهذه المؤسسة",
+      "failureReason": {
+        "recordMissing": "لم يتم العثور على سجل TXT",
+        "valueMismatch": "تم العثور على سجل TXT، لكن القيمة غير مطابقة",
+        "dnsFailed": "فشل تحليل DNS"
+      },
+      "pageSubtitle": "اربط نطاقات بريدك الإلكتروني، وعيّن مستخدميها للمؤسسات، وتحكم في من يمكنه الانضمام منها.",
+      "linkedTab": "النطاقات المرتبطة",
+      "mappingsTab": "التعيينات",
+      "accessTab": "المستخدمون المحظورون",
+      "requestsTab": "طلبات الربط",
+      "linkDomain": "اربط النطاق",
+      "sendRequest": "أرسل الطلب",
+      "linkMethod": "كيفية إثبات الملكية",
+      "method": {
+        "dns": "سجل DNS",
+        "approved": "طلب معتمد",
+        "request": "طلب ربط",
+        "dnsTitle": "أضف سجل DNS TXT",
+        "dnsDesc": "يتم التحقق تلقائيًا بمجرد نشر السجل. الأنسب عندما تدير DNS الخاص بالنطاق.",
+        "requestTitle": "اطلب ربطًا من OpenObserve",
+        "requestDesc": "يراجع فريقنا الطلب ويربط النطاق بعد الموافقة عليه."
+      },
+      "searchDomains": "ابحث في النطاقات",
+      "searchMappings": "ابحث حسب النطاق أو المؤسسة",
+      "searchRequests": "ابحث حسب النطاق أو المؤسسة أو مقدّم الطلب",
+      "status": "الحالة",
+      "linkedVia": "مرتبط عبر",
+      "lastChecked": "آخر فحص",
+      "linked": "تم ربط النطاق. أضف سجل DNS للتحقق منه.",
+      "verified": "تم التحقق من النطاق",
+      "notVerifiedYet": "لم يتم العثور على سجل DNS بعد. قد يستغرق انتشاره بعض الوقت.",
+      "requestSent": "تم إرسال طلب الربط",
+      "requestFailed": "فشل إرسال طلب الربط",
+      "keepRecordHint": "احتفظ بهذا السجل في مكانه. تتم إعادة التحقق من الملكية كل {minutes} دقيقة؛ إذا كان السجل مفقودًا لأكثر من {grace} دقيقة، فسيتم وضع علامة فشل على النطاق ويتوقف تطبيق تعييناته.",
+      "removeDomain": "إزالة النطاق",
+      "removeTitle": "إزالة النطاق؟",
+      "removeBody": "سيتم إلغاء ربط {domain} بهذه المؤسسة.",
+      "removeWithMappingsBody": "سيتم إلغاء ربط {domain} بهذه المؤسسة، وستتم إزالة {count} تعيين. | سيتم إلغاء ربط {domain} بهذه المؤسسة، وستتم إزالة {count} من التعيينات.",
+      "removed": "تمت إزالة النطاق",
+      "domainRequired": "النطاق مطلوب",
+      "mappingDomainHelp": "لا يمكن تعيين سوى النطاقات التي تم التحقق منها.",
+      "createsRoles": "ينشئ أدوارًا",
+      "duplicateMapping": "هذا النطاق معيّن بالفعل لتلك المؤسسة",
+      "domainNotVerified": "غير مُتحقق منه",
+      "noVerifiedDomains": "تنطبق التعيينات على النطاقات التي تم التحقق منها. اربط نطاقًا وتحقق منه أولًا.",
+      "goToLinked": "اربط نطاقًا",
+      "goToLinkedDesc": "تحقق من نطاق تملكه قبل تعيين مستخدميه",
+      "enforceTitle": "إزالة المستخدمين من المؤسسات الأخرى",
+      "enforceDesc": "عندما يسجل مستخدم من نطاق معيّن الدخول عبر SSO، تتم إزالته من كل مؤسسة خارج هذه المؤسسة ومجموعة الفوترة الخاصة بها.",
+      "enforceConfirmTitle": "إزالة المستخدمين من المؤسسات الأخرى؟",
+      "enforceConfirmBody": "في كل مرة يسجل فيها مستخدم ينتمي نطاق بريده الإلكتروني إلى تعيين هنا الدخول عبر SSO، ستتم إزالته من كل مؤسسة ليست هذه المؤسسة أو ضمن مجموعة الفوترة الخاصة بها، بما في ذلك مؤسساته الشخصية.",
+      "enforceConfirmAction": "تشغيل",
+      "enforceSaved": "تم حفظ الإعداد",
+      "blockUsers": "حظر المستخدمين",
+      "editBlockedUsers": "تعديل المستخدمين المحظورين",
+      "block": "حظر",
+      "blockedCount": "تم حظر {count} | تم حظر {count}",
+      "blockedEmails": "عناوين البريد المحظورة",
+      "blocklistDomainHelp": "أحد النطاقات التي تم التحقق منها لهذه المؤسسة.",
+      "blocklistEmailsHelp": "لا يمكن لهؤلاء المستخدمين الانضمام إلى هذه المؤسسة أو أعضاء مجموعة الفوترة الخاصة بها عبر SSO، وسيتم إزالتهم منها عند تسجيل دخولهم التالي.",
+      "ruleBlockedRequired": "أضف عنوان بريد إلكتروني واحدًا على الأقل للحظر",
+      "noDomainForBlocklist": "كل نطاق تم التحقق منه لديه بالفعل مستخدمون محظورون. عدّل صفه لتغييرهم.",
+      "unblockAll": "إلغاء حظر الكل",
+      "unblockAllTitle": "إلغاء حظر جميع المستخدمين؟",
+      "unblockAllBody": "يمكن لكل مستخدم محظور من {domain} الانضمام مجددًا عند تسجيل دخوله التالي عبر SSO.",
+      "blocklistSaved": "تم حفظ المستخدمين المحظورين",
+      "blocklistDeleted": "تم إلغاء حظر المستخدمين",
+      "blocklistSection": "المستخدمون المحظورون حسب النطاق",
+      "filterPending": "قيد الانتظار",
+      "filterAll": "الكل",
+      "requestedBy": "مقدّم الطلب",
+      "requestedAt": "تاريخ الطلب",
+      "verifiedAt": "تم التحقق",
+      "answeredBy": "تمت الإجابة بواسطة",
+      "reason": "السبب",
+      "reasonHelp": "يظهر للمؤسسة التي قدّمت الطلب.",
+      "reasonRequired": "يلزم ذكر سبب لرفض الطلب",
+      "approve": "موافقة",
+      "reject": "رفض",
+      "approveTitle": "هل تريد الموافقة على طلب الربط؟",
+      "rejectTitle": "هل تريد رفض طلب الربط؟",
+      "approveBody": "سيتم ربط {domain} بـ {org} دون التحقق من DNS.",
+      "rejectBody": "لن تحصل {org} على {domain}.",
+      "requestApproved": "تم ربط {domain}",
+      "requestRejected": "تم رفض الطلب الخاص بـ {domain}",
+      "decisionFailed": "فشل تحديث الطلب"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "يرجى اختيار خيار الكشف عند"
   },
   "search_history": {
-    "title": "سجل البحث",
+    "title": "سجل الاستخدام والتكلفة",
     "get_history": "احصل على التاريخ",
     "executed_at": "تم إعدامه في",
     "sql_query": "SQL استعلام",
-    "delayMessage": "قد يتأخر سجل البحث بمقدار"
+    "delayMessage": "قد يتأخر سجل الاستخدام والتكلفة بمقدار"
   },
   "correlation": {
     "unstableDimensionNote": "بعد غير مستقر - تغييرات عند إعادة تشغيل الكبسولة. الافتراضي: جميع القيم.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "البيانات جديدة",
     "dataGettingStale": "البيانات أصبحت قديمة",
     "dataStale": "البيانات قديمة",
-    "lastRefreshed": "آخر تحديث: {time}"
+    "lastRefreshed": "آخر تحديث: {time}",
+    "refresh": "تحديث",
+    "refreshWithAge": "تحديث، آخر تحديث {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "خطأ في المجس"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "نقر",
       "actionType": "النوع",
       "all": "الجميع",
@@ -19868,6 +20280,13 @@
       "attemptN": "محاولة {n}",
       "detailAction": "الحدث",
       "detailSelector": "المختار",
+      "detailStepId": "معرّف الخطوة",
+      "detailTargetUrl": "عنوان URL الهدف",
+      "detailStatus": "الحالة",
+      "detailSkipReason": "سبب التخطي",
+      "stepStatusSkipped": "تم التخطي",
+      "stepStatusUnknown": "غير معروف",
+      "skippedCount": "تم تخطي {n}",
       "downloadTrace": "تحميل {filename}",
       "errorFullscreenTitle": "الخطوة {id}: {action} - خطأ",
       "failedAtStartLoad": "فشل فتح عنوان URL الابتدائي",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "أقصى {max}. إعادة المحاولات تتم داخل نفس المهمة، لذا يجب أن يتناسب التسلسل كله مع ميزانية الفحص.",
       "retriesMaxBrowserHint": "أقصى {max} لفحص المتصفح. كل محاولة تعيد تشغيل الرحلة على كل جهاز، لذا سيتجاوز عدد الأجهزة مهلة الاستطلاع ويبلغ عن فشل لم يحدث في موقعك.",
       "retryDelay": "انتظر",
-      "retryDelaySuffix": "MS بين محاولات.",
+      "retryDelaySuffix": "ثوانٍ بين كل إعادة محاولة.",
       "schedule": "الجدول الزمني",
       "scheduleLater": "الجدول لاحقا",
       "scheduleLaterTooltip": "اختر تاريخا ووقتا مستقبليا لتفعيل الفحص.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "إعادة تشغيل الإعدادات — انسخ أمر إعداد هذا الوكيل لإعادة تشغيل التثبيت / إعادة تشغيل docker (مثلا بعد تدوير الرموز)",
         "noAgents": "لم يسجل أي وكلاء في هذا الموقع حتى الآن.",
         "agentsUnavailable": "وكلاء هذا الموقع مسجلون في مجموعة أخرى ولا يظهرون هنا.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "فحوصات تجري من هذا الموقع",
         "checkName": "الاسم",
         "noChecks": "لم يتم تعيين أي فحوصات لهذا الموقع حتى الآن.",
@@ -20546,7 +20967,7 @@
       "nodes": "العقد",
       "modelPricing": "تسعير النماذج",
       "searchSchedulers": "مُجدولات البحث",
-      "searchHistory": "سجل البحث",
+      "searchHistory": "سجل الاستخدام والتكلفة",
       "sessions": "الجلسات",
       "evalTemplates": "التقييمات الإلكترونية — القوالب",
       "scorers": "التقييمات عبر الإنترنت — أدوات التقييم",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "تحديث القائمة",
       "alertTemplatesAdd": "إضافة قالب جديد",
       "alertTemplatesRefresh": "تحديث القائمة",
-      "logsSearchHistory": "فتح سجل البحث",
+      "logsSearchHistory": "افتح سجل الاستخدام والتكلفة",
       "alertsImport": "استيراد تنبيه",
       "panelEditorRun": "تشغيل / تطبيق استعلام",
       "panelEditorSave": "حفظ ومتابعة التحرير",
@@ -21131,6 +21552,7 @@
         "system": "النظام"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "إلى الأعلى",
         "passed": "تم النجاح",
         "healthy": "سليم",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "فشل في التنقل إلى تنبيه",
       "alertNotFound": "لم يتم العثور على تنبيه",
-      "alertNotFoundInAlerts": "التنبيه \"{name}\" غير موجود ضمن التنبيهات ({count})",
       "failedToLoadAlerts": "فشل في تحميل التنبيهات",
       "alertsDeletedSuccessfully": "تم حذف {count} تنبيه بنجاح | تم حذف {count} من التنبيهات بنجاح",
       "failedToDeleteAlerts": "فشل حذف {count} تنبيه | فشل حذف {count} من التنبيهات",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "يرجى الانتظار أثناء تحميل القوالب...",
       "alertSavedSuccessfully": "تم حفظ التنبيه بنجاح.",
       "alertUpdatedSuccessfully": "تم تحديث التنبيه بنجاح.",
-      "openingDedupConfig": "فتح إعدادات إزالة التكرار لـ: {name}",
       "editingAlert": "تحرير التنبيه: {name}",
       "ack": {
         "acked": "تم الإقرار بـ {name}",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "محرر تسعير النماذج",
     "storageSettings": "إعدادات التخزين",
     "domainManagement": "إدارة النطاق",
+    "orgDomainMapping": "إدارة النطاقات",
     "slackApp": "Slack",
     "regexPatterns": "أنماط Regex",
     "syntheticsLocations": "مواقع المراقبة الاصطناعية",
@@ -26099,7 +26520,7 @@
       "logged": "مُسجَّل"
     },
     "policy": {
-      "gateHint": "من بين التغييرات على التنبيهات الحالية، لا يُطبَّق تلقائيًا سوى إزالة التكرار، مع لقطة للحالة السابقة وفترة مراجعة: يُبقى عليه إذا نجحت فحوصاته، ويُتراجع عنه إذا فشلت. أما كل ما عدا ذلك فينتظر موافقة بنقرة واحدة.",
+      "gateHint": "بين التغييرات التي تُجرى على التنبيهات الحالية، لا يُطبّق تلقائيًا سوى تفعيل كتم التكرارات، مع لقطة للحالة السابقة ونافذة مراجعة: يُحتفظ به إذا نجحت فحوصه، ويُتراجع عنه إذا فشلت. أما كل ما عدا ذلك فينتظر موافقة بنقرة واحدة.",
       "off": "إيقاف",
       "suggest": "اقتراح",
       "auto": "تلقائي",
@@ -26118,7 +26539,7 @@
         "gateDesc": "احتفظ بالنداء حتى ينتهي التحقيق، لمدة تصل إلى دقيقتين. يعمل بمبدأ الفشل المفتوح: إذا انتهت مهلة الفرز أو فشل، فإنه ينادي على أي حال، ويذكر أن التحقيق لا يزال جاريًا أو قد فشل، ويتبع السبب في السلسلة."
       },
       "classes": {
-        "EnableDeduplication": "شغّل إزالة التكرار لتنبيه يتكرر خلال دقائق.",
+        "EnableDeduplication": "تفعيل كتم التكرارات لتنبيه يُشعر عند كل تقييم.",
         "CreateDetector": "أنشئ كاشف شذوذ على طلبات خدمة أو أخطائها أو زمن استجابتها.",
         "RaiseThreshold": "ارفع حدًا ينطلق في الأيام السليمة.",
         "LengthenEvaluationWindow": "أطِل نافذة تنبيه متأرجح.",
@@ -26667,10 +27088,10 @@
           "on": "تنبيه الاتصال"
         },
         "L-302": {
-          "done": "جمعت تنبيهات زمن استجابة checkout الثلاثة في تنبيه واحد",
-          "why": "كانت تُفعَّل معًا 94% من الوقت، لذا تلقيت 3 نداءات بسبب تباطؤ واحد.",
-          "from": "3 تنبيهات",
-          "to": "1",
+          "done": "تم تفعيل كتم التكرارات لتنبيهات زمن استجابة إتمام الشراء الثلاثة",
+          "why": "كانت تُشعر عند كل تقييم طالما بقيت قيد الإطلاق، لذا أدّى تباطؤ واحد إلى استدعائك 120 مرة.",
+          "from": "كل تقييم",
+          "to": "مرة واحدة لكل تغيير",
           "on": "زمن استجابة checkout"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "أرسلت نداءً إلى المناوبة بشأن فشل checkout في المدفوعات.",
         "recsHeld": "أرجأت مشكلة بسيطة في recommendations إلى ملخص يوم الجمعة.",
         "diskApproved": "لقد وافقت على رفع تنبيه القرص على ingest-1 إلى {to}%.",
-        "latencyGrouped": "جمعت تنبيهات البطء الثلاثة في checkout في تنبيه واحد، بحيث لا يصل النداء إلا مرة واحدة عند حدوث تباطؤ واحد.",
+        "latencyGrouped": "فعّلت كتم التكرارات لتنبيهات بطء إتمام الشراء الثلاثة، لذا فإن تباطؤًا واحدًا يستدعي مرة واحدة.",
         "queueFixed": "أضفت عمّال قائمة انتظار الطلبات، لكن قائمة الانتظار ظلّت تنمو، لذا أعدتهم إلى ما كانوا عليه وأرسلت نداءً إلى المناوبة.",
         "loginPaged": "أرسلت نداءً إلى المناوبة بشأن بطء تسجيل الدخول.",
         "queuePermission": "سمحت لي بإضافة عمّال قائمة الانتظار من تلقاء نفسي، بما يصل إلى 8.",
@@ -28083,5 +28504,71 @@
       "legend": "حالة خط المعالجة",
       "legendToggle": "إظهار هذه الحالة على الخريطة أو إخفاؤها"
     }
+  },
+  "recentSearches": {
+    "title": "عمليات البحث الأخيرة",
+    "aboutKeptDays": "عمليات بحثك فقط في {org}، مرئية لك وحدك. تُحفظ لمدة {days} يوم؛ تبقى عمليات البحث المميزة بنجمة حتى تزيلها. | عمليات بحثك فقط في {org}، مرئية لك وحدك. تُحفظ لمدة {days} أيام؛ تبقى عمليات البحث المميزة بنجمة حتى تزيلها.",
+    "aboutKeptForever": "عمليات بحثك فقط في {org}، مرئية لك وحدك. تُحفظ حتى تُحذف.",
+    "pageTitle": {
+      "logs": "عمليات البحث الأخيرة في السجلات",
+      "traces": "عمليات البحث الأخيرة في التتبعات",
+      "metrics": "عمليات البحث الأخيرة في المقاييس",
+      "dbm": "عمليات البحث الأخيرة",
+      "profiles": "عمليات البحث الأخيرة"
+    },
+    "page": {
+      "logs": "السجلات",
+      "traces": "التتبعات",
+      "metrics": "المقاييس",
+      "dbm": "قاعدة البيانات",
+      "profiles": "ملفات تعريف الأداء"
+    },
+    "allPages": "كل الصفحات",
+    "viewAll": "اعرض الكل",
+    "failedCount": "{count} فشل",
+    "keyHints": "↑↓ للتنقل · PgUp/PgDn لتمرير الاستعلام · Enter للتشغيل · Shift+Enter للتحميل فقط · Esc للإغلاق",
+    "loadToFix": "حمّل للإصلاح",
+    "emptyTitle": "لا توجد عمليات بحث أخيرة بعد",
+    "loadError": "تعذر تحميل عمليات البحث الأخيرة",
+    "retry": "أعد المحاولة",
+    "warning": "اكتمل مع تحذير: انتهت المهلة أو كانت النتائج جزئية",
+    "failed": "فشل",
+    "ranCount": "شُغّل {count} مرة",
+    "lineCount": "{count} سطر | {count} أسطر",
+    "relativeWindow": "آخر {period}",
+    "rerunNow": "أعد التشغيل الآن",
+    "rerunOriginal": "في الوقت الأصلي",
+    "loadOnly": "حمّل دون تشغيل",
+    "copyLink": "انسخ الرابط",
+    "copyQuery": "انسخ الاستعلام",
+    "star": "أضف نجمة",
+    "unstar": "أزل النجمة",
+    "linkCopied": "تم نسخ الرابط",
+    "queryCopied": "تم نسخ الاستعلام",
+    "copyFunction": "انسخ الدالة",
+    "functionCopied": "تم نسخ الدالة",
+    "functionLabel": "الدالة (VRL)",
+    "searchPlaceholder": "ابحث في الاستعلامات والتدفقات",
+    "allStreams": "كل التدفقات",
+    "statusAll": "أي حالة",
+    "statusOk": "نجح",
+    "statusError": "فشل",
+    "starredOnly": "المميزة بنجمة فقط",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "الفلترة حسب تاريخ التشغيل",
+    "today": "اليوم",
+    "yesterday": "أمس",
+    "noMatch": "لا توجد عمليات بحث تطابق هذه الفلاتر",
+    "reset": "إعادة تعيين الكل",
+    "resetFilters": "إعادة تعيين الفلاتر",
+    "loadMore": "تحميل المزيد",
+    "clear": "مسح سجلي",
+    "confirmClear": "مسح السجل",
+    "clearBodyPage": "سيؤدي هذا إلى إزالة بحث {page} الأخير لك (العدد: {count}) في {org}. لن تتأثر العروض المحفوظة. | سيؤدي هذا إلى إزالة {count} من عمليات بحث {page} الأخيرة لك في {org}. لن تتأثر العروض المحفوظة.",
+    "clearBodyAll": "سيؤدي هذا إلى إزالة بحثك الأخير (العدد: {count}) في {org} عبر السجلات والتتبعات والمقاييس. لن تتأثر العروض المحفوظة. | سيؤدي هذا إلى إزالة {count} من عمليات البحث الأخيرة لك في {org} عبر السجلات والتتبعات والمقاييس. لن تتأثر العروض المحفوظة.",
+    "includeStarred": "إزالة {count} من بحثي المميز أيضًا | إزالة {count} من عمليات بحثي المميزة أيضًا",
+    "recentRow": "بحث حديث",
+    "deletedQuery": "تم حذف {query}",
+    "undo": "تراجع"
   }
 }
diff --git a/web/src/locales/languages/de-DE.json b/web/src/locales/languages/de-DE.json
index b693d5c78a..b452b0c28c 100644
--- a/web/src/locales/languages/de-DE.json
+++ b/web/src/locales/languages/de-DE.json
@@ -486,7 +486,11 @@
       "monitors": "Monitore",
       "modelPricing": "Modell-Preisdefinitionen",
       "variables": "Variablen",
-      "experiments": "Experimente"
+      "experiments": "Experimente",
+      "linkedDomains": "Verknüpfte Domains",
+      "domainMappings": "Domain-Zuordnungen",
+      "domainRequests": "Verknüpfungsanfragen",
+      "blockedUsers": "Blockierte Benutzer"
     },
     "demo": {
       "pageTitle": "Leere Zustände — vollständiger Satz zur Überprüfung",
@@ -572,6 +576,30 @@
       "action": "Neuer Task",
       "actionDesc": "Richten Sie OpenObserve auf Ihren Endpunkt und testen Sie die Verbindung."
     },
+    "noLinkedDomains": {
+      "title": "Noch keine verknüpften Domains",
+      "description": "Verknüpfen Sie eine E-Mail-Domain, die Ihnen gehört, um deren Benutzer Ihren Organisationen zuzuordnen und zu steuern, wer sich anmelden darf.",
+      "dns": "DNS-Eintrag hinzufügen",
+      "dnsDesc": "Eigentum mit einem TXT-Eintrag verifizieren",
+      "request": "Verknüpfung anfordern",
+      "requestDesc": "Bitten Sie OpenObserve, die Domain für Sie zu verknüpfen"
+    },
+    "noDomainMappings": {
+      "title": "Noch keine Domain-Zuordnungen",
+      "description": "Fügen Sie Benutzer, die sich mit einer verifizierten Domain anmelden, automatisch dieser Organisation oder den Mitgliedern ihrer Abrechnungsgruppe hinzu.",
+      "action": "Zuordnung hinzufügen",
+      "actionDesc": "Wählen Sie eine Domain, eine Organisation und eine Rolle"
+    },
+    "noBlockedUsers": {
+      "title": "Keine blockierten Benutzer",
+      "description": "Jeder Benutzer aus Ihren verifizierten Domains kann beitreten. Blockieren Sie bestimmte Benutzer, um sie fernzuhalten.",
+      "action": "Benutzer blockieren",
+      "actionDesc": "Wählen Sie eine Domain und die E-Mails, die blockiert werden sollen"
+    },
+    "noDomainRequests": {
+      "title": "Keine Verknüpfungsanfragen",
+      "description": "Anfragen von Organisationen zur Verknüpfung einer Domain erscheinen hier."
+    },
     "noDowntimes": {
       "title": "Noch keine Wartungsfenster",
       "description": "Ein Wartungsfenster hält Alarme, Anomalieerkennungen und Synthetics-Prüfungen aktiv und stoppt ihre Benachrichtigungen für einen von Ihnen geplanten Zeitraum.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Auto Run deaktivieren",
     "autoRefreshWithValue": "Automatische Aktualisierung: {value}",
     "searchHistory": "Suchverlauf",
+    "usageCostHistory": "Nutzungs- und Kostenverlauf",
     "createScheduledSearch": "Geplante Suche erstellen",
     "listScheduledSearch": "Geplante Suche auflisten",
     "scheduleSearchJob": "Jobsuche planen",
@@ -1355,6 +1384,8 @@
     "scanSize": "Scan-Größe",
     "deltaScanSize": "Delta-Scan-Größe",
     "scannedSoFar": "Gescannt: {size}",
+    "quickModeHiddenFields": "Schnellmodus ist aktiv. Diese Zeile zeigt {shown} von {total} Feldern.",
+    "turnOffQuickMode": "Schnellmodus ausschalten",
     "resultsProgressLabel": "Suchfortschritt",
     "histogramTitleError": "Fehler beim Generieren des Histogrammtitels.",
     "selectLogStream": "Logs-Stream auswählen",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Keine Netzwerkdaten für diese Ansicht",
     "apiEmptyDescription": "Der ausgewählte Stream enthält keine Ressourcen- oder Netzwerkanfragen in diesem Zeitraum. Netzwerkmetriken erscheinen, sobald die App ihre HTTP-Aufrufe instrumentiert.",
     "skipInactivity": "Inaktivität überspringen",
+    "fullScreen": "Vollbild",
+    "exitFullScreen": "Vollbild beenden",
     "error": "Fehler",
     "errorCount": "Anzahl der Fehler",
     "all": "Alle",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Fügen Sie einen zweiten Schritt hinzu, um diesen Funnel zu einem Dashboard hinzuzufügen",
         "snapshot": "Das Panel behält diese Schritte, Filter und Regeln für benannte Ereignisse so bei, wie sie jetzt sind."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Performance-Übersicht",
+      "filterService": "Service",
+      "filterEnv": "Umgebung",
+      "filterVersion": "Version",
+      "filterAll": "Alle",
+      "verdictPass": "Core Web Vitals bestanden",
+      "verdictFail": "Core Web Vitals erfordern Aufmerksamkeit",
+      "verdictAllPass": "Alle bestanden",
+      "verdictNeedWork": "{count} von {total} verbesserungswürdig | {count} von {total} verbesserungswürdig",
+      "percentileLabel": "Perzentil",
+      "bandGood": "Gut",
+      "bandNeeds": "Verbesserungswürdig",
+      "bandPoor": "Schlecht",
+      "bandGoodPct": "{n}% gut",
+      "bandNeedsPct": "{n}% verbesserungswürdig",
+      "bandPoorPct": "{n}% schlecht",
+      "bandAria": "{good}% gut, {needs}% verbesserungswürdig, {poor}% schlecht",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} schneller",
+      "deltaSlower": "{v} langsamer",
+      "deltaNone": "keine Änderung",
+      "deltaNoPrev": "nicht genügend vorherige Daten",
+      "kpiSessions": "Sitzungen",
+      "kpiErrorFree": "Fehlerfreie Sitzungen",
+      "kpiErrors": "Fehler gesamt",
+      "kpiUnhandled": "Unbehandelte Fehler",
+      "kpiRegion": "Wichtige Kennzahlen",
+      "sparkAria": "{label}: Trend im ausgewählten Zeitraum",
+      "chartTitle": "Sitzungen und Fehler",
+      "chartInterval": "pro Bucket",
+      "legendSessions": "Sitzungen",
+      "legendErrors": "Fehler",
+      "releaseMarker": "{version} erstmals gesehen: {time}",
+      "chartTableToggle": "Datentabelle anzeigen",
+      "chartTableHide": "Datentabelle ausblenden",
+      "chartTime": "Zeit",
+      "pagesTitle": "Zuerst zu behebende Seiten",
+      "pagesHint": "Nach Auswirkung sortiert: Traffic gewichtet nach dem Anteil der Aufrufe, bei denen ein Vital seinen Schwellenwert überschreitet oder ein Fehler auftritt. Klicken Sie auf eine Seite, um ihre Sitzungen zu sehen, oder auf eine Fehleranzahl für Error Tracking.",
+      "pagesColPage": "Seite",
+      "pagesColViews": "Aufrufe",
+      "pagesColErrors": "Fehler",
+      "pagesColImpact": "Auswirkung",
+      "pagesLegend": "▲ verbesserungswürdig · ■ schlecht · ohne Markierung gut. Seiten mit weniger als {n} Aufrufen werden ausgeblendet.",
+      "pagesOpenSessions": "Sitzungen für {path} öffnen",
+      "pagesOpenErrors": "{count} Fehler, Error Tracking öffnen | {count} Fehler, Error Tracking öffnen",
+      "pagesImpactAria": "Auswirkung {n} von 100",
+      "markNeeds": "verbesserungswürdig",
+      "markPoor": "schlecht",
+      "diffTitle": "Größter Unterschied",
+      "diffBody": "INP p75 ist {inp}, {ratio}x so hoch wie in den anderen Segmenten. Eine Korrelation zum Untersuchen, keine bewiesene Ursache.",
+      "diffNone": "In diesem Zeitraum hebt sich kein Segment von den anderen ab.",
+      "diffLink": "Betroffene Sitzungen anzeigen",
+      "segmentLabel": "Segment",
+      "segBrowser": "Browser",
+      "segDevice": "Gerät",
+      "segCountry": "Land",
+      "segInp": "INP {v}",
+      "segShare": "{n}% der Aufrufe",
+      "segNone": "Keine Daten für dieses Segment.",
+      "releaseTitle": "Release-Vergleich",
+      "releaseHint": "{cur} im Vergleich zu {prev}. Der Release-Start ist der Zeitpunkt, an dem eine Version erstmals gesehen wird.",
+      "releaseMetric": "Metrik",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Fehlerfrei",
+      "releaseSessions": "Sitzungen",
+      "releaseLink": "Fehler in {version}",
+      "frustrationTitle": "Nutzerfrustration",
+      "frustrationHint": "Probleme, die die Vitals nicht erfassen",
+      "rageClicks": "Rage-Klicks",
+      "deadClicks": "Klicks ohne Reaktion",
+      "stateLoading": "Lade {panel}…",
+      "stateEmptyTitle": "Keine Seitenaufrufe in diesem Zeitraum",
+      "stateEmptyBody": "Erweitern Sie den Zeitraum, entfernen Sie einen Filter oder prüfen Sie, ob das Browser-SDK Aufrufereignisse sendet.",
+      "stateEmptyAction": "SDK einrichten",
+      "stateLowTitle": "Nur {count} Seitenaufruf | Nur {count} Seitenaufrufe",
+      "stateLowBody": "Perzentile sind bei weniger als {min} Aufrufen unzuverlässig, daher wird die Bewertung ausgeblendet. Die Werte werden nur zur Information angezeigt.",
+      "stateErrorTitle": "Konnte {panel} nicht laden",
+      "stateErrorBody": "Die Abfrage ist fehlgeschlagen oder hat ein Timeout erreicht. Andere Panels sind nicht betroffen.",
+      "retry": "Erneut versuchen",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "Kennzahlen",
+      "panelPages": "Seiten",
+      "panelSegments": "Segmente",
+      "panelRelease": "Release-Vergleich",
+      "panelFrustration": "Nutzerfrustration",
+      "schemaErrorTitle": "Das RUM-Schema konnte nicht geladen werden",
+      "schemaErrorBody": "Die Stream-Felder konnten nicht gelesen werden, daher kann die Übersicht nicht entscheiden, welche Panels angezeigt werden.",
+      "pagesShowAll": "Alle {n} Seiten anzeigen",
+      "pagesShowFewer": "Weniger Seiten anzeigen",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Keine Seiten mit genügend Aufrufen",
+      "pagesEmptyBody": "Seiten benötigen in diesem Zeitraum mindestens {n} Aufrufe, um in die Rangliste aufgenommen zu werden.",
+      "segEmptyTitle": "Keine Segmentdaten",
+      "segEmptyBody": "Für diese Aufrufe wurden keine Werte für Browser, Gerät, Betriebssystem, Land oder Verbindung aufgezeichnet.",
+      "releaseEmptyTitle": "Zwei Versionen erforderlich",
+      "releaseEmptyBody": "Der Release-Vergleich benötigt mindestens zwei Versionen, die in diesem Zeitraum vorkommen.",
+      "releaseBefore": "{version} war bereits vor diesem Zeitraum live, daher wird der Zeitpunkt der ersten Sichtung nicht angezeigt.",
+      "pageErrorTitle": "Die Leistungsübersicht konnte nicht geladen werden",
+      "pageErrorBody": "Die Abfragen sind fehlgeschlagen oder haben das Zeitlimit überschritten. Erneut versuchen, um alle Panels zu laden.",
+      "verdictOver": "{vital} liegt bei {pct}% der Seitenaufrufe über dem guten Schwellenwert von {threshold}.",
+      "verdictAllThree": "Alle drei Core Web Vitals sind bei p75 erfüllt.",
+      "verdictAllSome": "Alle {n} bewerteten Core Web Vitals sind bei p75 erfüllt.",
+      "releaseNewErrors": "{count} neuer Fehler in diesem Release | {count} neue Fehler in diesem Release",
+      "verdictNoData": "Keine Core-Web-Vitals-Daten",
+      "verdictNoDataLead": "Keiner der {count} Seitenaufrufe in diesem Zeitraum hat LCP, INP oder CLS gemeldet. | Keiner der {count} Seitenaufrufe in diesem Zeitraum hat LCP, INP oder CLS gemeldet.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Sitzungen öffnen.",
+      "pagesTableLabel": "Seiten nach Auswirkung sortiert",
+      "verdictSessions": "{count} Sitzung im Zeitraum. | {count} Sitzungen im Zeitraum.",
+      "verdictCompare": "Im Vergleich zum vorherigen Zeitraum.",
+      "deltaLower": "{v} niedriger",
+      "deltaHigher": "{v} höher",
+      "forbiddenTitle": "Keine Berechtigung zum Anzeigen von {panel}",
+      "forbiddenBody": "Bitten Sie einen Administrator um Zugriff auf den RUM-Datenstream.",
+      "pageForbiddenTitle": "Keine Berechtigung zum Anzeigen der Leistungsübersicht",
+      "asideLabel": "Wo und was sich geändert hat",
+      "pagesAbout": "Über diese Rangfolge",
+      "chartPerFiveMinutes": "pro 5 Minuten",
+      "chartPerThirtyMinutes": "pro 30 Minuten",
+      "chartPerHour": "pro Stunde",
+      "chartPerSixHours": "pro 6 Stunden",
+      "chartPerDay": "pro Tag",
+      "chartIntervalOther": "pro Bucket",
+      "chartTableCaption": "Sitzungen und Fehler pro Bucket",
+      "deltaChange": "{delta} vs. vorherigem Zeitraum",
+      "deltaChangePts": "{delta} Punkte vs. vorherigem Zeitraum",
+      "deltaFlat": "Keine Änderung vs. vorherigem Zeitraum",
+      "deltaNewMsg": "Neu vs. vorherigem Zeitraum",
+      "verdictP75Note": "Das Urteil verwendet immer p75; p50 und p95 ändern nur die Werte.",
+      "releaseNote": "Vergleicht die beiden neuesten Versionen, unabhängig davon, was der Versionsfilter angibt.",
+      "kpiEmptyTitle": "Keine Sitzungen in diesem Zeitraum",
+      "kpiEmptyBody": "Erweitern Sie den Zeitraum oder löschen Sie einen Filter.",
+      "releaseImproved": "verbessert",
+      "releaseWorse": "verschlechtert",
+      "segOs": "OS",
+      "segConnection": "Verbindung",
+      "pagesAllLink": "Alle Seiten",
+      "pagesAllLinkAria": "Alle Seiten in der Produktanalyse",
+      "frustrationReplayLink": "Replay ansehen",
+      "frustrationReplayHint": "Öffnet die frustrierten Sitzungen in diesem Zeitraum; die aufgezeichneten haben ein Replay.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "In diesem Zeitraum wurde nichts aufgezeichnet. Erweitern Sie den Zeitraum oder richten Sie das Browser-SDK ein, falls diese App noch keine Daten gesendet hat.",
+      "stateEmptyFiltered": "In diesem Zeitraum entspricht nichts diesen Filtern. Löschen Sie die Filter, um alle Services, Umgebungen und Versionen zu sehen.",
+      "clearFilters": "Filter löschen",
+      "stateRefreshing": "{panel} wird aktualisiert",
+      "tileOpenSessions": "{label}: {value}. Sitzungen öffnen",
+      "tileOpenErrors": "{label}: {value}. Fehlerverfolgung öffnen",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Diese Übersicht zählt nur Browser-Sitzungen. Mobile-App-Metriken finden Sie unten.",
+      "mixedMobileNote": "Die Filter unten gelten nur für die Metriken der mobilen App."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Löschen",
     "confirmDeleteHead": "Benutzer löschen",
     "confirmDeleteMsg": "Möchten Sie den Benutzer {name} wirklich löschen?",
+    "block": "Blockieren",
+    "confirmBlockHead": "Benutzer blockieren",
+    "confirmBlockMsg": "{email} ist über Ihre verifizierte Domain beigetreten. Durch das Blockieren wird der Benutzer zu den Domain-Einschränkungen dieser Organisation hinzugefügt und aus dieser Organisation entfernt. Bei der nächsten Anmeldung wird er aus anderen zugeordneten Organisationen entfernt.",
     "cancel": "Abbrechen",
     "save": "Speichern",
     "ok": "OK",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Einladung widerrufen",
     "revokeInvitationMsg": "Sind Sie sicher, dass Sie die Einladung für {email} widerrufen möchten?",
     "deleteUsersTitle": "Benutzer löschen",
-    "deleteUsersMsg": "Möchten Sie wirklich {count} Benutzer löschen? | Möchten Sie wirklich {count} Benutzer löschen?"
+    "deleteUsersMsg": "Möchten Sie wirklich {count} Benutzer löschen? | Möchten Sie wirklich {count} Benutzer löschen?",
+    "deleteUsersBlockNote": "{count} von ihnen sind über Ihre verifizierte Domain beigetreten und werden blockiert statt gelöscht."
   },
   "invitation": {
     "pendingInvitations": "Ausstehende Einladungen",
@@ -3403,8 +3597,6 @@
       },
       "show": "Anzeigen",
       "searchPermissions": "Berechtigungen durchsuchen",
-      "filterModules": "Module filtern",
-      "noModuleMatch": "Kein Modul entspricht Ihrem Filter",
       "moduleScopeAll": "Alle",
       "moduleScopeGranted": "Ausgewählt",
       "noGrantedModule": "Noch kein Modul ausgewählt",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Berechtigung | Berechtigungen",
       "summaryReachSome": "{count} von {total}",
       "summaryEmptyTitle": "Diese Rolle gewährt noch nichts",
-      "summaryEmptyDescription": "Wählen Sie links ein Modul aus oder starten Sie mit einer Voreinstellung.",
+      "summaryEmptyDescription": "Starten Sie mit einer Voreinstellung oder wählen Sie Module aus der Liste.",
       "presetReadonlyTitle": "Schreibgeschützt",
       "presetReadonlyDescription": "Auflisten und Abrufen für jedes Modul",
       "presetDbmTitle": "Datenbanküberwachungs-Viewer",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "Keiner der {total} Kubernetes-Metrik-Streams existiert bisher in dieser Organisation, daher wurde nichts vorausgewählt.",
       "rumPresetSeeded": "Vorausgewählter Lesezugriff auf {matched} von {total} RUM-Streams, plus Source Maps und etwaige RUM-Product-Analytics-Berechtigungen. Vor dem Speichern prüfen.",
       "rumPresetNoMatch": "Keiner der {total} RUM-Streams existiert bisher in dieser Organisation, daher wurde auf ihnen nichts vorausgewählt; Source Maps und etwaige RUM-Product-Analytics-Berechtigungen wurden dennoch vorbereitet.",
-      "moduleGroupFleet": "Fleet"
+      "moduleGroupFleet": "Fleet",
+      "filterModulesTasks": "Module filtern",
+      "noModuleMatchQuery": "Kein Modul entspricht „{query}“",
+      "noModuleMatchHint": "Suchen Sie nach Modul, Gruppe oder Aufgabe, zum Beispiel slack, panel oder token.",
+      "presetAlertManagerTitle": "Alarm-Manager",
+      "presetAlertManagerDescription": "Alarme erstellen und verwalten, ihre Ziele und ihre Nachrichten",
+      "presetAlertViewerTitle": "Alarm-Viewer",
+      "presetAlertViewerDescription": "Alarme, Ziele und Vorlagen ansehen, ohne sie zu ändern",
+      "presetDashboardEditorTitle": "Dashboard-Editor",
+      "presetDashboardEditorDescription": "Dashboards erstellen und bearbeiten, mit Lesezugriff auf die Daten, die sie abfragen",
+      "presetDashboardViewerTitle": "Dashboard-Viewer",
+      "presetDashboardViewerDescription": "Dashboards öffnen und die Daten hinter ihren Panels lesen",
+      "presetPipelineEditorTitle": "Pipeline-Editor",
+      "presetPipelineEditorDescription": "Pipelines und Funktionen erstellen, mit Lesezugriff auf Streams und Anreicherungstabellen",
+      "presetApplied": "{title}: {permissions} hinzugefügt. Prüfen Sie die Änderungen vor dem Speichern.",
+      "presetPermissionCount": "{count} Berechtigung | {count} Berechtigungen",
+      "companionReasonAlertStreams": "um Alarme zu speichern. Der Server prüft beim Speichern den Zugriff auf Streams",
+      "companionReasonAlertDestinations": "um festzulegen, wohin Alarme gesendet werden",
+      "companionReasonDestinationTemplates": "um die Nachrichtenvorlage auszuwählen, die jedes Ziel benötigt",
+      "companionReasonDashboardStreams": "um Panel-Daten zu laden",
+      "presetsTitle": "Voreinstellungen",
+      "presetsClose": "Voreinstellungen schließen",
+      "presetsShow": "Voreinstellungen anzeigen",
+      "presetsSubtitle": "Fügen Sie dieser Rolle die Berechtigungen einer Voreinstellung hinzu. Es wird nichts entfernt.",
+      "presetsSectionBuiltin": "Integriert",
+      "presetsSectionJob": "Nach Tätigkeit",
+      "presetAddsTooltip": "Fügt {count} Berechtigung hinzu | Fügt {count} Berechtigungen hinzu",
+      "presetInRole": "In der Rolle",
+      "presetInRoleTooltip": "Diese Rolle hat bereits alles aus dieser Voreinstellung",
+      "presetBack": "Alle Voreinstellungen",
+      "presetModuleCount": "{count} Modul | {count} Module",
+      "presetSummaryAdds": "Fügt {permissions} in {modules} hinzu.",
+      "presetSummaryWrite": "Schreibzugriff in {modules}.",
+      "presetSummaryViewOnly": "Nur Ansicht: Es kann nichts erstellt, bearbeitet oder gelöscht werden.",
+      "presetSummaryHasAll": "Diese Rolle hat bereits alles aus dieser Voreinstellung.",
+      "presetSummarySkipped": "{count} Berechtigung, die diese Rolle bereits hat, wird übersprungen. | {count} Berechtigungen, die diese Rolle bereits hat, werden übersprungen.",
+      "presetStillMissing": "Fehlt nach dem Hinzufügen noch: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "Nach dem Hinzufügen fehlt nichts mehr.",
+      "neededBy": "Benötigt von {modules}",
+      "stillNeededBy": "Wird weiterhin benötigt von {modules}",
+      "presetReadsEveryStream": "Liest alle Streams in dieser Organisation, auch neue.",
+      "presetAddButton": "{count} Berechtigung hinzufügen | {count} Berechtigungen hinzufügen",
+      "presetNothingToAdd": "Nichts hinzuzufügen",
+      "presetApplyNote": "Hinzugefügte Berechtigungen werden zu ungespeicherten Änderungen. Prüfen Sie sie vor dem Speichern.",
+      "presetLoadingStreams": "Streams werden geladen",
+      "presetNoMatchingStreams": "In dieser Organisation gibt es noch keine passenden Streams.",
+      "reviewMissingTooltip": "{count} Modul fehlt, damit diese Rolle funktioniert | {count} Module fehlen, damit diese Rolle funktioniert",
+      "notAddedYetTitle": "Noch nicht hinzugefügt · {modules}",
+      "companionAdd": "Hinzufügen",
+      "companionAddItem": "{item} hinzufügen",
+      "companionAddAll": "Alle hinzufügen",
+      "companionOpenStreams": "Streams öffnen",
+      "companionOpenStreamsTooltip": "Wählen Sie, welche Streams diese Rolle lesen darf",
+      "companionNeeds": "{module} benötigt es, {reason}.",
+      "companionNeedsThis": "{module} benötigt dies, {reason}.",
+      "companionStillNeedsThis": "{module} benötigt dies weiterhin, {reason}.",
+      "yourChanges": "Ihre Änderungen",
+      "yourChangesCount": "{changes} in {modules}",
+      "yourChangesNone": "Noch keine",
+      "changeCount": "{count} Änderung | {count} Änderungen",
+      "changeOtherGroup": "Sonstiges",
+      "saveSuccessCounts": "{changes} in {modules} gespeichert.",
+      "effectCan": "Kann {target} {actions}.",
+      "effectCannot": "Kann {target} nicht mehr {actions}.",
+      "effectCanLoadDestinations": "Kann die Liste der Ziele laden.",
+      "effectCannotLoadDestinations": "Kann die Liste der Ziele nicht mehr laden.",
+      "effectCanLoadTemplates": "Kann die Liste der Vorlagen laden.",
+      "effectCannotLoadTemplates": "Kann die Liste der Vorlagen nicht mehr laden.",
+      "verbView": "ansehen",
+      "verbSeeListOf": "in der Liste sehen",
+      "verbList": "auflisten",
+      "verbOpen": "öffnen",
+      "verbCreate": "erstellen",
+      "verbEdit": "bearbeiten",
+      "verbDelete": "löschen",
+      "targetEveryStream": "jeden Stream (Logs, Metriken, Traces und Indizes), einschließlich neuer",
+      "targetTypeStreams": "alle {type}-Streams",
+      "targetOneStream": "den {type}-Stream {name}",
+      "targetAlertsEveryFolder": "Alarme in jedem Ordner, einschließlich neuer Ordner",
+      "targetAlertsInFolder": "Alarme im Ordner {name}",
+      "targetOneAlert": "den Alarm {name}",
+      "targetDashboardsEveryFolder": "Dashboards in jedem Ordner, einschließlich neuer Ordner",
+      "targetDashboardsInFolder": "Dashboards im Ordner {name}",
+      "targetOneDashboard": "das Dashboard {name}",
+      "targetReportsEveryFolder": "Berichte in jedem Ordner, einschließlich neuer Ordner",
+      "targetReportsInFolder": "Berichte im Ordner {name}",
+      "targetOneReport": "den Bericht {name}",
+      "targetEveryDestination": "jedes Alarmziel (Slack, E-Mail, Webhooks), einschließlich neuer",
+      "targetOneDestination": "das Ziel {name}",
+      "targetEveryTemplate": "jede Benachrichtigungsvorlage, einschließlich neuer",
+      "targetOneTemplate": "die Vorlage {name}",
+      "targetAllOf": "alle {module}, einschließlich neuer",
+      "targetItemIn": "{name} in {module}",
+      "noteDestinationsFiltered": "Sie sehen nur die Ziele, die sie auch öffnen können. Fügen Sie hier oder bei einzelnen Zielen „Holen“ hinzu, um festzulegen, welche.",
+      "noteTemplatesFiltered": "Sie sehen nur die Vorlagen, die sie auch öffnen können. Fügen Sie hier oder bei einzelnen Vorlagen „Holen“ hinzu, um festzulegen, welche.",
+      "presetStreamsFailed": "Die Stream-Liste konnte nicht geladen werden.",
+      "presetRetry": "Erneut versuchen",
+      "presetRestored": "{title}: {permissions} wiederhergestellt. Prüfen Sie die Änderungen vor dem Speichern.",
+      "presetSummaryRestores": "Behält {count} Berechtigung, die Sie zum Entfernen markiert haben. | Behält {count} Berechtigungen, die Sie zum Entfernen markiert haben.",
+      "presetRestoreButton": "{count} Berechtigung behalten | {count} Berechtigungen behalten",
+      "effectStillAllowed": "Keine Zugriffsänderung: Eine weiter gefasste Berechtigung erlaubt dies weiterhin."
     },
     "rolesPage": {
       "subtitle": "Rollen bündeln Berechtigungen — weisen Sie sie Benutzern, Dienstkonten oder Gruppen zu, um Zugriff zu gewähren.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Benutzer erfolgreich aktualisiert.",
       "userDeletedSuccess": "Benutzer erfolgreich gelöscht.",
       "errorDeletingUser": "Fehler beim Löschen des Benutzers.",
+      "userBlockedSuccess": "Benutzer erfolgreich blockiert.",
+      "errorBlockingUser": "Fehler beim Blockieren des Benutzers.",
+      "blockedButNotRemoved": "Der Benutzer wurde blockiert, konnte aber nicht aus dieser Organisation entfernt werden.",
+      "blockedUsersSuccess": "{count} Benutzer erfolgreich blockiert | {count} Benutzer erfolgreich blockiert",
+      "blockedUsersPartial": "{count} Benutzer blockiert und entfernt, aber {failed} konnte nicht aus dieser Organisation entfernt werden | {count} Benutzer blockiert und entfernt, aber {failed} konnten nicht aus dieser Organisation entfernt werden",
+      "blockedUsersNotRemoved": "{count} Benutzer blockiert, aber das Entfernen aus dieser Organisation war nicht möglich | {count} Benutzer blockiert, aber das Entfernen aus dieser Organisation war nicht möglich",
       "pleaseWait": "Bitte warten...",
       "invitationRevokedSuccess": "Einladung erfolgreich widerrufen.",
       "errorRevokingInvitation": "Fehler beim Widerrufen der Einladung.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Traces werden mit eBPF erfasst: Es sind keine Codeänderungen oder SDKs erforderlich. Trace-Kontext wird nur über Klartext-HTTP zwischen Diensten weitergegeben (bei Go-Apps auch über HTTPS, außer auf Nodes mit Kernel-Lockdown). Ein Prozess, der einem der Ports, dem Pfad der ausführbaren Datei oder der Befehlszeile entspricht, wird getraced; Glob-Muster dürfen `,`, `{'{'}` oder `{'}'}` nicht enthalten, und ein Port trifft auf jeden Prozess mit einem Socket auf diesem Port zu. Erfordert Helm 3.14+ und OpenTelemetry-Operator v0.142.0+; ist Ihrer älter, aktualisieren Sie ihn zuerst mit `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Wurde eBPF bereits mit einem älteren Operator aktiviert, führen Sie den Befehl erneut mit `--force` aus (`--force-replace` bei Helm 4). Wenn Sie den Installationsbefehl oben erneut ausführen, wird das Release zurückgesetzt und eBPF deaktiviert; führen Sie diesen Befehl danach erneut aus. Der Namespace `openobserve-collector` muss privilegierte Pods zulassen, und die Nodes müssen Linux auf amd64 oder arm64 mit Kernel 5.8+ (oder RHEL-Familie 4.18 mit eBPF-Backports) und BTF ausführen. Wählen Sie keine Apps aus, die bereits eigene Traces senden, und keine Pods, die den Go-Sidecar `inject-go` verwenden.",
       "k8sEbpfVariant": "eBPF (jede Sprache, keine Codeänderungen)",
       "k8sLibrariesVariant": "Sprachbibliotheken (Auto-Instrumentierung)",
+      "k8sNetworkFlowsDesc": "Das eBPF-DaemonSet des Collectors zeichnet auf jedem Linux-Knoten die **über beliebige TCP- oder UDP-Protokolle zwischen Workloads gesendeten Bytes** auf, einschließlich Datenbanken, Caches und anderer Dienste, die nicht getraced werden. Sie kommen als Metrik `obi_network_flow_bytes` an, mit dem Quell- und Ziel-Owner (Deployment, StatefulSet, Node, …) und dem Namespace als Labels versehen. Funktioniert mit und ohne eBPF-Tracing.",
+      "k8sNetworkFlowsNote": "Erfordert Helm 3.14+ und OpenTelemetry Operator v0.142.0+. Der Namespace `openobserve-collector` muss privilegierte Pods zulassen, und die Knoten müssen Linux auf amd64 oder arm64 mit Kernel 5.8+ (oder RHEL-Familie 4.18 mit eBPF-Backports) und BTF ausführen. Die eBPF-Pods laufen im Host-Netzwerk, und die eigenen Metriken des Collectors lauschen auf `127.0.0.1:8888` jedes Knotens, daher muss dieser Port dort frei sein. Bereits gesetzte eBPF-Trace-Selektoren bleiben erhalten. Ein erneutes Ausführen des obigen Installationsbefehls setzt das Release zurück und deaktiviert dies, daher führen Sie diesen Befehl anschließend erneut aus. Dieselben Bytes können mehrfach gemeldet werden: Datenverkehr zwischen Knoten von beiden Knoten sowie eine Verbindung zu einem Service, die sowohl dem Service als auch der dahinterliegenden Workload zugeordnet wird. Die Anleitung zu eBPF-Netzwerkflüssen erklärt, wie Sie diese ohne Doppelzählung abfragen.",
+      "k8sNetworkFlowsTitle": "Sehen Sie, welche Workloads miteinander kommunizieren: eBPF-Netzwerkflüsse",
       "k8sInstallerNote": "Dies installiert cert-manager, den OpenTelemetry-Operator und den OpenObserve-Collector automatisch.",
       "k8sInternalEndpointNote": "Verwenden Sie dies, wenn OpenObserve in diesem selben Cluster läuft – der Datenverkehr verlässt ihn nie.",
       "k8sTroubleAnnotationA": "Die Injektion erfolgt bei der Pod-Erstellung, daher bleiben bestehende Pods bis zu ihrem Neustart unberührt – führen Sie `kubectl rollout restart deployment -n my-namespace` aus. Bestätigen Sie mit `kubectl get ns my-namespace -o yaml`, dass die Annotation angekommen ist, und prüfen Sie, ob der Wert `openobserve-collector/openobserve-<language>` entspricht.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "Die Installation schlägt mit einem Fehler bezüglich des Admission-Webhooks fehl",
       "linuxAgentFixBody": "Der Installer startet den Agenten als systemd-Dienst. Wenn nichts ankommt, bestätigen Sie, dass er läuft, und lesen Sie seine Logs auf einen Authentifizierungs- oder Verbindungsfehler:",
       "linuxTracesNote": "Traces werden mit eBPF erfasst: Es sind keine Codeänderungen oder SDKs erforderlich. Ein Prozess, der einem der Ports, dem Pfad der ausführbaren Datei oder der Befehlszeile entspricht, wird getraced; Glob-Muster dürfen `,`, `{'{'}` oder `{'}'}` nicht enthalten. Tracing erfordert Linux 5.8+ (oder RHEL-Familie 4.18 mit eBPF-Backports) mit BTF; der Agent läuft dann als root. Wenn der Host nicht tracen kann, wird die Installation beendet und der laufende Agent bleibt unangetastet. Wenn der Agent anschließend mit aktiviertem Tracing nicht startet, wird es deaktiviert — ebenso Logs und Metriken —, bis Sie den Befehl **Logs & Metriken** erneut ausführen oder die Ursache beheben und mit Tracing erneut ausführen. Getracte Apps fügen ausgehenden Klartext-HTTP-Anfragen einen W3C-Header `traceparent` hinzu. Die folgende eBPF-Tracing-Anleitung behandelt HTTPS und wiederholte Flags.",
+      "linuxNetworkFlowsDesc": "Führen Sie den Installer mit `--network-flows` aus, um die **Bytes, die dieser Host über beliebige TCP- oder UDP-Protokolle sendet und empfängt**, als Metrik `obi_network_flow_bytes` zu melden. Jeder Fluss wird anhand der von Ihnen aufgelisteten Netzwerke mit `src_cidr` und `dst_cidr` gekennzeichnet; geben Sie daher jedem Host dieselbe Liste: Ein `/32`-Eintrag pro Host ergibt eine Host-zu-Host-Zuordnung.",
+      "linuxNetworkFlowsNote": "Erfordert Linux 5.8+ (oder RHEL-Familie 4.18 mit eBPF-Backports) mit BTF; der Agent läuft dann als root. Er funktioniert mit oder ohne Tracing, aber jeder Lauf des Installers ersetzt die Konfiguration des Agents: Um Tracing aktiviert zu lassen, fügen Sie die Flags `--trace-*` und `--service-name` aus dem Befehl **Logs, Metriken & eBPF-Traces** hinzu. Wenn der Host eBPF nicht ausführen kann, bricht die Installation ab und der laufende Agent bleibt unangetastet. Wenn sich die Netzwerkerfassung dann nicht starten lässt, wird der Agent deaktiviert – einschließlich Logs und Metriken –, bis Sie den Befehl **Logs & Metriken** erneut ausführen oder die Ursache beheben und mit `--network-flows` erneut ausführen. Datenverkehr zwischen zwei Hosts, die beide den Agenten ausführen, wird von jedem von ihnen gemeldet, und Loopback-Datenverkehr wird gezählt, sofern nicht beide Enden dieselbe Adresse haben. Die folgende Anleitung zu eBPF-Netzwerkflüssen erklärt die Labels und wie Sie diese ohne Doppelzählung abfragen.",
+      "linuxNetworkFlowsTitle": "Sehen Sie, welche Hosts miteinander kommunizieren: eBPF-Netzwerkflüsse",
       "linuxTracesVerifyNote": "Mit aktiviertem Tracing erscheinen Traces, sobald eine getracte Anwendung eine Anfrage verarbeitet.",
+      "ebpfNetworkFlowsGuideLink": "Anleitung zu eBPF-Netzwerkflüssen",
       "ebpfTracingGuideLink": "eBPF-Tracing-Anleitung",
       "logsMetricsTracesVariant": "Logs, Metriken & eBPF-Traces",
       "logsMetricsVariant": "Logs & Metriken",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Richten Sie einen beliebigen OpenTelemetry-Exporter auf OpenObserve aus — Collector oder SDK, HTTP oder gRPC. Ihr Endpunkt und Ihr Token sind unten ausgefüllt.",
       "taglineWindows": "Installieren Sie den OpenObserve-Agenten auf einem beliebigen Windows-Host — Ereignisprotokoll, Leistungsindikatoren und Host-Metriken.",
       "testAgain": "Erneut testen",
+      "networkFlowsHelp": "Einträge als CIDR oder CIDR=NAME, durch Kommas ohne Leerzeichen getrennt; jedes CIDR benötigt eine Präfixlänge, z. B. 10.0.1.5/32, und Namen dürfen nur Buchstaben, Ziffern, ., _ und - enthalten. Adressen, die keinem Eintrag entsprechen, bleiben ungekennzeichnet; 0.0.0.0/0=other benennt den Rest von IPv4, ::/0=other6 den Rest von IPv6.",
+      "networkFlowsLabel": "Zu kennzeichnende Netzwerke",
+      "networkFlowsRequired": "Geben Sie mindestens ein Netzwerk an: Flüsse werden mit den von Ihnen angegebenen Netzwerken gekennzeichnet.",
       "traceCmdHelp": "Für Python-, Node.js- und Java-Anwendungen.",
       "traceCmdLabel": "Befehlszeile",
       "traceExeLabel": "Pfad der ausführbaren Datei",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Zellen ausblenden unter",
     "heatmapHideBelowTooltip": "Zellen mit einem kleineren Wert bleiben leer.",
     "heatmapHideBelowNote": "Zellen unter {value} sind ausgeblendet",
+    "boxplotWhisker": "Whisker",
+    "boxplotWhiskerMinMax": "Minimum bis Maximum",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Nachrichtenfeld",
+    "logsLevelField": "Level-Feld",
+    "logsTimeField": "Zeitfeld",
+    "htmlPanelFieldTooltip": "Leer lassen, um die Spalte aus den Abfrageergebnissen zu erkennen",
+    "logsOrder": "Reihenfolge",
+    "logsOrderNewest": "Neueste zuerst",
+    "logsOrderOldest": "Älteste zuerst",
+    "logsOrderTooltip": "Sortiert die Zeilen, die die Abfrage liefert. Eine unveränderte Startabfrage wird ebenfalls in dieser Reihenfolge geladen, sodass „Älteste zuerst“ die frühesten Logs zeigt.",
+    "logsShowTime": "Zeit anzeigen",
+    "logsWrap": "Zeilen umbrechen",
+    "logsPrettifyJson": "JSON formatieren",
     "distributionBucketCount": "Anzahl der Klassen",
     "distributionBucketSize": "Klassenbreite",
     "distributionBucketSizeTooltip": "Breite jeder Klasse in den Einheiten des Felds. Wenn gesetzt, ersetzt sie die Anzahl der Klassen.",
@@ -7822,6 +8145,8 @@
       "gauge": "Messanzeige",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Boxplot",
+      "logs": "Logs",
       "barGauge": "Balkenanzeige",
       "distribution": "Verteilung",
       "treemap": "Treemap",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: Fehlendes erforderliches Argument an Position {index}.",
       "fieldNotAllowedForMetric": "Das Feld {label} ist für Metric-Diagramme nicht zulässig.",
       "rawValueSampled": "Basierend auf den ersten {count} Zeilen",
+      "addAtMostOneFieldFor": "Fügen Sie höchstens ein Feld für {label} hinzu",
+      "boxplotMin": "Min",
+      "boxplotMax": "Max",
+      "boxplotLowerWhisker": "Unterer Whisker",
+      "boxplotUpperWhisker": "Oberer Whisker",
+      "boxplotMedian": "Median",
+      "boxplotSamples": "Stichproben",
+      "boxplotOutlier": "Ausreißer",
       "fieldNotAllowedForDistribution": "Das Feld {label} ist für das Verteilungsdiagramm nicht zulässig",
       "distributionCount": "Anzahl",
       "addAtLeastOneFieldFor": "Fügen Sie mindestens ein Feld für {label} hinzu.",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Kein Zugriff",
       "urlHiddenHint": "Sie können das Dashboard dieses Links nicht ansehen, daher ist seine öffentliche URL ausgeblendet.",
       "orgDisabledHint": "Öffentliche Links sind für diese Organisation deaktiviert",
+      "orgDisabledBanner": "Öffentliche Links sind für diese Organisation deaktiviert, daher wird kein Link bereitgestellt. Ein Administrator kann sie wieder aktivieren.",
+      "disabledPaused": "Deaktiviert · Pausiert",
       "takeOver": "Übernehmen",
       "takeOverTitle": "Diesen Link übernehmen?",
       "takeOverBody": "Sie werden zum Herausgeber. Die öffentliche Seite zeigt, was Sie sehen dürfen. Das kann mehr oder weniger sein als bisher. Wer die URL hat, behält den Zugriff, und der Link ist ab sofort aktiv.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Gruppe",
     "wellSubgroup": "Untergruppe",
     "wellSize": "Größe",
+    "wellCategory": "Kategorie",
     "value": "Wert"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Verschieben Sie den Auslösewert weg vom beobachteten stationären Zustand.",
       "lengthenEvaluationWindow": "Auswertungsfenster verlängern",
       "lengthenEvaluationWindowDesc": "Erweitern Sie den Zeitraum, damit ein kurzer Ausschlag den Alarm nicht mehr auslöst.",
-      "enableDeduplication": "Deduplizierung aktivieren",
-      "enableDeduplicationDesc": "Fassen Sie wiederholte Auslösungen innerhalb eines Deduplizierungsfensters zusammen.",
+      "enableDeduplication": "Wiederholungen unterdrücken aktivieren",
+      "enableDeduplicationDesc": "Einmal pro Statusänderung benachrichtigen statt bei jeder Auswertung.",
       "reviewForDeletion": "Zur Löschung prüfen",
       "reviewForDeletionDesc": "Bestätigen Sie, dass die Abfrage noch der Realität entspricht, bevor Sie den Alarm außer Betrieb nehmen.",
       "fixAlertQuery": "Alarmabfrage korrigieren",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "Organisations-ID",
     "alertCreationTitle": "Alarmerstellung",
     "noAlertsFound": "Keine Alarme gefunden",
-    "suppressedByDeduplication": "Durch Deduplizierung unterdrückt",
-    "occurrence": "{count} Vorkommen | {count} Vorkommen",
     "groupedNotification": "Gruppierte Benachrichtigung",
     "alertsBatchedTogether": "Alarme zusammen gebündelt",
-    "notificationSent": "Benachrichtigung gesendet",
-    "occurrencesDeduplicated": "Vorkommen dedupliziert",
     "alertExecutionDetails": "Details zur Alarmausführung",
     "evaluationTime": "Auswertungszeit",
     "queryTime": "Abfragezeit",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "Bis: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Zeitliche Korrelation",
     "serviceGraphTooltipServiceDependency": "Service-Abhängigkeit",
-    "totalAlerts": "Alarme gesamt",
-    "usingDeduplication": "Mit Deduplizierung",
-    "deduplicationConfiguredTooltip": "Alarme mit konfigurierter Deduplizierung",
-    "suppressionRate24h": "Unterdrückungsrate (24h)",
     "suppressed": "unterdrückt /",
-    "total": "gesamt",
-    "passedLabel": "Bestanden:",
-    "pendingBatches": "Ausstehende Stapel",
-    "pendingBatchesTooltip": "Alarme, die darauf warten, gruppiert zu werden",
     "historyTimeline": {
       "firing": "Ausgelöst",
       "ok": "OK",
@@ -10089,7 +10413,8 @@
     "endTime": "Endzeit",
     "duration": "Dauer",
     "retries": "Wiederholungen",
-    "dedup": "Dedup",
+    "suppression": "Unterdrückung",
+    "suppressedAsRepeat": "Als Wiederholung unterdrückt",
     "validation": {
       "streamTypeRequired": "Stream-Typ ist erforderlich.",
       "streamNameRequired": "Stream-Name ist erforderlich.",
@@ -10281,15 +10606,6 @@
     "all": "Alle",
     "history": "Alarmverlauf",
     "searcHistory": "Alarmnamen eingeben",
-    "deduplication": {
-      "fingerprintFields": "Ähnliche Alarme gruppieren nach",
-      "fingerprintFieldsHint": "Wählen Sie Felder aus, die für die Deduplizierung verwendet werden sollen. Lassen Sie das Feld leer, um die automatische Erkennung anhand des Abfragetyps zu ermöglichen.",
-      "fingerprintFieldsTooltip": "Wählen Sie, welche Felder übereinstimmen müssen, damit Alarme als Duplikate gelten. Wenn Sie z. B. 'hostname' auswählen, werden Alarme vom selben Host gruppiert. Verschiedene Alarmtypen (z. B. hohe CPU-Auslastung und hoher Arbeitsspeicher) werden nie gruppiert, auch wenn sie vom selben Host stammen. Leer lassen für die automatische Erkennung anhand Ihres Abfragetyps.",
-      "timeWindow": "Zeitfenster (Minuten)",
-      "timeWindowHint": "Wie lange dauert es, die Fingerabdrücke von Alarmen zu verfolgen. Lassen Sie das Feld leer, um den Alarmzeitraum zu verwenden.",
-      "timeWindowTooltip": "Wie lange aktuelle Alarme für die Gruppierung gemerkt werden. Tritt innerhalb dieser Zeit ein ähnlicher Alarm auf, wird er nicht erneut gesendet. Leer lassen, um das Prüfintervall Ihres Alarms zu verwenden.",
-      "fingerprintFieldsHelp": "Leer lassen für automatische Erkennung basierend auf Abfrage (SQL: GROUP BY-Spalten, PromQL: Labels, Benutzerdefiniert: Bedingungsfelder)"
-    },
     "summary": {
       "scrollToBottom": "Nach unten scrollen",
       "title": "Zusammenfassung",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Mich benachrichtigen, wenn die konfigurierten Bedingungen erfüllt sind"
       }
     },
-    "correlation": {
-      "title": "Alarmkorrelation",
-      "description": "Konfigurieren Sie, wie Alarme in der gesamten Organisation korreliert und dedupliziert werden. Alarme mit übereinstimmenden Fingerabdruckwerten werden gruppiert.",
-      "semanticFieldNote": "Hinweis: Semantische Feldzuordnungen werden auf der Registerkarte Service Identity konfiguriert.",
-      "enableOrgLevel": "Deduplizierung auf Organisationsebene aktivieren",
-      "enableOrgLevelTooltip": "Deduplizierungs- und Korrelationsfunktionen für alle Alarme in dieser Organisation aktivieren",
-      "enableCrossAlert": "Alarmübergreifende Deduplizierung aktivieren",
-      "enableCrossAlertTooltip": "Erlauben Sie verschiedenen Benachrichtigungen, sich gegenseitig zu deduplizieren, wenn sie denselben Fingerabdruck verwenden",
-      "fingerprintGroups": "Alarmübergreifende Fingerabdruckgruppen",
-      "fingerprintGroupsTooltip": "Wählen Sie aus, welche semantischen Gruppen für alarmübergreifende Fingerabdrücke verwendet werden sollen. Alarme werden dedupliziert, wenn sie dieselben Werte für diese Dimensionen aufweisen.",
-      "fingerprintGroupsHint": "Wählen Sie mindestens eine semantische Gruppe für die alarmübergreifende Deduplizierung aus",
-      "fingerprintGroupsRequired": "Es muss mindestens eine semantische Gruppe ausgewählt werden",
-      "defaultWindow": "Standardkorrelationsfenster (Minuten)",
-      "defaultWindowTooltip": "Wenn kein semantisches Feld übereinstimmt, werden Alarme und Daten aus der angegebenen Dauer als zusammengehörig betrachtet.",
-      "defaultWindowDescription": "Wenn kein semantisches Feld übereinstimmt, werden Alarme und Daten aus der angegebenen Dauer als zusammengehörig betrachtet.",
-      "defaultWindowPlaceholder": "Standardmäßig den Alarmzeitraum verwenden",
-      "cancelButton": "Stornieren",
-      "saveButton": "Einstellungen speichern",
-      "settingsSaved": "Organisations-Deduplizierungseinstellungen erfolgreich gespeichert",
-      "settingsSaveError": "Einstellungen konnten nicht gespeichert werden"
-    },
     "placeholders": {
       "typeSomething": "Etwas eingeben",
       "value": "Wert",
       "selectColumn": "Wählen Sie eine Spalte",
       "savedFunctions": "Gespeicherte Funktionen",
-      "autoUsesCheckInterval": "Auto (verwendet Prüfintervall)",
       "addTag": "Tag hinzufügen und Enter drücken"
     },
     "steps": {
       "compareWithPast": "Mit der Vergangenheit vergleichen",
-      "deduplication": "Deduplizierung",
       "advanced": "Fortgeschritten"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Was soll den Alarm auslösen?",
       "compareWithPast": "Aktuelle Ergebnisse mit Daten aus einem anderen Zeitraum vergleichen",
       "alertSettings": "Legen Sie Ihre Alarmregeln fest und wählen Sie aus, wie Sie benachrichtigt werden möchten.",
-      "deduplication": "Vermeiden Sie es, denselben Alarm mehrmals zu senden, indem Sie ähnliche Alarme zu Gruppen zusammenfassen.",
       "advanced": "Kontextvariablen, Beschreibung und Zeilenvorlage"
     },
     "failedToFetchHistory": "Der Alarmverlauf konnte nicht abgerufen werden",
@@ -10399,8 +10691,6 @@
         "closeActions": "Aktionen schließen",
         "viewAlertHistory": "Alarmverlauf anzeigen",
         "actionsFor": "Aktionen für:",
-        "configureDedup": "Dedup konfigurieren",
-        "configureDedupTooltip": "Deduplizierung für diesen Alarm konfigurieren",
         "editAlert": "Alarm bearbeiten",
         "editAlertTooltip": "Alarmkonfiguration bearbeiten",
         "viewHistory": "Verlauf ansehen",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "neue \"Behoben\"-Nachricht",
       "keepFiringFor": "Weiter auslösen für",
       "keepFiringForTooltip": "So lange warten, nachdem die Bedingung nicht mehr erfüllt ist, bevor die Wiederherstellung erfolgt. 0 stellt sofort wieder her.",
+      "suppressRepeats": "Wiederholungen unterdrücken",
+      "suppressRepeatsTooltip": "Einmal benachrichtigen, wenn der Alarm ausgelöst wird oder die Stufe wechselt, nicht bei jeder Auswertung. Lassen Sie es ausgeschaltet, um nach jeder Stummschaltung weiterhin Erinnerungen zu erhalten.",
       "keepFiringForInvalid": "Geben Sie 0 oder mehr Sekunden ein",
       "keepFiringForTooLong": "Geben Sie höchstens 86400 Sekunden (24 Stunden) ein"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Diese E-Mail-Adresse wurde bereits hinzugefügt",
     "confirmRemoveEmail": "Möchten Sie die E-Mail-Adresse {email} wirklich entfernen?",
     "domainNeedsEmails": "Domain '{domain}' muss mindestens eine E-Mail-Adresse haben, wenn nicht alle Benutzer zugelassen werden",
+    "noAllowedEmailsDenyAll": "Es sind noch keine E-Mail-Adressen erlaubt, daher wird jeder Benutzer von {domain} abgewiesen.",
     "domainSettingsSaved": "Die Domain-Einstellungen wurden erfolgreich gespeichert",
     "errorSavingDomainSettings": "Fehler beim Speichern der Domain-Einstellungen",
     "noDomainMessage": "Keine Domänen konfiguriert. Fügen Sie oben die Domains hinzu, um den Zugriff einzuschränken.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Konfigurieren Sie mindestens einen Identitätssatz, bevor Sie speichern.",
       "discoveredServicesTab": "Entdeckte Dienste",
       "serviceDiscoveryTab": "Erkennungsregeln",
-      "alertCorrelationTab": "Alarmgruppierung",
       "fieldAliasesTab": "Feldzuordnungen",
       "fieldAliasesSaved": "Feldaliasse erfolgreich gespeichert",
       "fieldAliasesSaveError": "Feldaliasse konnten nicht gespeichert werden",
@@ -14079,27 +14371,144 @@
     "runsIn": "Läuft in",
     "recommendedByFieldCoverage": "Empfohlen basierend auf der Feldabdeckung in Ihren Streams.",
     "listConjunctionAndTwo": "{first} und {last}",
-    "domainOrgMappings": {
-      "title": "Zuordnungen von Domänen zu Organisationen",
-      "subtitle": "Neue Benutzer, die sich mit einer passenden E-Mail-Domain anmelden, werden automatisch zur Organisation hinzugefügt.",
+    "orgDomainMapping": {
+      "tabLabel": "Domain-Verwaltung",
+      "tabDesc": "Verknüpfen Sie Ihre E-Mail-Domains, ordnen Sie deren Benutzer Organisationen zu und steuern Sie, wer beitreten darf.",
+      "loadFailed": "Organisationseinstellungen konnten nicht geladen werden",
       "addMapping": "Zuordnung hinzufügen",
       "editMapping": "Zuordnung bearbeiten",
-      "empty": "Noch keine Zuordnungen. Verwenden Sie „{addLabel}“, um eine hinzuzufügen.",
       "domain": "E-Mail-Domain",
-      "domainHelp": "Der Teil nach {at_sign} in der E-Mail-Adresse des Benutzers.",
+      "domainHelp": "Der Teil nach {at_sign} in der E-Mail-Adresse des Benutzers. Die Domain wird mit dieser Organisation verknüpft und muss über DNS verifiziert werden.",
+      "domainHelpRequest": "Der Teil nach {at_sign} in der E-Mail-Adresse des Benutzers. Die Domain wird mit dieser Organisation verknüpft, sobald OpenObserve die Anfrage genehmigt.",
       "organization": "Organisation",
-      "organizationPlaceholder": "Organisationskennung",
-      "organizationHelp": "Die Kennung der Organisation, zu der passende Benutzer hinzugefügt werden.",
+      "organizationHelp": "Diese Organisation oder eines der Mitglieder ihrer Abrechnungsgruppe.",
       "organizationRequired": "Organisation ist erforderlich",
       "baseRole": "Basisrolle",
-      "baseRoleHelp": "Die Rolle, die passende Benutzer in dieser Organisation erhalten.",
+      "baseRoleHelp": "Die Rolle, die vergeben wird, wenn ein Benutzer zu dieser Organisation hinzugefügt wird. Bestehende Mitglieder behalten ihre aktuelle Rolle.",
       "roleClaimName": "Rollen-Claim",
       "roleClaimNamePlaceholder": "Claim-Name, z. B. groups",
-      "roleClaimNameHelp": "Optional. Token-Claim mit den benutzerdefinierten Rollen des Benutzers; bei jeder Anmeldung werden seine benutzerdefinierten Rollen in dieser Organisation daran angeglichen.",
-      "createMissingRoles": "Im Claim genannte Rollen erstellen, die in der Organisation nicht existieren",
-      "duplicateDomain": "Für diese Domain existiert bereits eine Zuordnung",
-      "confirmRemove": "Sind Sie sicher, dass Sie die Zuordnung für {name} löschen möchten?",
-      "deleteTitle": "Zuordnung löschen"
+      "roleClaimNameHelp": "Optional. SSO-Token-Claim, der die benutzerdefinierten Rollen des Benutzers auflistet. Bei jeder SSO-Anmeldung werden die benutzerdefinierten Rollen in dieser Organisation durch die im Claim angegebenen ersetzt; im Claim angegebene Rollen, die nicht existieren, werden übersprungen, es sei denn, sie werden erstellt.",
+      "createMissingRoles": "Im Claim angegebene Rollen erstellen, die in der Organisation nicht existieren",
+      "verifyNow": "Jetzt verifizieren",
+      "details": "Details",
+      "detailsDialogTitle": "Verknüpfungsdetails für {domain}",
+      "approvedLinkInfo": "Von OpenObserve nach einer Verknüpfungsanfrage verknüpft. Es ist kein DNS-Eintrag erforderlich.",
+      "pendingRequestInfo": "OpenObserve prüft diese Anfrage. Bis zur Genehmigung ist nichts zu tun.",
+      "rejectedRequestInfo": "OpenObserve hat diese Anfrage abgelehnt.",
+      "verifyDialogTitle": "{domain} verifizieren",
+      "recordDialogTitle": "DNS-Eintrag für {domain}",
+      "lastCheckFailed": "Letzte Prüfung fehlgeschlagen: {reason}",
+      "state": {
+        "pending": "Ausstehend",
+        "verified": "Verifiziert",
+        "failed": "Fehlgeschlagen",
+        "requested": "Warten auf Genehmigung",
+        "approved": "Genehmigt",
+        "rejected": "Abgelehnt"
+      },
+      "saved": "Domänenzuordnung gespeichert",
+      "saveFailed": "Einstellungen konnten nicht gespeichert werden",
+      "linkFailed": "Die Domäne konnte nicht verknüpft werden",
+      "unlinkFailed": "Die Verknüpfung der Domäne konnte nicht aufgehoben werden",
+      "verifyFailed": "Verifizierung fehlgeschlagen",
+      "deleted": "Zuordnung entfernt",
+      "deleteTitle": "Zuordnung entfernen?",
+      "deleteMappingBody": "Benutzer von {domain} werden bei der Anmeldung nicht mehr zu {org} hinzugefügt.",
+      "recordInstructions": "Fügen Sie diesen DNS-TXT-Eintrag bei Ihrem DNS-Anbieter hinzu:",
+      "txtNameLabel": "Eintragsname",
+      "txtValueLabel": "Eintragswert",
+      "copyTxtName": "Eintragsnamen kopieren",
+      "copyTxtValue": "Eintragswert kopieren",
+      "txtNameCopied": "Eintragsname kopiert",
+      "txtValueCopied": "Eintragswert kopiert",
+      "verifyHint": "Die Verifizierung erfolgt automatisch alle {minutes} Minuten. Sie können auch jetzt verifizieren.",
+      "alreadyLinked": "Diese Domäne ist bereits mit dieser Organisation verknüpft",
+      "failureReason": {
+        "recordMissing": "TXT-Eintrag nicht gefunden",
+        "valueMismatch": "TXT-Eintrag gefunden, aber der Wert stimmt nicht überein",
+        "dnsFailed": "DNS-Auflösung fehlgeschlagen"
+      },
+      "pageSubtitle": "Verknüpfen Sie Ihre E-Mail-Domänen, ordnen Sie deren Benutzer Organisationen zu und steuern Sie, welche davon beitreten können.",
+      "linkedTab": "Verknüpfte Domänen",
+      "mappingsTab": "Zuordnungen",
+      "accessTab": "Blockierte Benutzer",
+      "requestsTab": "Verknüpfungsanfragen",
+      "linkDomain": "Domäne verknüpfen",
+      "sendRequest": "Anfrage senden",
+      "linkMethod": "So weisen Sie die Inhaberschaft nach",
+      "method": {
+        "dns": "DNS-Eintrag",
+        "approved": "Genehmigte Anfrage",
+        "request": "Verknüpfungsanfrage",
+        "dnsTitle": "DNS-TXT-Eintrag hinzufügen",
+        "dnsDesc": "Wird automatisch verifiziert, sobald der Eintrag veröffentlicht ist. Am besten, wenn Sie das DNS der Domäne verwalten.",
+        "requestTitle": "Verknüpfung bei OpenObserve anfragen",
+        "requestDesc": "Unser Team prüft die Anfrage und verknüpft die Domäne nach der Genehmigung."
+      },
+      "searchDomains": "Domänen suchen",
+      "searchMappings": "Nach Domäne oder Organisation suchen",
+      "searchRequests": "Nach Domäne, Organisation oder Antragsteller suchen",
+      "status": "Status",
+      "linkedVia": "Verlinkt über",
+      "lastChecked": "Zuletzt geprüft",
+      "linked": "Domain verlinkt. Fügen Sie den DNS-Eintrag hinzu, um sie zu verifizieren.",
+      "verified": "Domain verifiziert",
+      "notVerifiedYet": "Der DNS-Eintrag wurde noch nicht gefunden. Die Propagierung kann eine Weile dauern.",
+      "requestSent": "Verknüpfungsanfrage gesendet",
+      "requestFailed": "Die Verknüpfungsanfrage konnte nicht gesendet werden",
+      "keepRecordHint": "Lassen Sie diesen Eintrag bestehen. Der Eigentümernachweis wird alle {minutes} Minuten erneut geprüft; fehlt der Eintrag länger als {grace} Minuten, wird die Domain als fehlgeschlagen markiert und ihre Zuordnungen werden nicht mehr angewendet.",
+      "removeDomain": "Domain entfernen",
+      "removeTitle": "Domain entfernen?",
+      "removeBody": "{domain} wird von dieser Organisation getrennt.",
+      "removeWithMappingsBody": "{domain} wird von dieser Organisation getrennt und ihre {count} Zuordnung wird entfernt. | {domain} wird von dieser Organisation getrennt und ihre {count} Zuordnungen werden entfernt.",
+      "removed": "Domain entfernt",
+      "domainRequired": "Domain ist erforderlich",
+      "mappingDomainHelp": "Nur verifizierte Domains können zugeordnet werden.",
+      "createsRoles": "Erstellt Rollen",
+      "duplicateMapping": "Diese Domain ist bereits dieser Organisation zugeordnet",
+      "domainNotVerified": "Nicht verifiziert",
+      "noVerifiedDomains": "Zuordnungen gelten für verifizierte Domains. Verknüpfen und verifizieren Sie zuerst eine Domain.",
+      "goToLinked": "Domain verknüpfen",
+      "goToLinkedDesc": "Verifizieren Sie eine Domain, die Ihnen gehört, bevor Sie ihre Benutzer zuordnen",
+      "enforceTitle": "Benutzer aus anderen Organisationen entfernen",
+      "enforceDesc": "Wenn sich ein Benutzer einer zugeordneten Domain über SSO anmeldet, wird er aus jeder Organisation außerhalb dieser und ihrer Abrechnungsgruppe entfernt.",
+      "enforceConfirmTitle": "Benutzer aus anderen Organisationen entfernen?",
+      "enforceConfirmBody": "Jedes Mal, wenn sich ein Benutzer, dessen E-Mail-Domain hier zugeordnet ist, über SSO anmeldet, wird er aus jeder Organisation entfernt, die nicht diese ist oder zu ihrer Abrechnungsgruppe gehört, einschließlich seiner persönlichen Organisationen.",
+      "enforceConfirmAction": "Aktivieren",
+      "enforceSaved": "Einstellung gespeichert",
+      "blockUsers": "Benutzer blockieren",
+      "editBlockedUsers": "Blockierte Benutzer bearbeiten",
+      "block": "Blockieren",
+      "blockedCount": "{count} blockiert | {count} blockiert",
+      "blockedEmails": "Blockierte E-Mail-Adressen",
+      "blocklistDomainHelp": "Eine der verifizierten Domains dieser Organisation.",
+      "blocklistEmailsHelp": "Diese Benutzer können über SSO weder dieser Organisation noch Mitgliedern ihrer Abrechnungsgruppe beitreten und werden bei ihrer nächsten Anmeldung daraus entfernt.",
+      "ruleBlockedRequired": "Fügen Sie mindestens eine E-Mail-Adresse zum Blockieren hinzu",
+      "noDomainForBlocklist": "Jede verifizierte Domain hat bereits blockierte Benutzer. Bearbeiten Sie die jeweilige Zeile, um sie zu ändern.",
+      "unblockAll": "Alle entsperren",
+      "unblockAllTitle": "Blockierung für alle Benutzer aufheben?",
+      "unblockAllBody": "Jeder blockierte Benutzer von {domain} kann bei seiner nächsten SSO-Anmeldung wieder beitreten.",
+      "blocklistSaved": "Blockierte Benutzer gespeichert",
+      "blocklistDeleted": "Benutzer entsperrt",
+      "blocklistSection": "Blockierte Benutzer nach Domain",
+      "filterPending": "Ausstehend",
+      "filterAll": "Alle",
+      "requestedBy": "Angefragt von",
+      "requestedAt": "Angefragt am",
+      "verifiedAt": "Verifiziert",
+      "answeredBy": "Beantwortet von",
+      "reason": "Grund",
+      "reasonHelp": "Wird der Organisation angezeigt, die die Anfrage gestellt hat.",
+      "reasonRequired": "Ein Grund ist erforderlich, um eine Anfrage abzulehnen",
+      "approve": "Genehmigen",
+      "reject": "Ablehnen",
+      "approveTitle": "Link-Anfrage genehmigen?",
+      "rejectTitle": "Link-Anfrage ablehnen?",
+      "approveBody": "{domain} wird ohne DNS-Prüfung mit {org} verknüpft.",
+      "rejectBody": "{org} erhält {domain} nicht.",
+      "requestApproved": "{domain} verknüpft",
+      "requestRejected": "Anfrage für {domain} abgelehnt",
+      "decisionFailed": "Anfrage konnte nicht aktualisiert werden"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Bitte wählen Sie eine Option für „Erkennen bei“"
   },
   "search_history": {
-    "title": "Suchverlauf",
+    "title": "Nutzungs- und Kostenverlauf",
     "get_history": "Verlauf abrufen",
     "executed_at": "Ausgeführt am",
     "sql_query": "SQL-Abfrage",
-    "delayMessage": "Der Suchverlauf könnte sich verzögern um"
+    "delayMessage": "Der Nutzungs- und Kostenverlauf kann sich verzögern um"
   },
   "correlation": {
     "unstableDimensionNote": "Instabile Dimension - Änderungen beim Pod-Neustart. Standard: Alle Werte.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Die Daten sind frisch",
     "dataGettingStale": "Daten werden veraltet",
     "dataStale": "Daten sind veraltet",
-    "lastRefreshed": "Zuletzt aktualisiert: {time}"
+    "lastRefreshed": "Zuletzt aktualisiert: {time}",
+    "refresh": "Aktualisieren",
+    "refreshWithAge": "Aktualisieren, zuletzt aktualisiert {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Probe-Fehler"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "Klicken",
       "actionType": "Eingabe",
       "all": "Alle",
@@ -19868,6 +20280,13 @@
       "attemptN": "Versuch {n}",
       "detailAction": "Aktion",
       "detailSelector": "Selektor",
+      "detailStepId": "Schritt-ID",
+      "detailTargetUrl": "Ziel-URL",
+      "detailStatus": "Status",
+      "detailSkipReason": "Grund für Überspringen",
+      "stepStatusSkipped": "Übersprungen",
+      "stepStatusUnknown": "Unbekannt",
+      "skippedCount": "{n} übersprungen",
       "downloadTrace": "{filename} herunterladen",
       "errorFullscreenTitle": "Schritt {id}: {action} - Fehler",
       "failedAtStartLoad": "Öffnen der Start-URL fehlgeschlagen",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Maximum {max}. Wiederholungen laufen im selben Job, daher muss die gesamte Sequenz in das Check-Budget passen.",
       "retriesMaxBrowserHint": "Maximum {max} für Browser-Checks. Jeder Versuch führt den Durchlauf auf jedem Gerät erneut aus, daher würde eine höhere Anzahl das Probe-Timeout überschreiten und einen Fehler melden, den Ihre Website nie hatte.",
       "retryDelay": "Zwischen den Wiederholungsversuchen",
-      "retryDelaySuffix": "ms warten.",
+      "retryDelaySuffix": "Sekunden zwischen den Wiederholungsversuchen.",
       "schedule": "Zeitplan",
       "scheduleLater": "Später planen",
       "scheduleLaterTooltip": "Wählen Sie ein Datum und eine Uhrzeit in der Zukunft, um den Scheck zu aktivieren.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Neustartkonfiguration – kopieren Sie den Setup-Befehl dieses Agenten, um die Installation / den Docker-Neustart erneut auszuführen (z. B. nach einer Token-Rotation).",
         "noAgents": "Es haben sich noch keine Agenten für diesen Standort registriert.",
         "agentsUnavailable": "Die Agenten dieses Standorts sind bei einem anderen Cluster registriert und hier nicht sichtbar.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Von diesem Standort ausgeführte Prüfungen",
         "checkName": "Name",
         "noChecks": "Diesem Standort sind noch keine Prüfungen zugewiesen.",
@@ -20546,7 +20967,7 @@
       "nodes": "Knoten",
       "modelPricing": "Preismodell",
       "searchSchedulers": "Scheduler suchen",
-      "searchHistory": "Suchverlauf",
+      "searchHistory": "Nutzungs- und Kostenverlauf",
       "sessions": "Sessions",
       "evalTemplates": "Online-Evals — Vorlagen",
       "scorers": "Online-Evals — Scorer",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Liste aktualisieren",
       "alertTemplatesAdd": "Neue Vorlage hinzufügen",
       "alertTemplatesRefresh": "Liste aktualisieren",
-      "logsSearchHistory": "Suchverlauf öffnen",
+      "logsSearchHistory": "Nutzungs- und Kostenverlauf öffnen",
       "alertsImport": "Alarm importieren",
       "panelEditorRun": "Abfrage ausführen/anwenden",
       "panelEditorSave": "Speichern und weiter bearbeiten",
@@ -21131,6 +21552,7 @@
         "system": "System"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Verfügbar",
         "passed": "Bestanden",
         "healthy": "Gesund",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Navigation zum Alarm fehlgeschlagen",
       "alertNotFound": "Alarm nicht gefunden",
-      "alertNotFoundInAlerts": "Alarm \"{name}\" nicht unter {count} Alarmen gefunden",
       "failedToLoadAlerts": "Alarme konnten nicht geladen werden",
       "alertsDeletedSuccessfully": "{count} Alarm erfolgreich gelöscht | {count} Alarme erfolgreich gelöscht",
       "failedToDeleteAlerts": "Fehler beim Löschen von {count} Alarm | Fehler beim Löschen von {count} Alarmen",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Bitte warten Sie, während die Vorlagen geladen werden...",
       "alertSavedSuccessfully": "Alarm erfolgreich gespeichert.",
       "alertUpdatedSuccessfully": "Alarm erfolgreich aktualisiert.",
-      "openingDedupConfig": "Dedup-Konfiguration für {name} wird geöffnet",
       "editingAlert": "Alarm bearbeiten: {name}",
       "ack": {
         "acked": "{name} bestätigt",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Modellpreis-Editor",
     "storageSettings": "Speichereinstellungen",
     "domainManagement": "Domain-Verwaltung",
+    "orgDomainMapping": "Domain-Verwaltung",
     "slackApp": "Slack",
     "regexPatterns": "Regex-Muster",
     "syntheticsLocations": "Synthetics-Standorte",
@@ -26099,7 +26520,7 @@
       "logged": "Protokolliert"
     },
     "policy": {
-      "gateHint": "Unter den Änderungen an bestehenden Alarmen wird nur die Deduplizierung von selbst angewendet, mit einem Snapshot des vorherigen Zustands und einem Prüfzeitraum: beibehalten, wenn die Prüfungen bestehen, zurückgerollt, wenn sie fehlschlagen. Alles andere wartet auf eine Genehmigung per Klick.",
+      "gateHint": "Bei Änderungen an bestehenden Alarmen wird nur das Aktivieren der Wiederholungsunterdrückung eigenständig angewendet, mit einem Snapshot des vorherigen Zustands und einem Überprüfungsfenster: beibehalten, wenn die Prüfungen bestehen, zurückgerollt, wenn sie fehlschlagen. Alles andere wartet auf eine Ein-Klick-Genehmigung.",
       "off": "Aus",
       "suggest": "Vorschlagen",
       "auto": "Auto",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Hält die Alarmierung zurück, bis die Untersuchung vorliegt, für maximal 2 Minuten. Fail-open: Wenn die Triage in ein Timeout läuft oder fehlschlägt, alarmiert sie trotzdem, meldet, dass die Untersuchung noch läuft oder fehlgeschlagen ist, und die Ursache folgt im Thread."
       },
       "classes": {
-        "EnableDeduplication": "Deduplizierung für einen Alarm aktivieren, der sich innerhalb von Minuten wiederholt.",
+        "EnableDeduplication": "Wiederholungsunterdrückung für einen Alarm aktivieren, der bei jeder Auswertung benachrichtigt.",
         "CreateDetector": "Einen Anomalie-Detektor für die Anfragen, Fehler oder Latenz eines Dienstes erstellen.",
         "RaiseThreshold": "Einen Schwellenwert anheben, der an gesunden Tagen auslöst.",
         "LengthenEvaluationWindow": "Das Fenster eines Alarms verlängern, der flattert.",
@@ -26667,10 +27088,10 @@
           "on": "Verbindungsalarm"
         },
         "L-302": {
-          "done": "Die 3 Checkout-Latenzalarme zu einem zusammengefasst",
-          "why": "Sie wurden 94% der Zeit gemeinsam ausgelöst, sodass eine einzige Verlangsamung Ihnen dreimal einen Alarm schickte.",
-          "from": "3 Alarme",
-          "to": "1",
+          "done": "Wiederholungsunterdrückung für die 3 Checkout-Latenzalarme aktiviert",
+          "why": "Sie benachrichtigten bei jeder Auswertung, solange sie ausgelöst blieben, sodass eine einzige Verlangsamung Sie 120 Mal alarmierte.",
+          "from": "Jede Auswertung",
+          "to": "Einmal pro Änderung",
           "on": "Checkout-Latenz"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "Ich habe On-Call benachrichtigt, weil bei checkout Zahlungen fehlschlagen.",
         "recsHeld": "Ich habe ein kleines Problem mit recommendations für die Zusammenfassung am Freitag zurückgehalten.",
         "diskApproved": "Sie haben genehmigt, den Festplattenalarm auf ingest-1 auf {to}% anzuheben.",
-        "latencyGrouped": "Ich habe die drei checkout-Langsamkeitsalarme zu einem zusammengefasst, sodass eine einzelne Verlangsamung nur einmal alarmiert.",
+        "latencyGrouped": "Ich habe die Wiederholungsunterdrückung für die drei Checkout-Verlangsamungsalarme aktiviert, sodass eine einzelne Verlangsamung nur einmal alarmiert.",
         "queueFixed": "Ich habe Worker für die orders-Warteschlange hinzugefügt, aber die Warteschlange wuchs weiter, also habe ich sie wieder entfernt und On-Call benachrichtigt.",
         "loginPaged": "Ich habe On-Call wegen der langsamen Anmeldung benachrichtigt.",
         "queuePermission": "Sie haben mir erlaubt, Warteschlangen-Worker selbstständig hinzuzufügen, bis zu 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Pipeline-Status",
       "legendToggle": "Diesen Status auf der Karte ein- oder ausblenden"
     }
+  },
+  "recentSearches": {
+    "title": "Letzte Suchen",
+    "aboutKeptDays": "Nur Ihre Suchen in {org}, nur für Sie sichtbar. Sie werden {days} Tag aufbewahrt; mit Stern markierte Suchen bleiben, bis Sie sie entfernen. | Nur Ihre Suchen in {org}, nur für Sie sichtbar. Sie werden {days} Tage aufbewahrt; mit Stern markierte Suchen bleiben, bis Sie sie entfernen.",
+    "aboutKeptForever": "Nur Ihre Suchen in {org}, nur für Sie sichtbar. Sie bleiben bis zur Löschung erhalten.",
+    "pageTitle": {
+      "logs": "Letzte Log-Suchen",
+      "traces": "Letzte Trace-Suchen",
+      "metrics": "Letzte Metriken-Suchen",
+      "dbm": "Letzte Suchen",
+      "profiles": "Letzte Suchen"
+    },
+    "page": {
+      "logs": "Logs",
+      "traces": "Traces",
+      "metrics": "Metriken",
+      "dbm": "Datenbank",
+      "profiles": "Profile"
+    },
+    "allPages": "Alle Seiten",
+    "viewAll": "Alle anzeigen",
+    "failedCount": "{count} fehlgeschlagen",
+    "keyHints": "↑↓ navigieren · PgUp/PgDn Abfrage scrollen · Enter ausführen · Shift+Enter nur laden · Esc schließen",
+    "loadToFix": "Zum Beheben laden",
+    "emptyTitle": "Noch keine Suchen vorhanden",
+    "loadError": "Letzte Suchen konnten nicht geladen werden",
+    "retry": "Erneut versuchen",
+    "warning": "Mit einer Warnung beendet: Zeitüberschreitung oder Teilergebnisse",
+    "failed": "Fehlgeschlagen",
+    "ranCount": "{count}x ausgeführt",
+    "lineCount": "{count} Zeile | {count} Zeilen",
+    "relativeWindow": "Letzte {period}",
+    "rerunNow": "Jetzt erneut ausführen",
+    "rerunOriginal": "Zum ursprünglichen Zeitpunkt",
+    "loadOnly": "Laden ohne Ausführen",
+    "copyLink": "Link kopieren",
+    "copyQuery": "Abfrage kopieren",
+    "star": "Mit Stern markieren",
+    "unstar": "Stern entfernen",
+    "linkCopied": "Link kopiert",
+    "queryCopied": "Abfrage kopiert",
+    "copyFunction": "Funktion kopieren",
+    "functionCopied": "Funktion kopiert",
+    "functionLabel": "Funktion (VRL)",
+    "searchPlaceholder": "Abfragen und Streams durchsuchen",
+    "allStreams": "Alle Streams",
+    "statusAll": "Beliebiger Status",
+    "statusOk": "Erfolgreich",
+    "statusError": "Fehlgeschlagen",
+    "starredOnly": "Nur mit Stern",
+    "datePlaceholder": "TT/MM/JJJJ",
+    "filterByDateRun": "Nach Ausführungsdatum filtern",
+    "today": "Heute",
+    "yesterday": "Gestern",
+    "noMatch": "Keine Suchanfragen entsprechen diesen Filtern",
+    "reset": "Alle zurücksetzen",
+    "resetFilters": "Filter zurücksetzen",
+    "loadMore": "Mehr laden",
+    "clear": "Meinen Verlauf löschen",
+    "confirmClear": "Verlauf löschen",
+    "clearBodyPage": "Hiermit wird Ihre {count} letzte {page}-Suche in {org} entfernt. Gespeicherte Ansichten sind nicht betroffen. | Hiermit werden Ihre {count} letzten {page}-Suchen in {org} entfernt. Gespeicherte Ansichten sind nicht betroffen.",
+    "clearBodyAll": "Hiermit wird Ihre {count} letzte Suche in {org} über Logs, Traces und Metriken entfernt. Gespeicherte Ansichten sind nicht betroffen. | Hiermit werden Ihre {count} letzten Suchen in {org} über Logs, Traces und Metriken entfernt. Gespeicherte Ansichten sind nicht betroffen.",
+    "includeStarred": "Auch meine {count} mit Stern markierte Suche entfernen | Auch meine {count} mit Stern markierten Suchen entfernen",
+    "recentRow": "Letzte Suche",
+    "deletedQuery": "Gelöscht: {query}",
+    "undo": "Rückgängig"
   }
 }
diff --git a/web/src/locales/languages/en-US.json b/web/src/locales/languages/en-US.json
index ebfb59fcfc..7381f2cc9e 100644
--- a/web/src/locales/languages/en-US.json
+++ b/web/src/locales/languages/en-US.json
@@ -486,7 +486,11 @@
       "monitors": "monitors",
       "modelPricing": "model pricing definitions",
       "variables": "variables",
-      "experiments": "experiments"
+      "experiments": "experiments",
+      "linkedDomains": "linked domains",
+      "domainMappings": "domain mappings",
+      "domainRequests": "link requests",
+      "blockedUsers": "blocked users"
     },
     "demo": {
       "pageTitle": "Empty states — full set for review",
@@ -572,6 +576,30 @@
       "action": "New Task",
       "actionDesc": "Point OpenObserve at your endpoint and test the connection."
     },
+    "noLinkedDomains": {
+      "title": "No linked domains yet",
+      "description": "Link an email domain you own to map its users to your organizations and control who can sign in.",
+      "dns": "Add a DNS record",
+      "dnsDesc": "Verify ownership with a TXT record",
+      "request": "Request a link",
+      "requestDesc": "Ask OpenObserve to link the domain for you"
+    },
+    "noDomainMappings": {
+      "title": "No domain mappings yet",
+      "description": "Add users who sign in with a verified domain to this organization or its billing group members automatically.",
+      "action": "Add mapping",
+      "actionDesc": "Choose a domain, an organization and a role"
+    },
+    "noBlockedUsers": {
+      "title": "No blocked users",
+      "description": "Every user from your verified domains can join. Block specific users to keep them out.",
+      "action": "Block users",
+      "actionDesc": "Choose a domain and the emails to block"
+    },
+    "noDomainRequests": {
+      "title": "No link requests",
+      "description": "Requests from organizations to link a domain show up here."
+    },
     "noDowntimes": {
       "title": "No downtimes yet",
       "description": "A downtime keeps alerts, anomaly detections and synthetics checks running and stops their notifications for a window that you schedule.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Turn off Auto Run",
     "autoRefreshWithValue": "Auto Refresh: {value}",
     "searchHistory": "Search History",
+    "usageCostHistory": "Usage & cost history",
     "createScheduledSearch": "Create Scheduled Search",
     "listScheduledSearch": "List Scheduled Search",
     "scheduleSearchJob": "Schedule Search Job",
@@ -1355,6 +1384,8 @@
     "scanSize": "Scan Size",
     "deltaScanSize": "Delta Scan Size",
     "scannedSoFar": "Scanned {size}",
+    "quickModeHiddenFields": "Quick mode is on. This row shows {shown} of {total} fields.",
+    "turnOffQuickMode": "Turn off quick mode",
     "resultsProgressLabel": "Search progress",
     "histogramTitleError": "Error while generating histogram title.",
     "selectLogStream": "Select logs stream",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "No network data for this view",
     "apiEmptyDescription": "The selected stream has no resource or network requests in this time range. Network metrics appear once the app instruments its HTTP calls.",
     "skipInactivity": "Skip Inactivity",
+    "fullScreen": "Full screen",
+    "exitFullScreen": "Exit full screen",
     "error": "Error",
     "errorCount": "Error Count",
     "all": "All",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Add a second step to add this funnel to a dashboard",
         "snapshot": "The panel keeps these steps, filters and named-event rules as they are now."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Performance overview",
+      "filterService": "Service",
+      "filterEnv": "Environment",
+      "filterVersion": "Version",
+      "filterAll": "All",
+      "verdictPass": "Core Web Vitals pass",
+      "verdictFail": "Core Web Vitals need attention",
+      "verdictAllPass": "All pass",
+      "verdictNeedWork": "{count} of {total} needs work | {count} of {total} need work",
+      "percentileLabel": "Percentile",
+      "bandGood": "Good",
+      "bandNeeds": "Needs work",
+      "bandPoor": "Poor",
+      "bandGoodPct": "{n}% good",
+      "bandNeedsPct": "{n}% needs work",
+      "bandPoorPct": "{n}% poor",
+      "bandAria": "{good}% good, {needs}% needs work, {poor}% poor",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} faster",
+      "deltaSlower": "{v} slower",
+      "deltaNone": "no change",
+      "deltaNoPrev": "not enough previous data",
+      "kpiSessions": "Sessions",
+      "kpiErrorFree": "Error-free sessions",
+      "kpiErrors": "Total errors",
+      "kpiUnhandled": "Unhandled errors",
+      "kpiRegion": "Key indicators",
+      "sparkAria": "{label} trend over the selected range",
+      "chartTitle": "Sessions and errors",
+      "chartInterval": "per bucket",
+      "legendSessions": "Sessions",
+      "legendErrors": "Errors",
+      "releaseMarker": "{version} first seen {time}",
+      "chartTableToggle": "Show data table",
+      "chartTableHide": "Hide data table",
+      "chartTime": "Time",
+      "pagesTitle": "Pages to fix first",
+      "pagesHint": "Ranked by impact: traffic weighted by the share of views with a vital past its threshold or an error. Click a page for its sessions, an error count for Error Tracking.",
+      "pagesColPage": "Page",
+      "pagesColViews": "Views",
+      "pagesColErrors": "Errors",
+      "pagesColImpact": "Impact",
+      "pagesLegend": "▲ needs work · ■ poor · unmarked is good. Pages under {n} views are hidden.",
+      "pagesOpenSessions": "Open sessions for {path}",
+      "pagesOpenErrors": "{count} error, open Error Tracking | {count} errors, open Error Tracking",
+      "pagesImpactAria": "Impact {n} out of 100",
+      "markNeeds": "needs work",
+      "markPoor": "poor",
+      "diffTitle": "Biggest difference",
+      "diffBody": "INP p75 is {inp}, {ratio}x the other segments. A correlation to investigate, not a proven cause.",
+      "diffNone": "No segment stands out from the others in this range.",
+      "diffLink": "View affected sessions",
+      "segmentLabel": "Segment",
+      "segBrowser": "Browser",
+      "segDevice": "Device",
+      "segCountry": "Country",
+      "segInp": "INP {v}",
+      "segShare": "{n}% of views",
+      "segNone": "No data for this segment.",
+      "releaseTitle": "Release comparison",
+      "releaseHint": "{cur} against {prev}. Release start is the first time a version is seen.",
+      "releaseMetric": "Metric",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Error-free",
+      "releaseSessions": "Sessions",
+      "releaseLink": "Errors in {version}",
+      "frustrationTitle": "User frustration",
+      "frustrationHint": "Pain that vitals do not catch",
+      "rageClicks": "Rage clicks",
+      "deadClicks": "Dead clicks",
+      "stateLoading": "Loading {panel}…",
+      "stateEmptyTitle": "No page views in this range",
+      "stateEmptyBody": "Widen the time range, clear a filter, or check that the browser SDK is sending view events.",
+      "stateEmptyAction": "Set up the SDK",
+      "stateLowTitle": "Only {count} page view | Only {count} page views",
+      "stateLowBody": "Percentiles are unreliable under {min} views, so the verdict is hidden. Values are shown for reference.",
+      "stateErrorTitle": "Could not load {panel}",
+      "stateErrorBody": "The query failed or timed out. Other panels are not affected.",
+      "retry": "Retry",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "key indicators",
+      "panelPages": "pages",
+      "panelSegments": "segments",
+      "panelRelease": "release comparison",
+      "panelFrustration": "user frustration",
+      "schemaErrorTitle": "Could not load the RUM schema",
+      "schemaErrorBody": "The stream fields could not be read, so the overview cannot decide which panels to show.",
+      "pagesShowAll": "Show all {n} pages",
+      "pagesShowFewer": "Show fewer pages",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "No pages with enough views",
+      "pagesEmptyBody": "Pages need at least {n} views in this range to be ranked.",
+      "segEmptyTitle": "No segment data",
+      "segEmptyBody": "No browser, device, OS, country or connection values were recorded for these views.",
+      "releaseEmptyTitle": "Two versions needed",
+      "releaseEmptyBody": "Release comparison needs at least two versions seen in this range.",
+      "releaseBefore": "{version} was already live before this range, so its first-seen time is not shown.",
+      "pageErrorTitle": "Could not load the performance overview",
+      "pageErrorBody": "The queries failed or timed out. Retry to load every panel again.",
+      "verdictOver": "{vital} is over the {threshold} good threshold for {pct}% of page views.",
+      "verdictAllThree": "All three Core Web Vitals pass at p75.",
+      "verdictAllSome": "All {n} assessed Core Web Vitals pass at p75.",
+      "releaseNewErrors": "{count} new error in this release | {count} new errors in this release",
+      "verdictNoData": "No Core Web Vitals data",
+      "verdictNoDataLead": "None of the {count} page view in this range reported LCP, INP or CLS. | None of the {count} page views in this range reported LCP, INP or CLS.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Open sessions.",
+      "pagesTableLabel": "Pages ranked by impact",
+      "verdictSessions": "{count} session in the range. | {count} sessions in the range.",
+      "verdictCompare": "Compared with the previous period.",
+      "deltaLower": "{v} lower",
+      "deltaHigher": "{v} higher",
+      "forbiddenTitle": "No permission to view {panel}",
+      "forbiddenBody": "Ask an administrator for access to the RUM data stream.",
+      "pageForbiddenTitle": "No permission to view the performance overview",
+      "asideLabel": "Where and what changed",
+      "pagesAbout": "About this ranking",
+      "chartPerFiveMinutes": "per 5 minutes",
+      "chartPerThirtyMinutes": "per 30 minutes",
+      "chartPerHour": "per hour",
+      "chartPerSixHours": "per 6 hours",
+      "chartPerDay": "per day",
+      "chartIntervalOther": "per bucket",
+      "chartTableCaption": "Sessions and errors per bucket",
+      "deltaChange": "{delta} vs previous period",
+      "deltaChangePts": "{delta} pts vs previous period",
+      "deltaFlat": "No change vs previous period",
+      "deltaNewMsg": "New vs previous period",
+      "verdictP75Note": "The verdict always uses p75; p50 and p95 change the values only.",
+      "releaseNote": "Compares the two latest versions, whatever the Version filter says.",
+      "kpiEmptyTitle": "No sessions in this range",
+      "kpiEmptyBody": "Widen the time range or clear a filter.",
+      "releaseImproved": "improved",
+      "releaseWorse": "worse",
+      "segOs": "OS",
+      "segConnection": "Connection",
+      "pagesAllLink": "All pages",
+      "pagesAllLinkAria": "All pages in Product Analytics",
+      "frustrationReplayLink": "Watch a replay",
+      "frustrationReplayHint": "Opens the frustrated sessions in this range; the ones that were recorded have a replay.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "Nothing was recorded in this range. Widen the time range, or set up the browser SDK if this app has not sent data yet.",
+      "stateEmptyFiltered": "Nothing matches these filters in this range. Clear the filters to see every service, environment and version.",
+      "clearFilters": "Clear filters",
+      "stateRefreshing": "Refreshing {panel}",
+      "tileOpenSessions": "{label}: {value}. Open Sessions",
+      "tileOpenErrors": "{label}: {value}. Open Error Tracking",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "This overview counts browser sessions only. Mobile app metrics are below.",
+      "mixedMobileNote": "The filters below apply to the mobile app metrics only."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Delete",
     "confirmDeleteHead": "Delete User",
     "confirmDeleteMsg": "Are you sure you want to delete the {name} user?",
+    "block": "Block",
+    "confirmBlockHead": "Block User",
+    "confirmBlockMsg": "{email} joined through your verified domain. Blocking adds them to this organization's domain restrictions and removes them from this organization. They are removed from other mapped organizations on their next login.",
     "cancel": "Cancel",
     "save": "Save",
     "ok": "OK",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Revoke Invitation",
     "revokeInvitationMsg": "Are you sure you want to revoke the invitation for {email}?",
     "deleteUsersTitle": "Delete Users",
-    "deleteUsersMsg": "Are you sure you want to delete {count} user? | Are you sure you want to delete {count} users?"
+    "deleteUsersMsg": "Are you sure you want to delete {count} user? | Are you sure you want to delete {count} users?",
+    "deleteUsersBlockNote": "{count} of them joined through your verified domain and will be blocked instead of deleted."
   },
   "invitation": {
     "pendingInvitations": "Pending Invitations",
@@ -3403,8 +3597,6 @@
       },
       "show": "Show",
       "searchPermissions": "Search Permissions",
-      "filterModules": "Filter Modules",
-      "noModuleMatch": "No Module Matches Your Filter",
       "moduleScopeAll": "All",
       "moduleScopeGranted": "Selected",
       "noGrantedModule": "No Module Is Selected Yet",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Grant | Grants",
       "summaryReachSome": "{count} of {total}",
       "summaryEmptyTitle": "This Role Grants Nothing Yet",
-      "summaryEmptyDescription": "Pick a module on the left, or start from a preset.",
+      "summaryEmptyDescription": "Start from a preset, or pick modules from the list.",
       "presetReadonlyTitle": "Read-Only",
       "presetReadonlyDescription": "List and get on every module",
       "presetDbmTitle": "Database Monitoring Viewer",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "None of the {total} Kubernetes metric streams exist in this organization yet, so nothing was pre-selected.",
       "rumPresetSeeded": "Pre-selected read access on {matched} of {total} RUM streams, plus source maps and any RUM Product Analytics grant. Review before saving.",
       "rumPresetNoMatch": "None of the {total} RUM streams exist in this organization yet, so nothing was pre-selected on them; source maps and any RUM Product Analytics grants were still staged.",
-      "moduleGroupFleet": "Fleet"
+      "moduleGroupFleet": "Fleet",
+      "filterModulesTasks": "Filter Modules",
+      "noModuleMatchQuery": "No Module Matches “{query}”",
+      "noModuleMatchHint": "Search by module, group or task, for example slack, panel or token.",
+      "presetAlertManagerTitle": "Alert Manager",
+      "presetAlertManagerDescription": "Create and manage alerts, where they send, and their messages",
+      "presetAlertViewerTitle": "Alert Viewer",
+      "presetAlertViewerDescription": "See alerts, destinations and templates without changing them",
+      "presetDashboardEditorTitle": "Dashboard Editor",
+      "presetDashboardEditorDescription": "Build and edit dashboards, with read access to the data they query",
+      "presetDashboardViewerTitle": "Dashboard Viewer",
+      "presetDashboardViewerDescription": "Open dashboards and read the data behind their panels",
+      "presetPipelineEditorTitle": "Pipeline Editor",
+      "presetPipelineEditorDescription": "Build pipelines and functions, with read access to streams and enrichment tables",
+      "presetApplied": "{title}: {permissions} added. Review Changes before you save.",
+      "presetPermissionCount": "{count} permission | {count} permissions",
+      "companionReasonAlertStreams": "to save alerts. The server checks stream access on save",
+      "companionReasonAlertDestinations": "to choose where alerts send",
+      "companionReasonDestinationTemplates": "to pick the message template, which every destination requires",
+      "companionReasonDashboardStreams": "to load panel data",
+      "presetsTitle": "Presets",
+      "presetsClose": "Close Presets",
+      "presetsShow": "Show Presets",
+      "presetsSubtitle": "Add a preset's grants to this role. Nothing is removed.",
+      "presetsSectionBuiltin": "Built-In",
+      "presetsSectionJob": "By Job",
+      "presetAddsTooltip": "Adds {count} Permission | Adds {count} Permissions",
+      "presetInRole": "In Role",
+      "presetInRoleTooltip": "This Role Already Has Everything In This Preset",
+      "presetBack": "All Presets",
+      "presetModuleCount": "{count} module | {count} modules",
+      "presetSummaryAdds": "Adds {permissions} in {modules}.",
+      "presetSummaryWrite": "Write access in {modules}.",
+      "presetSummaryViewOnly": "View only: nothing can be created, edited or deleted.",
+      "presetSummaryHasAll": "This role already has everything in this preset.",
+      "presetSummarySkipped": "{count} permission already in this role is skipped. | {count} permissions already in this role are skipped.",
+      "presetStillMissing": "Still missing after adding: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "Nothing will be missing after you add it.",
+      "neededBy": "Needed by {modules}",
+      "stillNeededBy": "Still needed by {modules}",
+      "presetReadsEveryStream": "Reads every stream in this organization, including new ones.",
+      "presetAddButton": "Add {count} Permission | Add {count} Permissions",
+      "presetNothingToAdd": "Nothing To Add",
+      "presetApplyNote": "Added grants become unsaved changes. Review them before you save.",
+      "presetLoadingStreams": "Loading Streams",
+      "presetNoMatchingStreams": "No matching streams in this organization yet.",
+      "reviewMissingTooltip": "{count} Module Missing For This Role To Work | {count} Modules Missing For This Role To Work",
+      "notAddedYetTitle": "Not added yet · {modules}",
+      "companionAdd": "Add",
+      "companionAddItem": "Add {item}",
+      "companionAddAll": "Add All",
+      "companionOpenStreams": "Open Streams",
+      "companionOpenStreamsTooltip": "Pick Which Streams This Role Can Read",
+      "companionNeeds": "{module} needs it {reason}.",
+      "companionNeedsThis": "{module} needs this {reason}.",
+      "companionStillNeedsThis": "{module} still needs this {reason}.",
+      "yourChanges": "Your Changes",
+      "yourChangesCount": "{changes} in {modules}",
+      "yourChangesNone": "none yet",
+      "changeCount": "{count} change | {count} changes",
+      "changeOtherGroup": "Other",
+      "saveSuccessCounts": "Saved {changes} in {modules}.",
+      "effectCan": "Can {actions} {target}.",
+      "effectCannot": "Can no longer {actions} {target}.",
+      "effectCanLoadDestinations": "Can load the destinations list.",
+      "effectCannotLoadDestinations": "Can no longer load the destinations list.",
+      "effectCanLoadTemplates": "Can load the templates list.",
+      "effectCannotLoadTemplates": "Can no longer load the templates list.",
+      "verbView": "view",
+      "verbSeeListOf": "see the list of",
+      "verbList": "list",
+      "verbOpen": "open",
+      "verbCreate": "create",
+      "verbEdit": "edit",
+      "verbDelete": "delete",
+      "targetEveryStream": "every stream (logs, metrics, traces and indices), including new ones",
+      "targetTypeStreams": "all {type} streams",
+      "targetOneStream": "the {name} {type} stream",
+      "targetAlertsEveryFolder": "alerts in every folder, including new folders",
+      "targetAlertsInFolder": "alerts in the {name} folder",
+      "targetOneAlert": "the {name} alert",
+      "targetDashboardsEveryFolder": "dashboards in every folder, including new folders",
+      "targetDashboardsInFolder": "dashboards in the {name} folder",
+      "targetOneDashboard": "the {name} dashboard",
+      "targetReportsEveryFolder": "reports in every folder, including new folders",
+      "targetReportsInFolder": "reports in the {name} folder",
+      "targetOneReport": "the {name} report",
+      "targetEveryDestination": "every alert destination (Slack, email, webhooks), including new ones",
+      "targetOneDestination": "the {name} destination",
+      "targetEveryTemplate": "every notification template, including new ones",
+      "targetOneTemplate": "the {name} template",
+      "targetAllOf": "all {module}, including new ones",
+      "targetItemIn": "{name} in {module}",
+      "noteDestinationsFiltered": "They see only the destinations they can also open. Add Get here, or on single destinations, to choose which ones.",
+      "noteTemplatesFiltered": "They see only the templates they can also open. Add Get here, or on single templates, to choose which ones.",
+      "presetStreamsFailed": "Could not load the stream list.",
+      "presetRetry": "Retry",
+      "presetRestored": "{title}: {permissions} restored. Review Changes before you save.",
+      "presetSummaryRestores": "Keeps {count} permission you marked for removal. | Keeps {count} permissions you marked for removal.",
+      "presetRestoreButton": "Keep {count} Permission | Keep {count} Permissions",
+      "effectStillAllowed": "No access change: a wider grant still allows this."
     },
     "rolesPage": {
       "subtitle": "Roles bundle permissions — assign them to Users, Service Accounts, or Groups to grant access.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "User updated successfully.",
       "userDeletedSuccess": "User deleted successfully.",
       "errorDeletingUser": "Error while deleting user.",
+      "userBlockedSuccess": "User blocked successfully.",
+      "errorBlockingUser": "Error while blocking user.",
+      "blockedButNotRemoved": "User was blocked, but could not be removed from this organization.",
+      "blockedUsersSuccess": "Successfully blocked {count} user | Successfully blocked {count} users",
+      "blockedUsersPartial": "Blocked and removed {count} user, but {failed} could not be removed from this organization | Blocked and removed {count} users, but {failed} could not be removed from this organization",
+      "blockedUsersNotRemoved": "Blocked {count} user, but could not remove them from this organization | Blocked {count} users, but could not remove them from this organization",
       "pleaseWait": "Please wait...",
       "invitationRevokedSuccess": "Invitation revoked successfully.",
       "errorRevokingInvitation": "Error while revoking invitation.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Traces are captured with eBPF: no code changes or SDK needed. Trace context crosses services only over plain-text HTTP (Go apps also over HTTPS, except on nodes with kernel lockdown). A process matching any of ports, executable path or command line is traced; globs can't contain `,`, `{'{'}` or `{'}'}`, and a port matches any process with a socket on it. Needs Helm 3.14+ and OpenTelemetry operator v0.142.0+; if yours is older, upgrade it first with `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. If eBPF was already enabled on an older operator, re-run with `--force` (`--force-replace` on Helm 4). Re-running the install command above resets the release and turns eBPF off, so run this command again afterwards. The `openobserve-collector` namespace must allow privileged pods, and nodes must run Linux on amd64 or arm64 with kernel 5.8+ (or RHEL-family 4.18 with eBPF backports) and BTF. Don't select apps that already send their own traces, or pods using the Go `inject-go` sidecar.",
       "k8sEbpfVariant": "eBPF (any language, no code changes)",
       "k8sLibrariesVariant": "Language libraries (auto-instrumentation)",
+      "k8sNetworkFlowsDesc": "The collector's eBPF DaemonSet records the **bytes sent between workloads over any TCP or UDP protocol** on each Linux node, including databases, caches and other services that aren't traced. They arrive as the `obi_network_flow_bytes` metric, labelled with the source and destination owner (Deployment, StatefulSet, Node, …) and namespace. Works with or without eBPF tracing.",
+      "k8sNetworkFlowsNote": "Needs Helm 3.14+ and OpenTelemetry operator v0.142.0+. The `openobserve-collector` namespace must allow privileged pods, and nodes must run Linux on amd64 or arm64 with kernel 5.8+ (or RHEL-family 4.18 with eBPF backports) and BTF. The eBPF pods run on the host network, and the collector's own metrics listen on `127.0.0.1:8888` of each node, so that port must be free there. eBPF trace selectors you already set are kept. Re-running the install command above resets the release and turns this off, so run this command again afterwards. The same bytes can be reported more than once: traffic between nodes by both nodes, and a connection to a Service against both the Service and the workload behind it. The eBPF network flows guide explains how to query them without double counting.",
+      "k8sNetworkFlowsTitle": "See which workloads talk to each other: eBPF network flows",
       "k8sInstallerNote": "This installs cert-manager, the OpenTelemetry operator and the OpenObserve collector automatically.",
       "k8sInternalEndpointNote": "Use this when OpenObserve runs in this same cluster — traffic never leaves it.",
       "k8sTroubleAnnotationA": "Injection happens at pod creation, so existing pods are unaffected until they restart — run `kubectl rollout restart deployment -n my-namespace`. Confirm the annotation landed with `kubectl get ns my-namespace -o yaml`, and check that the value matches `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "The install fails with an error about the admission webhook",
       "linuxAgentFixBody": "The installer starts the agent as a systemd service. If nothing arrives, confirm it is running and read its logs for an auth or connectivity error:",
       "linuxTracesNote": "Traces are captured with eBPF: no code changes or SDK needed. A process matching any of ports, executable path or command line is traced; globs can't contain `,`, `{'{'}` or `{'}'}`. Tracing needs Linux 5.8+ (or RHEL-family 4.18 with eBPF backports) with BTF; the agent then runs as root. If the host can't trace, the install stops and leaves the running agent untouched. If the agent then fails to start with tracing on, it is disabled — logs and metrics too — until you re-run the **Logs & metrics** command, or fix the cause and re-run with tracing. Traced apps add a W3C `traceparent` header to outgoing plain-text HTTP requests. The eBPF tracing guide below covers HTTPS and repeating flags.",
+      "linuxNetworkFlowsDesc": "Run the installer with `--network-flows` to report the **bytes this host sends and receives over any TCP or UDP protocol**, as the `obi_network_flow_bytes` metric. Each flow is labelled `src_cidr` and `dst_cidr` with the networks you list, so give every host the same list: one `/32` entry per host gives a host-to-host map.",
+      "linuxNetworkFlowsNote": "Needs Linux 5.8+ (or RHEL-family 4.18 with eBPF backports) with BTF; the agent then runs as root. It works with or without tracing, but each run of the installer replaces the agent's configuration: to keep tracing on, add the `--trace-*` and `--service-name` flags from the **Logs, metrics & eBPF traces** command. If the host can't run eBPF, the install stops and leaves the running agent untouched. If network capture then fails to start, the agent is disabled — logs and metrics too — until you re-run the **Logs & metrics** command, or fix the cause and re-run with `--network-flows`. Traffic between two hosts that both run the agent is reported by each of them, and loopback traffic is counted unless both ends have the same address. The eBPF network flows guide below explains the labels and how to query them without double counting.",
+      "linuxNetworkFlowsTitle": "See which hosts talk to each other: eBPF network flows",
       "linuxTracesVerifyNote": "With tracing on, traces appear once a traced app handles a request.",
+      "ebpfNetworkFlowsGuideLink": "eBPF network flows guide",
       "ebpfTracingGuideLink": "eBPF tracing guide",
       "logsMetricsTracesVariant": "Logs, metrics & eBPF traces",
       "logsMetricsVariant": "Logs & metrics",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Point any OpenTelemetry exporter at OpenObserve — collector or SDK, HTTP or gRPC. Your endpoint and token are filled in below.",
       "taglineWindows": "Install the OpenObserve agent on any Windows host — Event Log, performance counters and host metrics.",
       "testAgain": "Test again",
+      "networkFlowsHelp": "CIDR or CIDR=NAME entries, comma-separated with no spaces; each CIDR needs a prefix length, e.g. 10.0.1.5/32, and names may only contain letters, digits, ., _ and -. Addresses no entry matches are left unlabelled; 0.0.0.0/0=other names the rest of IPv4, ::/0=other6 the rest of IPv6.",
+      "networkFlowsLabel": "Networks to label",
+      "networkFlowsRequired": "List at least one network: flows are labelled with the networks you list.",
       "traceCmdHelp": "For Python, Node.js and Java apps.",
       "traceCmdLabel": "Command line",
       "traceExeLabel": "Executable path",
@@ -7516,6 +7825,20 @@
     "heatmapHideBelow": "Hide cells below",
     "heatmapHideBelowTooltip": "Cells with a value below this are left empty.",
     "heatmapHideBelowNote": "Cells below {value} are hidden",
+    "boxplotWhisker": "Whiskers",
+    "boxplotWhiskerMinMax": "Min to max",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Message field",
+    "logsLevelField": "Level field",
+    "logsTimeField": "Time field",
+    "htmlPanelFieldTooltip": "Leave empty to detect the column from the query results",
+    "logsOrder": "Order",
+    "logsOrderNewest": "Newest first",
+    "logsOrderOldest": "Oldest first",
+    "logsOrderTooltip": "Orders the rows the query returns. An untouched starter query is also fetched in this order, so oldest first shows the earliest logs.",
+    "logsShowTime": "Show time",
+    "logsWrap": "Wrap lines",
+    "logsPrettifyJson": "Prettify JSON",
     "distributionBucketCount": "Bucket count",
     "distributionBucketSize": "Bucket size",
     "distributionBucketSizeTooltip": "Width of each bucket in the field's units. When set, it replaces the bucket count.",
@@ -7820,6 +8143,8 @@
       "gauge": "Gauge",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Box plot",
+      "logs": "Logs",
       "barGauge": "Bar gauge",
       "distribution": "Distribution",
       "treemap": "Treemap",
@@ -8319,6 +8644,14 @@
       "missingRequiredArgument": "{field}: Missing required argument at position {index}",
       "fieldNotAllowedForMetric": "{label} field is not allowed for Metric chart",
       "rawValueSampled": "Based on the first {count} rows",
+      "addAtMostOneFieldFor": "Add at most one field for the {label}",
+      "boxplotMin": "Min",
+      "boxplotMax": "Max",
+      "boxplotLowerWhisker": "Lower whisker",
+      "boxplotUpperWhisker": "Upper whisker",
+      "boxplotMedian": "Median",
+      "boxplotSamples": "Samples",
+      "boxplotOutlier": "Outlier",
       "fieldNotAllowedForDistribution": "{label} field is not allowed for the distribution chart",
       "distributionCount": "Count",
       "addAtLeastOneFieldFor": "Add at least one field for the {label}",
@@ -8523,6 +8856,8 @@
       "urlHidden": "No access",
       "urlHiddenHint": "You can't view this link's dashboard, so its public URL is hidden.",
       "orgDisabledHint": "Public links are turned off for this organization",
+      "orgDisabledBanner": "Public links are turned off for this organization, so no link is served. An admin can turn them back on.",
+      "disabledPaused": "Disabled · Paused",
       "takeOver": "Take over",
       "takeOverTitle": "Take over this link?",
       "takeOverBody": "You become the publisher. The public page will show what you are allowed to see, which may be more or less than before. Anyone who has the URL keeps access to it, and the link goes live now.",
@@ -8782,6 +9117,7 @@
     "wellGroup": "Group",
     "wellSubgroup": "Sub-group",
     "wellSize": "Size",
+    "wellCategory": "Category",
     "value": "Value"
   },
   "home": {
@@ -9685,8 +10021,8 @@
       "raiseThresholdDesc": "Move the trigger value away from the observed steady state.",
       "lengthenEvaluationWindow": "Lengthen evaluation window",
       "lengthenEvaluationWindowDesc": "Widen the period so a short spike no longer trips the alert.",
-      "enableDeduplication": "Enable deduplication",
-      "enableDeduplicationDesc": "Collapse repeat firings inside a deduplication window.",
+      "enableDeduplication": "Turn on suppress repeats",
+      "enableDeduplicationDesc": "Notify once per state change instead of on every evaluation.",
       "reviewForDeletion": "Review for deletion",
       "reviewForDeletionDesc": "Confirm the query still matches reality before retiring the alert.",
       "fixAlertQuery": "Fix alert query",
@@ -10003,12 +10339,8 @@
     "organizationIdLabel": "Organization Id",
     "alertCreationTitle": "Alert Creation",
     "noAlertsFound": "No alerts found",
-    "suppressedByDeduplication": "Suppressed by deduplication",
-    "occurrence": "{count} occurrence | {count} occurrences",
     "groupedNotification": "Grouped notification",
     "alertsBatchedTogether": "alerts batched together",
-    "notificationSent": "Notification sent",
-    "occurrencesDeduplicated": "occurrences deduplicated",
     "alertExecutionDetails": "Alert Execution Details",
     "evaluationTime": "Evaluation Time",
     "queryTime": "Query Time",
@@ -10058,15 +10390,7 @@
     "serviceGraphTooltipTo": "To: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Temporal correlation",
     "serviceGraphTooltipServiceDependency": "Service dependency",
-    "totalAlerts": "Total Alerts",
-    "usingDeduplication": "Using Deduplication",
-    "deduplicationConfiguredTooltip": "Alerts with deduplication configured",
-    "suppressionRate24h": "Suppression Rate (24h)",
     "suppressed": "suppressed /",
-    "total": "total",
-    "passedLabel": "Passed:",
-    "pendingBatches": "Pending Batches",
-    "pendingBatchesTooltip": "Alerts waiting to be grouped together",
     "historyTimeline": {
       "firing": "Firing",
       "ok": "Ok",
@@ -10087,7 +10411,8 @@
     "endTime": "End Time",
     "duration": "Duration",
     "retries": "Retries",
-    "dedup": "Dedup",
+    "suppression": "Suppression",
+    "suppressedAsRepeat": "Suppressed as a repeat",
     "validation": {
       "streamTypeRequired": "Stream type is required.",
       "streamNameRequired": "Stream name is required.",
@@ -10279,15 +10604,6 @@
     "all": "All",
     "history": "Alert History",
     "searcHistory": "Enter Alert Name",
-    "deduplication": {
-      "fingerprintFields": "Group similar alerts by",
-      "fingerprintFieldsHint": "Select fields that make alerts similar (e.g., hostname, service). Leave empty to auto-detect based on your query.",
-      "fingerprintFieldsTooltip": "Choose which fields should match for alerts to be considered duplicates. For example, selecting 'hostname' means alerts from the same host will be grouped together. Different alert types (e.g., High CPU vs High Memory) are never grouped, even if they come from the same host. Leave empty for automatic detection based on your query type.",
-      "timeWindow": "Consider alerts identical within",
-      "timeWindowHint": "Time period to group similar alerts. Leave empty to match your check interval.",
-      "timeWindowTooltip": "How long to remember recent alerts for grouping. If a similar alert happens within this time, it won't be sent again. Leave empty to use your alert's check interval.",
-      "fingerprintFieldsHelp": "Leave empty to auto-detect based on query (SQL: GROUP BY columns, PromQL: labels, Custom: condition fields)"
-    },
     "summary": {
       "scrollToBottom": "Scroll to bottom",
       "title": "Summary",
@@ -10335,38 +10651,15 @@
         "defaultConditions": "Alert me when the configured conditions are met"
       }
     },
-    "correlation": {
-      "title": "Alert Correlation",
-      "description": "Configure how alerts are correlated and deduplicated across the organization. Alerts with matching fingerprint values will be grouped together.",
-      "semanticFieldNote": "Note: Semantic field mappings are configured in the Service Identity tab.",
-      "enableOrgLevel": "Enable Organization-Level Deduplication",
-      "enableOrgLevelTooltip": "Enable deduplication and correlation features for all alerts in this organization",
-      "enableCrossAlert": "Enable Cross-Alert Deduplication",
-      "enableCrossAlertTooltip": "Allow different alerts to deduplicate each other when they share the same fingerprint",
-      "fingerprintGroups": "Cross-Alert Fingerprint Groups",
-      "fingerprintGroupsTooltip": "Select which semantic groups to use for cross-alert fingerprinting. Alerts will be deduplicated if they share the same values for these dimensions.",
-      "fingerprintGroupsHint": "Select at least one semantic group for cross-alert deduplication",
-      "fingerprintGroupsRequired": "At least one semantic group must be selected",
-      "defaultWindow": "Default Correlation Window (minutes)",
-      "defaultWindowTooltip": "In absence of semantic field match, alerts and data from given duration is considered related",
-      "defaultWindowDescription": "In absence of semantic field match, alerts and data from given duration is considered related",
-      "defaultWindowPlaceholder": "Use alert period by default",
-      "cancelButton": "Cancel",
-      "saveButton": "Save",
-      "settingsSaved": "Organization deduplication settings saved successfully",
-      "settingsSaveError": "Failed to save settings"
-    },
     "placeholders": {
       "typeSomething": "Type something",
       "value": "Value",
       "selectColumn": "Select column",
       "savedFunctions": "Saved functions",
-      "autoUsesCheckInterval": "Auto (uses check interval)",
       "addTag": "Add tag and press Enter"
     },
     "steps": {
       "compareWithPast": "Compare with Past",
-      "deduplication": "Deduplication",
       "advanced": "Advanced"
     },
     "stepCaptions": {
@@ -10374,7 +10667,6 @@
       "conditions": "What should trigger the alert",
       "compareWithPast": "Compare current results with data from another time period",
       "alertSettings": "Set your alert rules and choose how you'd like to be notified.",
-      "deduplication": "Avoid sending the same alert multiple times by grouping similar alerts together.",
       "advanced": "Context variables, description, and row template"
     },
     "failedToFetchHistory": "Failed to fetch alert history",
@@ -10397,8 +10689,6 @@
         "closeActions": "Close actions",
         "viewAlertHistory": "View Alert History",
         "actionsFor": "Actions for:",
-        "configureDedup": "Configure Dedup",
-        "configureDedupTooltip": "Configure deduplication for this alert",
         "editAlert": "Edit Alert",
         "editAlertTooltip": "Edit alert configuration",
         "viewHistory": "View History",
@@ -11178,6 +11468,8 @@
       "recoveryChatMessage": "new \"Resolved\" message",
       "keepFiringFor": "Keep firing for",
       "keepFiringForTooltip": "Wait this long after the condition clears before recovering. 0 recovers immediately.",
+      "suppressRepeats": "Suppress repeats",
+      "suppressRepeatsTooltip": "Notify once when the alert starts firing or changes level, not on every evaluation. Leave it off to keep getting reminders after each silence period.",
       "keepFiringForInvalid": "Enter 0 or more seconds",
       "keepFiringForTooLong": "Enter at most 86400 seconds (24 hours)"
     },
@@ -13583,6 +13875,7 @@
     "emailAlreadyExists": "This email address has already been added",
     "confirmRemoveEmail": "Are you sure you want to remove the {email} email?",
     "domainNeedsEmails": "Domain '{domain}' must have at least one email address when not allowing all users",
+    "noAllowedEmailsDenyAll": "No emails are allowed yet, so every user from {domain} is denied.",
     "domainSettingsSaved": "Domain settings saved successfully",
     "errorSavingDomainSettings": "Error saving domain settings",
     "noDomainMessage": "No domains configured. Add domains above to restrict access.",
@@ -13679,7 +13972,6 @@
       "identityConfigNoSets": "Configure at least one identity set before saving.",
       "discoveredServicesTab": "Discovered Services",
       "serviceDiscoveryTab": "Detection Rules",
-      "alertCorrelationTab": "Alert Grouping",
       "fieldAliasesTab": "Field Mappings",
       "fieldAliasesSaved": "Field aliases saved successfully",
       "fieldAliasesSaveError": "Failed to save field aliases",
@@ -14077,27 +14369,144 @@
     "runsIn": "Runs in",
     "recommendedByFieldCoverage": "Recommended based on field coverage in your streams.",
     "listConjunctionAndTwo": "{first} and {last}",
-    "domainOrgMappings": {
-      "title": "Domain to organization mappings",
-      "subtitle": "New users signing in with a matching email domain are added to the organization automatically.",
+    "orgDomainMapping": {
+      "tabLabel": "Domain management",
+      "tabDesc": "Link your email domains, map their users to organizations, and control which of them can join.",
+      "loadFailed": "Failed to load organization settings",
       "addMapping": "Add mapping",
       "editMapping": "Edit mapping",
-      "empty": "No mappings yet. Use “{addLabel}” to add one.",
       "domain": "Email domain",
-      "domainHelp": "The part after {at_sign} in the user's email address.",
+      "domainHelp": "The part after {at_sign} in the user's email address. The domain is linked to this organization and must be verified through DNS.",
+      "domainHelpRequest": "The part after {at_sign} in the user's email address. The domain is linked to this organization once OpenObserve approves the request.",
       "organization": "Organization",
-      "organizationPlaceholder": "Organization identifier",
-      "organizationHelp": "The identifier of the organization matching users are added to.",
+      "organizationHelp": "This organization or one of its billing group members.",
       "organizationRequired": "Organization is required",
       "baseRole": "Base role",
-      "baseRoleHelp": "The role matching users are given in that organization.",
+      "baseRoleHelp": "The role given when a user is added to that organization. Existing members keep their current role.",
       "roleClaimName": "Role claim",
       "roleClaimNamePlaceholder": "Claim name, e.g. groups",
-      "roleClaimNameHelp": "Optional. Token claim listing the user's custom roles; on every login, their custom roles in that organization are synced to it.",
+      "roleClaimNameHelp": "Optional. SSO token claim listing the user's custom roles. On each SSO sign-in, their custom roles in that organization are replaced with the claimed ones; claimed roles that don't exist are skipped unless they are created.",
       "createMissingRoles": "Create claimed roles that don't exist in the organization",
-      "duplicateDomain": "A mapping for this domain already exists",
-      "confirmRemove": "Are you sure you want to delete the mapping for {name}?",
-      "deleteTitle": "Delete Mapping"
+      "verifyNow": "Verify now",
+      "details": "Details",
+      "detailsDialogTitle": "Link details for {domain}",
+      "approvedLinkInfo": "Linked by OpenObserve after a link request. No DNS record is needed.",
+      "pendingRequestInfo": "OpenObserve is reviewing this request. Nothing to do until it is approved.",
+      "rejectedRequestInfo": "OpenObserve rejected this request.",
+      "verifyDialogTitle": "Verify {domain}",
+      "recordDialogTitle": "DNS record for {domain}",
+      "lastCheckFailed": "Last check failed: {reason}",
+      "state": {
+        "pending": "Pending",
+        "verified": "Verified",
+        "failed": "Failed",
+        "requested": "Awaiting approval",
+        "approved": "Approved",
+        "rejected": "Rejected"
+      },
+      "saved": "Domain mapping saved",
+      "saveFailed": "Failed to save settings",
+      "linkFailed": "Failed to link the domain",
+      "unlinkFailed": "Failed to unlink the domain",
+      "verifyFailed": "Verification failed",
+      "deleted": "Mapping removed",
+      "deleteTitle": "Remove mapping?",
+      "deleteMappingBody": "Users from {domain} will no longer be added to {org} when they sign in.",
+      "recordInstructions": "Add this DNS TXT record at your DNS provider:",
+      "txtNameLabel": "Record name",
+      "txtValueLabel": "Record value",
+      "copyTxtName": "Copy record name",
+      "copyTxtValue": "Copy record value",
+      "txtNameCopied": "Record name copied",
+      "txtValueCopied": "Record value copied",
+      "verifyHint": "Verification runs automatically every {minutes} minutes. You can also verify now.",
+      "alreadyLinked": "This domain is already linked to this organization",
+      "failureReason": {
+        "recordMissing": "TXT record not found",
+        "valueMismatch": "TXT record found, but the value doesn't match",
+        "dnsFailed": "DNS resolution failed"
+      },
+      "pageSubtitle": "Link your email domains, map their users to organizations, and control which of them can join.",
+      "linkedTab": "Linked domains",
+      "mappingsTab": "Mappings",
+      "accessTab": "Blocked users",
+      "requestsTab": "Link requests",
+      "linkDomain": "Link domain",
+      "sendRequest": "Send request",
+      "linkMethod": "How to prove ownership",
+      "method": {
+        "dns": "DNS record",
+        "approved": "Approved request",
+        "request": "Link request",
+        "dnsTitle": "Add a DNS TXT record",
+        "dnsDesc": "Verified automatically once the record is published. Best when you manage the domain's DNS.",
+        "requestTitle": "Request a link from OpenObserve",
+        "requestDesc": "Our team reviews the request and links the domain once approved."
+      },
+      "searchDomains": "Search domains",
+      "searchMappings": "Search by domain or organization",
+      "searchRequests": "Search by domain, organization or requester",
+      "status": "Status",
+      "linkedVia": "Linked via",
+      "lastChecked": "Last checked",
+      "linked": "Domain linked. Add the DNS record to verify it.",
+      "verified": "Domain verified",
+      "notVerifiedYet": "The DNS record was not found yet. It can take a while to propagate.",
+      "requestSent": "Link request sent",
+      "requestFailed": "Failed to send the link request",
+      "keepRecordHint": "Keep this record in place. Ownership is re-checked every {minutes} minutes; if the record is missing for more than {grace} minutes, the domain is marked failed and its mappings stop applying.",
+      "removeDomain": "Remove domain",
+      "removeTitle": "Remove domain?",
+      "removeBody": "{domain} will be unlinked from this organization.",
+      "removeWithMappingsBody": "{domain} will be unlinked from this organization, and its {count} mapping will be removed. | {domain} will be unlinked from this organization, and its {count} mappings will be removed.",
+      "removed": "Domain removed",
+      "domainRequired": "Domain is required",
+      "mappingDomainHelp": "Only verified domains can be mapped.",
+      "createsRoles": "Creates roles",
+      "duplicateMapping": "This domain is already mapped to that organization",
+      "domainNotVerified": "Not verified",
+      "noVerifiedDomains": "Mappings apply to verified domains. Link and verify a domain first.",
+      "goToLinked": "Link a domain",
+      "goToLinkedDesc": "Verify a domain you own before mapping its users",
+      "enforceTitle": "Remove users from other organizations",
+      "enforceDesc": "When a user from a mapped domain signs in through SSO, they are removed from every organization outside this one and its billing group.",
+      "enforceConfirmTitle": "Remove users from other organizations?",
+      "enforceConfirmBody": "Each time a user whose email domain has a mapping here signs in through SSO, they will be removed from every organization that is not this one or in its billing group, including their personal organizations.",
+      "enforceConfirmAction": "Turn on",
+      "enforceSaved": "Setting saved",
+      "blockUsers": "Block users",
+      "editBlockedUsers": "Edit blocked users",
+      "block": "Block",
+      "blockedCount": "{count} blocked | {count} blocked",
+      "blockedEmails": "Blocked emails",
+      "blocklistDomainHelp": "One of this organization's verified domains.",
+      "blocklistEmailsHelp": "These users can't join this organization or its billing group members through SSO, and are removed from them at their next sign-in.",
+      "ruleBlockedRequired": "Add at least one email to block",
+      "noDomainForBlocklist": "Every verified domain already has blocked users. Edit its row to change them.",
+      "unblockAll": "Unblock all",
+      "unblockAllTitle": "Unblock all users?",
+      "unblockAllBody": "Every blocked user from {domain} can join again at their next SSO sign-in.",
+      "blocklistSaved": "Blocked users saved",
+      "blocklistDeleted": "Users unblocked",
+      "blocklistSection": "Blocked users by domain",
+      "filterPending": "Pending",
+      "filterAll": "All",
+      "requestedBy": "Requested by",
+      "requestedAt": "Requested",
+      "verifiedAt": "Verified",
+      "answeredBy": "Answered by",
+      "reason": "Reason",
+      "reasonHelp": "Shown to the organization that raised the request.",
+      "reasonRequired": "A reason is required to reject a request",
+      "approve": "Approve",
+      "reject": "Reject",
+      "approveTitle": "Approve link request?",
+      "rejectTitle": "Reject link request?",
+      "approveBody": "{domain} will be linked to {org} without a DNS check.",
+      "rejectBody": "{org} will not get {domain}.",
+      "requestApproved": "{domain} linked",
+      "requestRejected": "Request for {domain} rejected",
+      "decisionFailed": "Failed to update the request"
     }
   },
   "reports": {
@@ -15354,11 +15763,11 @@
     "select_detect_at_option": "Please select detect at option"
   },
   "search_history": {
-    "title": "Search History",
+    "title": "Usage & cost history",
     "get_history": "Get History",
     "executed_at": "Executed At",
     "sql_query": "SQL Query",
-    "delayMessage": "Search History might be delayed by"
+    "delayMessage": "Usage & cost history might be delayed by"
   },
   "correlation": {
     "unstableDimensionNote": "Unstable dimension - changes on pod restart. Default: All values.",
@@ -18782,7 +19191,9 @@
     "dataFresh": "Data is fresh",
     "dataGettingStale": "Data is getting stale",
     "dataStale": "Data is stale",
-    "lastRefreshed": "Last refreshed: {time}"
+    "lastRefreshed": "Last refreshed: {time}",
+    "refresh": "Refresh",
+    "refreshWithAge": "Refresh, last refreshed {age}"
   },
   "synthetics": {
     "variables": {
@@ -19151,6 +19562,7 @@
       "probeError": "Probe error"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "click",
       "actionType": "type",
       "all": "All",
@@ -19866,6 +20278,13 @@
       "attemptN": "Attempt {n}",
       "detailAction": "Action",
       "detailSelector": "Selector",
+      "detailStepId": "Step ID",
+      "detailTargetUrl": "Target URL",
+      "detailStatus": "Status",
+      "detailSkipReason": "Skip reason",
+      "stepStatusSkipped": "Skipped",
+      "stepStatusUnknown": "Unknown",
+      "skippedCount": "{n} skipped",
       "downloadTrace": "Download {filename}",
       "errorFullscreenTitle": "Step {id}: {action} - Error",
       "failedAtStartLoad": "Failed opening Starting URL",
@@ -20015,7 +20434,7 @@
       "retriesMaxHint": "Maximum {max}. Retries run inside the same job, so the whole sequence must fit the check budget.",
       "retriesMaxBrowserHint": "Maximum {max} for browser checks. Each attempt reruns the journey on every device, so more would outrun the probe timeout and report a failure your site never had.",
       "retryDelay": "Wait for",
-      "retryDelaySuffix": "ms in between retries.",
+      "retryDelaySuffix": "seconds in between retries.",
       "schedule": "Schedule",
       "scheduleLater": "Schedule later",
       "scheduleLaterTooltip": "Choose a future date and time to activate the check.",
@@ -20239,6 +20658,8 @@
         "restartConfig": "Restart config — copy this agent's setup command to re-run install / docker restart (e.g. after a token rotation)",
         "noAgents": "No agents have registered for this location yet.",
         "agentsUnavailable": "This location's agents registered with another cluster and are not visible here.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Checks running from this location",
         "checkName": "Name",
         "noChecks": "No checks are assigned to this location yet.",
@@ -20544,7 +20965,7 @@
       "nodes": "Nodes",
       "modelPricing": "Model Pricing",
       "searchSchedulers": "Search Schedulers",
-      "searchHistory": "Search History",
+      "searchHistory": "Usage & cost history",
       "sessions": "Sessions",
       "evalTemplates": "Online Evals — Templates",
       "scorers": "Online Evals — Scorers",
@@ -20632,7 +21053,7 @@
       "alertSourcesRefresh": "Refresh list",
       "alertTemplatesAdd": "Add new template",
       "alertTemplatesRefresh": "Refresh list",
-      "logsSearchHistory": "Open search history",
+      "logsSearchHistory": "Open usage & cost history",
       "alertsImport": "Import alert",
       "panelEditorRun": "Run / apply query",
       "panelEditorSave": "Save and keep editing",
@@ -21129,6 +21550,7 @@
         "system": "system"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Up",
         "passed": "Passed",
         "healthy": "Healthy",
@@ -21216,7 +21638,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Failed to navigate to alert",
       "alertNotFound": "Alert not found",
-      "alertNotFoundInAlerts": "Alert \"{name}\" not found in {count} alerts",
       "failedToLoadAlerts": "Failed to load alerts",
       "alertsDeletedSuccessfully": "{count} alert deleted successfully | {count} alerts deleted successfully",
       "failedToDeleteAlerts": "Failed to delete {count} alert | Failed to delete {count} alerts",
@@ -21285,7 +21706,6 @@
       "pleaseWaitWhileLoadingTemplates": "Please wait while loading templates...",
       "alertSavedSuccessfully": "Alert saved successfully.",
       "alertUpdatedSuccessfully": "Alert updated successfully.",
-      "openingDedupConfig": "Opening dedup configuration for: {name}",
       "editingAlert": "Editing alert: {name}",
       "ack": {
         "acked": "Acknowledged {name}",
@@ -22168,6 +22588,7 @@
     "modelPricingEditor": "Model Pricing Editor",
     "storageSettings": "Storage Settings",
     "domainManagement": "Domain Management",
+    "orgDomainMapping": "Domain management",
     "slackApp": "Slack",
     "regexPatterns": "Regex Patterns",
     "syntheticsLocations": "Synthetics Locations",
@@ -26097,7 +26518,7 @@
       "logged": "Logged"
     },
     "policy": {
-      "gateHint": "Among changes to existing alerts, only deduplication applies on its own, with a prior-state snapshot and a review window: kept if its checks pass, rolled back if they fail. Everything else waits for one-click approval.",
+      "gateHint": "Among changes to existing alerts, only turning on suppress repeats applies on its own, with a prior-state snapshot and a review window: kept if its checks pass, rolled back if they fail. Everything else waits for one-click approval.",
       "off": "Off",
       "suggest": "Suggest",
       "auto": "Auto",
@@ -26116,7 +26537,7 @@
         "gateDesc": "Hold the page until the investigation lands, for up to 2 minutes. Fails open: if triage times out or fails, it pages anyway, says the investigation is still running or failed, and the cause follows in the thread."
       },
       "classes": {
-        "EnableDeduplication": "Turn on deduplication for an alert that repeats within minutes.",
+        "EnableDeduplication": "Turn on suppress repeats for an alert that notifies on every evaluation.",
         "CreateDetector": "Create an anomaly detector on a service's requests, errors or latency.",
         "RaiseThreshold": "Raise a threshold that fires on healthy days.",
         "LengthenEvaluationWindow": "Lengthen the window of an alert that flaps.",
@@ -26665,10 +27086,10 @@
           "on": "connection alert"
         },
         "L-302": {
-          "done": "Grouped the 3 checkout latency alerts into one",
-          "why": "They went off together 94% of the time, so one slowdown paged you 3 times.",
-          "from": "3 alerts",
-          "to": "1",
+          "done": "Turned on suppress repeats for the 3 checkout latency alerts",
+          "why": "They notified on every evaluation while they stayed firing, so one slowdown paged you 120 times.",
+          "from": "Every evaluation",
+          "to": "Once per change",
           "on": "checkout latency"
         },
         "L-303": {
@@ -26725,7 +27146,7 @@
         "checkoutPaged": "I paged on-call about checkout failing payments.",
         "recsHeld": "I held a minor problem with recommendations for Friday's summary.",
         "diskApproved": "You approved raising the disk alert on ingest-1 to {to}%.",
-        "latencyGrouped": "I grouped the three checkout slowness alerts into one, so a single slowdown pages once.",
+        "latencyGrouped": "I turned on suppress repeats for the three checkout slowness alerts, so a single slowdown pages once.",
         "queueFixed": "I added orders queue workers, but the queue kept growing, so I put them back and paged on-call.",
         "loginPaged": "I paged on-call about slow sign-in.",
         "queuePermission": "You allowed me to add queue workers on my own, up to 8.",
@@ -28081,5 +28502,71 @@
       "legend": "Pipeline status",
       "legendToggle": "Show or hide this status on the map"
     }
+  },
+  "recentSearches": {
+    "title": "Recent searches",
+    "aboutKeptDays": "Only your searches in {org}, visible only to you. Kept {days} day; starred searches stay until you remove them. | Only your searches in {org}, visible only to you. Kept {days} days; starred searches stay until you remove them.",
+    "aboutKeptForever": "Only your searches in {org}, visible only to you. Kept until deleted.",
+    "pageTitle": {
+      "logs": "Recent logs searches",
+      "traces": "Recent traces searches",
+      "metrics": "Recent metrics searches",
+      "dbm": "Recent searches",
+      "profiles": "Recent searches"
+    },
+    "page": {
+      "logs": "Logs",
+      "traces": "Traces",
+      "metrics": "Metrics",
+      "dbm": "Database",
+      "profiles": "Profiles"
+    },
+    "allPages": "All pages",
+    "viewAll": "View all",
+    "failedCount": "{count} failed",
+    "keyHints": "↑↓ move · PgUp/PgDn scroll query · Enter run · Shift+Enter load only · Esc close",
+    "loadToFix": "Load to fix",
+    "emptyTitle": "No recent searches yet",
+    "loadError": "Couldn't load recent searches",
+    "retry": "Retry",
+    "warning": "Finished with a warning: timed out or partial results",
+    "failed": "Failed",
+    "ranCount": "ran {count}x",
+    "lineCount": "{count} line | {count} lines",
+    "relativeWindow": "Last {period}",
+    "rerunNow": "Re-run now",
+    "rerunOriginal": "At original time",
+    "loadOnly": "Load without running",
+    "copyLink": "Copy link",
+    "copyQuery": "Copy query",
+    "star": "Star",
+    "unstar": "Unstar",
+    "linkCopied": "Link copied",
+    "queryCopied": "Query copied",
+    "copyFunction": "Copy function",
+    "functionCopied": "Function copied",
+    "functionLabel": "Function (VRL)",
+    "searchPlaceholder": "Search queries and streams",
+    "allStreams": "All streams",
+    "statusAll": "Any status",
+    "statusOk": "Succeeded",
+    "statusError": "Failed",
+    "starredOnly": "Starred only",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "Filter by date run",
+    "today": "Today",
+    "yesterday": "Yesterday",
+    "noMatch": "No searches match these filters",
+    "reset": "Reset all",
+    "resetFilters": "Reset filters",
+    "loadMore": "Load more",
+    "clear": "Clear my history",
+    "confirmClear": "Clear history",
+    "clearBodyPage": "This removes your {count} recent {page} search in {org}. Saved views are not affected. | This removes your {count} recent {page} searches in {org}. Saved views are not affected.",
+    "clearBodyAll": "This removes your {count} recent search in {org} across Logs, Traces and Metrics. Saved views are not affected. | This removes your {count} recent searches in {org} across Logs, Traces and Metrics. Saved views are not affected.",
+    "includeStarred": "Also remove my {count} starred search | Also remove my {count} starred searches",
+    "recentRow": "Recent search",
+    "deletedQuery": "Deleted {query}",
+    "undo": "Undo"
   }
 }
diff --git a/web/src/locales/languages/es-ES.json b/web/src/locales/languages/es-ES.json
index 68ebd8ec6d..278fac3d27 100644
--- a/web/src/locales/languages/es-ES.json
+++ b/web/src/locales/languages/es-ES.json
@@ -486,7 +486,11 @@
       "monitors": "monitores",
       "modelPricing": "definiciones de precios de modelos",
       "variables": "variables",
-      "experiments": "experimentos"
+      "experiments": "experimentos",
+      "linkedDomains": "dominios vinculados",
+      "domainMappings": "asignaciones de dominio",
+      "domainRequests": "solicitudes de vinculación",
+      "blockedUsers": "usuarios bloqueados"
     },
     "demo": {
       "pageTitle": "Estados vacíos — conjunto completo para revisión",
@@ -572,6 +576,30 @@
       "action": "Nueva tarea",
       "actionDesc": "Apunta OpenObserve a tu endpoint y prueba la conexión."
     },
+    "noLinkedDomains": {
+      "title": "Aún no hay dominios vinculados",
+      "description": "Vincula un dominio de correo que te pertenezca para asignar sus usuarios a tus organizaciones y controlar quién puede iniciar sesión.",
+      "dns": "Agregar un registro DNS",
+      "dnsDesc": "Verifica la propiedad con un registro TXT",
+      "request": "Solicitar una vinculación",
+      "requestDesc": "Pide a OpenObserve que vincule el dominio por ti"
+    },
+    "noDomainMappings": {
+      "title": "Aún no hay asignaciones de dominio",
+      "description": "Agrega automáticamente los usuarios que inician sesión con un dominio verificado a esta organización o a los miembros de su grupo de facturación.",
+      "action": "Agregar asignación",
+      "actionDesc": "Elige un dominio, una organización y un rol"
+    },
+    "noBlockedUsers": {
+      "title": "No hay usuarios bloqueados",
+      "description": "Todos los usuarios de tus dominios verificados pueden unirse. Bloquea usuarios específicos para impedir su acceso.",
+      "action": "Bloquear usuarios",
+      "actionDesc": "Elige un dominio y los correos a bloquear"
+    },
+    "noDomainRequests": {
+      "title": "No hay solicitudes de vinculación",
+      "description": "Las solicitudes de organizaciones para vincular un dominio aparecen aquí."
+    },
     "noDowntimes": {
       "title": "Aún no hay periodos de mantenimiento",
       "description": "Un periodo de mantenimiento mantiene en ejecución las alertas, las detecciones de anomalías y las comprobaciones sintéticas, y detiene sus notificaciones durante una ventana que tú programes.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Desactivar el modo Live",
     "autoRefreshWithValue": "Actualización automática: {value}",
     "searchHistory": "Historial de búsqueda",
+    "usageCostHistory": "Historial de uso y coste",
     "createScheduledSearch": "Crear búsqueda programada",
     "listScheduledSearch": "Listar búsqueda programada",
     "scheduleSearchJob": "Programar trabajo de búsqueda",
@@ -1355,6 +1384,8 @@
     "scanSize": "Tamaño de escaneo",
     "deltaScanSize": "Tamaño de escaneo delta",
     "scannedSoFar": "Escaneado {size}",
+    "quickModeHiddenFields": "El modo rápido está activado. Esta fila muestra {shown} de {total} campos.",
+    "turnOffQuickMode": "Desactivar modo rápido",
     "resultsProgressLabel": "Progreso de la búsqueda",
     "histogramTitleError": "Error al generar el título del histograma.",
     "selectLogStream": "Seleccione el stream de logs",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Sin datos de red para esta vista",
     "apiEmptyDescription": "El stream seleccionado no tiene solicitudes de recursos ni de red en este rango de tiempo. Las métricas de red aparecen una vez que la aplicación instrumenta sus llamadas HTTP.",
     "skipInactivity": "Omitir inactividad",
+    "fullScreen": "Pantalla completa",
+    "exitFullScreen": "Salir de pantalla completa",
     "error": "Error",
     "errorCount": "Recuento de errores",
     "all": "Todas",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Añade un segundo paso para añadir este embudo a un dashboard",
         "snapshot": "El panel conserva estos pasos, filtros y reglas de eventos con nombre tal como están ahora."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Resumen de rendimiento",
+      "filterService": "Servicio",
+      "filterEnv": "Entorno",
+      "filterVersion": "Versión",
+      "filterAll": "Todos",
+      "verdictPass": "Core Web Vitals correctos",
+      "verdictFail": "Core Web Vitals requieren atención",
+      "verdictAllPass": "Todos correctos",
+      "verdictNeedWork": "{count} de {total} requiere atención | {count} de {total} requieren atención",
+      "percentileLabel": "Percentil",
+      "bandGood": "Bueno",
+      "bandNeeds": "Requiere atención",
+      "bandPoor": "Deficiente",
+      "bandGoodPct": "{n}% bueno",
+      "bandNeedsPct": "{n}% requiere atención",
+      "bandPoorPct": "{n}% deficiente",
+      "bandAria": "{good}% bueno, {needs}% requiere atención, {poor}% deficiente",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} más rápido",
+      "deltaSlower": "{v} más lento",
+      "deltaNone": "sin cambios",
+      "deltaNoPrev": "no hay suficientes datos anteriores",
+      "kpiSessions": "Sesiones",
+      "kpiErrorFree": "Sesiones sin errores",
+      "kpiErrors": "Errores totales",
+      "kpiUnhandled": "Errores no controlados",
+      "kpiRegion": "Indicadores clave",
+      "sparkAria": "Tendencia de {label} en el intervalo seleccionado",
+      "chartTitle": "Sesiones y errores",
+      "chartInterval": "por intervalo",
+      "legendSessions": "Sesiones",
+      "legendErrors": "Errores",
+      "releaseMarker": "Primera aparición de {version}: {time}",
+      "chartTableToggle": "Mostrar tabla de datos",
+      "chartTableHide": "Ocultar tabla de datos",
+      "chartTime": "Hora",
+      "pagesTitle": "Páginas que corregir primero",
+      "pagesHint": "Ordenadas por impacto: tráfico ponderado por la proporción de vistas con una métrica vital que supera su umbral o con un error. Haz clic en una página para ver sus sesiones, o en un recuento de errores para abrir Error Tracking.",
+      "pagesColPage": "Página",
+      "pagesColViews": "Vistas",
+      "pagesColErrors": "Errores",
+      "pagesColImpact": "Impacto",
+      "pagesLegend": "▲ requiere atención · ■ deficiente · sin marca, bueno. Las páginas con menos de {n} vistas están ocultas.",
+      "pagesOpenSessions": "Abrir sesiones de {path}",
+      "pagesOpenErrors": "{count} error, abrir Error Tracking | {count} errores, abrir Error Tracking",
+      "pagesImpactAria": "Impacto {n} de 100",
+      "markNeeds": "requiere atención",
+      "markPoor": "deficiente",
+      "diffTitle": "Mayor diferencia",
+      "diffBody": "INP p75 es {inp}, {ratio}x los otros segmentos. Una correlación que investigar, no una causa probada.",
+      "diffNone": "Ningún segmento destaca sobre los demás en este rango.",
+      "diffLink": "Ver sesiones afectadas",
+      "segmentLabel": "Segmento",
+      "segBrowser": "Navegador",
+      "segDevice": "Dispositivo",
+      "segCountry": "País",
+      "segInp": "INP {v}",
+      "segShare": "{n}% de las vistas",
+      "segNone": "No hay datos para este segmento.",
+      "releaseTitle": "Comparación de versiones",
+      "releaseHint": "{cur} frente a {prev}. El inicio de la versión es la primera vez que se detecta una versión.",
+      "releaseMetric": "Métrica",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Sin errores",
+      "releaseSessions": "Sesiones",
+      "releaseLink": "Errores en {version}",
+      "frustrationTitle": "Frustración del usuario",
+      "frustrationHint": "Problemas que los Core Web Vitals no detectan",
+      "rageClicks": "Clics de frustración",
+      "deadClicks": "Clics muertos",
+      "stateLoading": "Cargando {panel}…",
+      "stateEmptyTitle": "No hay vistas de página en este rango",
+      "stateEmptyBody": "Amplía el rango temporal, borra un filtro o comprueba que el SDK del navegador envía eventos de vista.",
+      "stateEmptyAction": "Configurar el SDK",
+      "stateLowTitle": "Solo {count} vista de página | Solo {count} vistas de página",
+      "stateLowBody": "Los percentiles no son fiables con menos de {min} vistas, así que el veredicto está oculto. Los valores se muestran como referencia.",
+      "stateErrorTitle": "No se pudo cargar {panel}",
+      "stateErrorBody": "La consulta falló o se agotó el tiempo de espera. Los demás paneles no se ven afectados.",
+      "retry": "Reintentar",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "indicadores clave",
+      "panelPages": "páginas",
+      "panelSegments": "segmentos",
+      "panelRelease": "comparación de versiones",
+      "panelFrustration": "frustración del usuario",
+      "schemaErrorTitle": "No se pudo cargar el esquema de RUM",
+      "schemaErrorBody": "No se pudieron leer los campos del stream, así que la vista general no puede decidir qué paneles mostrar.",
+      "pagesShowAll": "Mostrar las {n} páginas",
+      "pagesShowFewer": "Mostrar menos páginas",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "No hay páginas con suficientes vistas",
+      "pagesEmptyBody": "Las páginas necesitan al menos {n} vistas en este rango para poder clasificarse.",
+      "segEmptyTitle": "No hay datos de segmentos",
+      "segEmptyBody": "No se registraron valores de navegador, dispositivo, SO, país ni conexión para estas vistas.",
+      "releaseEmptyTitle": "Se necesitan dos versiones",
+      "releaseEmptyBody": "La comparación de versiones necesita al menos dos versiones vistas en este rango.",
+      "releaseBefore": "{version} ya estaba activa antes de este rango, por lo que no se muestra cuándo se vio por primera vez.",
+      "pageErrorTitle": "No se pudo cargar la descripción general del rendimiento",
+      "pageErrorBody": "Las consultas fallaron o agotaron el tiempo de espera. Reinténtalo para volver a cargar todos los paneles.",
+      "verdictOver": "{vital} supera el umbral bueno de {threshold} en el {pct}% de las vistas de página.",
+      "verdictAllThree": "Los tres Core Web Vitals cumplen en el p75.",
+      "verdictAllSome": "Los {n} Core Web Vitals evaluados cumplen en el p75.",
+      "releaseNewErrors": "{count} error nuevo en esta versión | {count} errores nuevos en esta versión",
+      "verdictNoData": "No hay datos de Core Web Vitals",
+      "verdictNoDataLead": "Ninguna de las {count} vistas de página de este rango notificó LCP, INP ni CLS. | Ninguna de las {count} vistas de página de este rango notificó LCP, INP ni CLS.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Abrir sesiones.",
+      "pagesTableLabel": "Páginas ordenadas por impacto",
+      "verdictSessions": "{count} sesión en el rango. | {count} sesiones en el rango.",
+      "verdictCompare": "Comparado con el periodo anterior.",
+      "deltaLower": "{v} menos",
+      "deltaHigher": "{v} más",
+      "forbiddenTitle": "Sin permiso para ver {panel}",
+      "forbiddenBody": "Pide a un administrador acceso al stream de datos de RUM.",
+      "pageForbiddenTitle": "Sin permiso para ver la descripción general del rendimiento",
+      "asideLabel": "Dónde y qué cambió",
+      "pagesAbout": "Acerca de esta clasificación",
+      "chartPerFiveMinutes": "cada 5 minutos",
+      "chartPerThirtyMinutes": "cada 30 minutos",
+      "chartPerHour": "cada hora",
+      "chartPerSixHours": "cada 6 horas",
+      "chartPerDay": "cada día",
+      "chartIntervalOther": "por intervalo",
+      "chartTableCaption": "Sesiones y errores por intervalo",
+      "deltaChange": "{delta} frente al periodo anterior",
+      "deltaChangePts": "{delta} pts frente al periodo anterior",
+      "deltaFlat": "Sin cambios frente al periodo anterior",
+      "deltaNewMsg": "Nuevo frente al periodo anterior",
+      "verdictP75Note": "El veredicto siempre usa p75; p50 y p95 solo cambian los valores.",
+      "releaseNote": "Compara las dos últimas versiones, independientemente de lo que indique el filtro Versión.",
+      "kpiEmptyTitle": "No hay sesiones en este rango",
+      "kpiEmptyBody": "Amplía el rango de tiempo o borra un filtro.",
+      "releaseImproved": "mejoró",
+      "releaseWorse": "empeoró",
+      "segOs": "SO",
+      "segConnection": "Conexión",
+      "pagesAllLink": "Todas las páginas",
+      "pagesAllLinkAria": "Todas las páginas en Analítica de producto",
+      "frustrationReplayLink": "Ver una repetición",
+      "frustrationReplayHint": "Abre las sesiones frustradas de este rango; las que se grabaron tienen una repetición.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "No se registró nada en este rango. Amplía el rango de tiempo o configura el SDK del navegador si esta aplicación aún no ha enviado datos.",
+      "stateEmptyFiltered": "Nada coincide con estos filtros en este rango. Borra los filtros para ver todos los servicios, entornos y versiones.",
+      "clearFilters": "Borrar filtros",
+      "stateRefreshing": "Actualizando {panel}",
+      "tileOpenSessions": "{label}: {value}. Abrir sesiones",
+      "tileOpenErrors": "{label}: {value}. Abrir seguimiento de errores",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Esta descripción general solo cuenta las sesiones del navegador. Las métricas de la aplicación móvil aparecen a continuación.",
+      "mixedMobileNote": "Los filtros siguientes solo se aplican a las métricas de la aplicación móvil."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Eliminar",
     "confirmDeleteHead": "Eliminar usuario",
     "confirmDeleteMsg": "¿Seguro que quieres eliminar el usuario {name}?",
+    "block": "Bloquear",
+    "confirmBlockHead": "Bloquear usuario",
+    "confirmBlockMsg": "{email} se unió a través de tu dominio verificado. Al bloquearlo, se agrega a las restricciones de dominio de esta organización y se elimina de esta organización. Se eliminará de otras organizaciones asignadas en su próximo inicio de sesión.",
     "cancel": "Cancelar",
     "save": "Guardar",
     "ok": "Aceptar",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Revocar invitación",
     "revokeInvitationMsg": "¿Estás seguro de que quieres revocar la invitación de {email}?",
     "deleteUsersTitle": "Eliminar usuarios",
-    "deleteUsersMsg": "¿Estás seguro de que deseas eliminar {count} usuario? | ¿Estás seguro de que deseas eliminar {count} usuarios?"
+    "deleteUsersMsg": "¿Estás seguro de que deseas eliminar {count} usuario? | ¿Estás seguro de que deseas eliminar {count} usuarios?",
+    "deleteUsersBlockNote": "{count} de ellos se unieron a través de tu dominio verificado y se bloquearán en lugar de eliminarse."
   },
   "invitation": {
     "pendingInvitations": "Invitaciones pendientes",
@@ -3403,8 +3597,6 @@
       },
       "show": "Mostrar",
       "searchPermissions": "Buscar permisos",
-      "filterModules": "Filtrar módulos",
-      "noModuleMatch": "Ningún módulo coincide con tu filtro",
       "moduleScopeAll": "Todos",
       "moduleScopeGranted": "Seleccionados",
       "noGrantedModule": "Aún no se ha seleccionado ningún módulo",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Concesión | Concesiones",
       "summaryReachSome": "{count} de {total}",
       "summaryEmptyTitle": "Este rol aún no concede nada",
-      "summaryEmptyDescription": "Elige un módulo a la izquierda o empieza desde un preajuste.",
+      "summaryEmptyDescription": "Empieza desde un preajuste o elige módulos de la lista.",
       "presetReadonlyTitle": "Solo lectura",
       "presetReadonlyDescription": "Listar y obtener en cada módulo",
       "presetDbmTitle": "Visualizador de monitorización de bases de datos",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "Ninguno de los {total} streams de métricas de Kubernetes existe todavía en esta organización, por lo que no se preseleccionó nada.",
       "rumPresetSeeded": "Acceso de lectura preseleccionado en {matched} de {total} streams de RUM, además de mapas de origen y cualquier permiso de Product Analytics de RUM. Revísalo antes de guardar.",
       "rumPresetNoMatch": "Ninguno de los {total} streams de RUM existe aún en esta organización, por lo que no se preseleccionó nada en ellos; los mapas de origen y cualquier permiso de Product Analytics de RUM sí se prepararon.",
-      "moduleGroupFleet": "Flota"
+      "moduleGroupFleet": "Flota",
+      "filterModulesTasks": "Filtrar módulos",
+      "noModuleMatchQuery": "Ningún módulo coincide con «{query}»",
+      "noModuleMatchHint": "Busca por módulo, grupo o tarea, por ejemplo slack, panel o token.",
+      "presetAlertManagerTitle": "Gestor de alertas",
+      "presetAlertManagerDescription": "Crear y gestionar alertas, sus destinos y sus mensajes",
+      "presetAlertViewerTitle": "Visualizador de alertas",
+      "presetAlertViewerDescription": "Ver alertas, destinos y plantillas sin modificarlos",
+      "presetDashboardEditorTitle": "Editor de dashboards",
+      "presetDashboardEditorDescription": "Crear y editar dashboards, con acceso de lectura a los datos que consultan",
+      "presetDashboardViewerTitle": "Visualizador de dashboards",
+      "presetDashboardViewerDescription": "Abrir dashboards y leer los datos detrás de sus paneles",
+      "presetPipelineEditorTitle": "Editor de pipelines",
+      "presetPipelineEditorDescription": "Crear pipelines y funciones, con acceso de lectura a los streams y las tablas de enriquecimiento",
+      "presetApplied": "{title} ha añadido {permissions}. Revisa los cambios antes de guardar.",
+      "presetPermissionCount": "{count} permiso | {count} permisos",
+      "companionReasonAlertStreams": "para guardar alertas. El servidor comprueba el acceso a los streams al guardar",
+      "companionReasonAlertDestinations": "para elegir adónde se envían las alertas",
+      "companionReasonDestinationTemplates": "para elegir la plantilla del mensaje, que todo destino requiere",
+      "companionReasonDashboardStreams": "para cargar los datos de los paneles",
+      "presetsTitle": "Preajustes",
+      "presetsClose": "Cerrar preajustes",
+      "presetsShow": "Mostrar preajustes",
+      "presetsSubtitle": "Añade a este rol las concesiones de un preajuste. No se quita nada.",
+      "presetsSectionBuiltin": "Integrados",
+      "presetsSectionJob": "Por puesto",
+      "presetAddsTooltip": "Añade {count} permiso | Añade {count} permisos",
+      "presetInRole": "En el rol",
+      "presetInRoleTooltip": "Este rol ya tiene todo lo de este preajuste",
+      "presetBack": "Todos los preajustes",
+      "presetModuleCount": "{count} módulo | {count} módulos",
+      "presetSummaryAdds": "Añade {permissions} en {modules}.",
+      "presetSummaryWrite": "Acceso de escritura en {modules}.",
+      "presetSummaryViewOnly": "Solo lectura: no se puede crear, editar ni eliminar nada.",
+      "presetSummaryHasAll": "Este rol ya tiene todo lo de este preajuste.",
+      "presetSummarySkipped": "Se omite {count} permiso que este rol ya tiene. | Se omiten {count} permisos que este rol ya tiene.",
+      "presetStillMissing": "Aún faltará después de añadirlo: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "No faltará nada después de añadirlo.",
+      "neededBy": "Necesario para {modules}",
+      "stillNeededBy": "Aún necesario para {modules}",
+      "presetReadsEveryStream": "Lee todos los streams de esta organización, incluidos los nuevos.",
+      "presetAddButton": "Añadir {count} permiso | Añadir {count} permisos",
+      "presetNothingToAdd": "Nada que añadir",
+      "presetApplyNote": "Las concesiones añadidas pasan a ser cambios sin guardar. Revísalas antes de guardar.",
+      "presetLoadingStreams": "Cargando streams",
+      "presetNoMatchingStreams": "Aún no hay streams coincidentes en esta organización.",
+      "reviewMissingTooltip": "Falta {count} módulo para que este rol funcione | Faltan {count} módulos para que este rol funcione",
+      "notAddedYetTitle": "Aún no añadidos · {modules}",
+      "companionAdd": "Añadir",
+      "companionAddItem": "Añadir {item}",
+      "companionAddAll": "Añadir todo",
+      "companionOpenStreams": "Abrir streams",
+      "companionOpenStreamsTooltip": "Elige qué streams puede leer este rol",
+      "companionNeeds": "{module} lo necesita {reason}.",
+      "companionNeedsThis": "{module} necesita esto {reason}.",
+      "companionStillNeedsThis": "{module} todavía necesita esto {reason}.",
+      "yourChanges": "Tus cambios",
+      "yourChangesCount": "{changes} en {modules}",
+      "yourChangesNone": "Ninguno todavía",
+      "changeCount": "{count} cambio | {count} cambios",
+      "changeOtherGroup": "Otros",
+      "saveSuccessCounts": "Guardado: {changes} en {modules}.",
+      "effectCan": "Puede {actions} {target}.",
+      "effectCannot": "Ya no puede {actions} {target}.",
+      "effectCanLoadDestinations": "Puede cargar la lista de destinos.",
+      "effectCannotLoadDestinations": "Ya no puede cargar la lista de destinos.",
+      "effectCanLoadTemplates": "Puede cargar la lista de plantillas.",
+      "effectCannotLoadTemplates": "Ya no puede cargar la lista de plantillas.",
+      "verbView": "ver",
+      "verbSeeListOf": "ver en la lista",
+      "verbList": "listar",
+      "verbOpen": "abrir",
+      "verbCreate": "crear",
+      "verbEdit": "editar",
+      "verbDelete": "eliminar",
+      "targetEveryStream": "todos los streams (logs, métricas, trazas e índices), incluidos los nuevos",
+      "targetTypeStreams": "todos los streams de {type}",
+      "targetOneStream": "el stream de {type} {name}",
+      "targetAlertsEveryFolder": "las alertas de todas las carpetas, incluidas las carpetas nuevas",
+      "targetAlertsInFolder": "las alertas de la carpeta {name}",
+      "targetOneAlert": "la alerta {name}",
+      "targetDashboardsEveryFolder": "los dashboards de todas las carpetas, incluidas las carpetas nuevas",
+      "targetDashboardsInFolder": "los dashboards de la carpeta {name}",
+      "targetOneDashboard": "el dashboard {name}",
+      "targetReportsEveryFolder": "los informes de todas las carpetas, incluidas las carpetas nuevas",
+      "targetReportsInFolder": "los informes de la carpeta {name}",
+      "targetOneReport": "el informe {name}",
+      "targetEveryDestination": "todos los destinos de alertas (Slack, correo electrónico, webhooks), incluidos los nuevos",
+      "targetOneDestination": "el destino {name}",
+      "targetEveryTemplate": "todas las plantillas de notificación, incluidas las nuevas",
+      "targetOneTemplate": "la plantilla {name}",
+      "targetAllOf": "todos los {module}, incluidos los nuevos",
+      "targetItemIn": "{name} en {module}",
+      "noteDestinationsFiltered": "Solo ven los destinos que también pueden abrir. Añade «Obtener» aquí, o en destinos concretos, para elegir cuáles.",
+      "noteTemplatesFiltered": "Solo ven las plantillas que también pueden abrir. Añade «Obtener» aquí, o en plantillas concretas, para elegir cuáles.",
+      "presetStreamsFailed": "No se pudo cargar la lista de streams.",
+      "presetRetry": "Reintentar",
+      "presetRestored": "{title} ha restaurado {permissions}. Revisa los cambios antes de guardar.",
+      "presetSummaryRestores": "Conserva {count} permiso que marcaste para eliminar. | Conserva {count} permisos que marcaste para eliminar.",
+      "presetRestoreButton": "Conservar {count} permiso | Conservar {count} permisos",
+      "effectStillAllowed": "Sin cambios en el acceso: un permiso más amplio sigue permitiéndolo."
     },
     "rolesPage": {
       "subtitle": "Los roles agrupan permisos: asígnelos a usuarios, cuentas de servicio o grupos para conceder acceso.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Usuario actualizado exitosamente.",
       "userDeletedSuccess": "Usuario eliminado exitosamente.",
       "errorDeletingUser": "Error al eliminar el usuario.",
+      "userBlockedSuccess": "Usuario bloqueado correctamente.",
+      "errorBlockingUser": "Error al bloquear el usuario.",
+      "blockedButNotRemoved": "El usuario se bloqueó, pero no se pudo eliminar de esta organización.",
+      "blockedUsersSuccess": "Se bloqueó correctamente {count} usuario | Se bloquearon correctamente {count} usuarios",
+      "blockedUsersPartial": "Se bloqueó y eliminó {count} usuario, pero no fue posible eliminar {failed} de esta organización | Se bloquearon y eliminaron {count} usuarios, pero no fue posible eliminar {failed} de esta organización",
+      "blockedUsersNotRemoved": "Se bloqueó {count} usuario, pero no fue posible eliminarlo de esta organización | Se bloquearon {count} usuarios, pero no fue posible eliminarlos de esta organización",
       "pleaseWait": "Espere...",
       "invitationRevokedSuccess": "Invitación revocada exitosamente.",
       "errorRevokingInvitation": "Error al revocar la invitación.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Las trazas se capturan con eBPF: no se necesitan cambios en el código ni SDK. El contexto de traza solo se propaga entre servicios por HTTP en texto plano (en apps Go también por HTTPS, salvo en nodos con kernel lockdown). Se traza un proceso que coincida con cualquiera de los puertos, la ruta del ejecutable o la línea de comandos; los globs no pueden contener `,`, `{'{'}` ni `{'}'}`, y un puerto coincide con cualquier proceso que tenga un socket en él. Requiere Helm 3.14+ y el operador de OpenTelemetry v0.142.0+; si el tuyo es anterior, actualízalo primero con `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Si eBPF ya estaba activado con un operador anterior, vuelve a ejecutar el comando con `--force` (`--force-replace` en Helm 4). Volver a ejecutar el comando de instalación de arriba restablece la release y desactiva eBPF, así que ejecuta este comando de nuevo después. El namespace `openobserve-collector` debe permitir pods privilegiados, y los nodos deben ejecutar Linux en amd64 o arm64 con kernel 5.8+ (o la familia RHEL 4.18 con backports de eBPF) y BTF. No selecciones aplicaciones que ya envíen sus propias trazas ni pods que usen el sidecar de Go `inject-go`.",
       "k8sEbpfVariant": "eBPF (cualquier lenguaje, sin cambios de código)",
       "k8sLibrariesVariant": "Bibliotecas de lenguaje (autoinstrumentación)",
+      "k8sNetworkFlowsDesc": "El DaemonSet eBPF del collector registra los **bytes enviados entre cargas de trabajo por cualquier protocolo TCP o UDP** en cada nodo Linux, incluidas las bases de datos, las cachés y otros servicios que no se trazan. Llegan como la métrica `obi_network_flow_bytes`, etiquetada con el propietario de origen y destino (Deployment, StatefulSet, Node, …) y el espacio de nombres. Funciona con o sin trazado eBPF.",
+      "k8sNetworkFlowsNote": "Requiere Helm 3.14+ y el operador OpenTelemetry v0.142.0+. El espacio de nombres `openobserve-collector` debe permitir pods privilegiados, y los nodos deben ejecutar Linux en amd64 o arm64 con kernel 5.8+ (o familia RHEL 4.18 con backports de eBPF) y BTF. Los pods de eBPF se ejecutan en la red del host, y las métricas propias del colector escuchan en `127.0.0.1:8888` de cada nodo, por lo que ese puerto debe estar libre allí. Se conservan los selectores de trazas de eBPF que ya haya definido. Volver a ejecutar el comando de instalación anterior restablece la versión desplegada y desactiva esta opción, así que vuelva a ejecutar este comando después. Los mismos bytes pueden registrarse más de una vez: el tráfico entre nodos lo registran ambos nodos, y una conexión a un Service se registra tanto en el Service como en la carga de trabajo que hay detrás. La guía de flujos de red de eBPF explica cómo consultarlos sin contarlos dos veces.",
+      "k8sNetworkFlowsTitle": "Descubre qué cargas de trabajo se comunican entre sí: flujos de red eBPF",
       "k8sInstallerNote": "Esto instala cert-manager, el operador de OpenTelemetry y el colector de OpenObserve automáticamente.",
       "k8sInternalEndpointNote": "Usa esto cuando OpenObserve se ejecute en este mismo clúster — el tráfico nunca sale de él.",
       "k8sTroubleAnnotationA": "La inyección ocurre al crear el pod, por lo que los pods existentes no se ven afectados hasta que se reinician — ejecuta `kubectl rollout restart deployment -n my-namespace`. Confirma que la anotación se aplicó con `kubectl get ns my-namespace -o yaml`, y comprueba que el valor coincide con `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "La instalación falla con un error sobre el webhook de admisión",
       "linuxAgentFixBody": "El instalador inicia el agente como un servicio systemd. Si no llega nada, confirma que esté ejecutándose y lee sus logs en busca de un error de autenticación o conectividad:",
       "linuxTracesNote": "Las trazas se capturan con eBPF: no se necesitan cambios en el código ni SDK. Se traza un proceso que coincida con cualquiera de los puertos, la ruta del ejecutable o la línea de comandos; los globs no pueden contener `,`, `{'{'}` ni `{'}'}`. El trazado requiere Linux 5.8+ (o la familia RHEL 4.18 con backports de eBPF) con BTF; el agente se ejecuta entonces como root. Si el host no puede realizar el trazado, la instalación se detiene y deja intacto el agente en ejecución. Si después el agente no logra iniciarse con el trazado activado, este se desactiva —también los logs y las métricas— hasta que vuelvas a ejecutar el comando **Logs y métricas**, o corrijas la causa y vuelvas a ejecutar con trazado. Las aplicaciones trazadas añaden un encabezado W3C `traceparent` a las solicitudes HTTP salientes de texto plano. La guía de trazado con eBPF que aparece a continuación cubre HTTPS y las flags repetidas.",
+      "linuxNetworkFlowsDesc": "Ejecuta el instalador con `--network-flows` para notificar los **bytes que este host envía y recibe por cualquier protocolo TCP o UDP**, como la métrica `obi_network_flow_bytes`. Cada flujo se etiqueta con `src_cidr` y `dst_cidr` con las redes que indiques, así que da a cada host la misma lista: una entrada `/32` por host genera un mapa host a host.",
+      "linuxNetworkFlowsNote": "Requiere Linux 5.8+ (o familia RHEL 4.18 con backports de eBPF) con BTF; en ese caso, el agente se ejecuta como root. Funciona con o sin trazas, pero cada ejecución del instalador reemplaza la configuración del agente: para mantener las trazas activadas, añada las opciones `--trace-*` y `--service-name` del comando **Logs, métricas y trazas de eBPF**. Si el host no puede ejecutar eBPF, la instalación se detiene y deja intacto el agente en ejecución. Si entonces la captura de red no logra iniciarse, el agente se desactiva —también los logs y las métricas— hasta que vuelva a ejecutar el comando **Logs y métricas**, o corrija la causa y vuelva a ejecutar con `--network-flows`. El tráfico entre dos hosts que ejecutan el agente lo registra cada uno de ellos, y el tráfico de loopback se cuenta a menos que ambos extremos tengan la misma dirección. La guía de flujos de red de eBPF que aparece a continuación explica las etiquetas y cómo consultarlas sin contar dos veces.",
+      "linuxNetworkFlowsTitle": "Descubre qué hosts se comunican entre sí: flujos de red eBPF",
       "linuxTracesVerifyNote": "Con el trazado activado, las trazas aparecen en cuanto una app trazada atiende una solicitud.",
+      "ebpfNetworkFlowsGuideLink": "Guía de flujos de red eBPF",
       "ebpfTracingGuideLink": "Guía de trazado eBPF",
       "logsMetricsTracesVariant": "Logs, métricas y trazas de eBPF",
       "logsMetricsVariant": "Registros y métricas",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Apunta cualquier exportador de OpenTelemetry a OpenObserve: colector o SDK, HTTP o gRPC. Tu endpoint y token se completan a continuación.",
       "taglineWindows": "Instala el agente de OpenObserve en cualquier host Windows: Registro de eventos, contadores de rendimiento y métricas del host.",
       "testAgain": "Probar de nuevo",
+      "networkFlowsHelp": "Entradas CIDR o CIDR=NOMBRE, separadas por comas y sin espacios; cada CIDR necesita una longitud de prefijo, p. ej. 10.0.1.5/32, y los nombres solo pueden contener letras, dígitos, ., _ y -. Las direcciones que no coincidan con ninguna entrada se dejan sin etiqueta; 0.0.0.0/0=other nombra el resto de IPv4 y ::/0=other6 el resto de IPv6.",
+      "networkFlowsLabel": "Redes a etiquetar",
+      "networkFlowsRequired": "Indica al menos una red: los flujos se etiquetan con las redes que indiques.",
       "traceCmdHelp": "Para apps de Python, Node.js y Java.",
       "traceCmdLabel": "Línea de comandos",
       "traceExeLabel": "Ruta del ejecutable",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Ocultar celdas por debajo de",
     "heatmapHideBelowTooltip": "Las celdas con un valor inferior quedan vacías.",
     "heatmapHideBelowNote": "Las celdas por debajo de {value} están ocultas",
+    "boxplotWhisker": "Bigotes",
+    "boxplotWhiskerMinMax": "Mínimo a máximo",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Campo de mensaje",
+    "logsLevelField": "Campo de nivel",
+    "logsTimeField": "Campo de hora",
+    "htmlPanelFieldTooltip": "Déjalo vacío para detectar la columna a partir de los resultados de la consulta",
+    "logsOrder": "Orden",
+    "logsOrderNewest": "Más recientes primero",
+    "logsOrderOldest": "Más antiguos primero",
+    "logsOrderTooltip": "Ordena las filas que devuelve la consulta. Una consulta inicial sin cambios también se obtiene en este orden, así que «Más antiguos primero» muestra los registros más tempranos.",
+    "logsShowTime": "Mostrar hora",
+    "logsWrap": "Ajustar líneas",
+    "logsPrettifyJson": "Formatear JSON",
     "distributionBucketCount": "Número de intervalos",
     "distributionBucketSize": "Tamaño del intervalo",
     "distributionBucketSizeTooltip": "Ancho de cada intervalo en las unidades del campo. Si se define, sustituye al número de intervalos.",
@@ -7822,6 +8145,8 @@
       "gauge": "Medidor",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Diagrama de caja",
+      "logs": "Registros",
       "barGauge": "Indicador de barras",
       "distribution": "Distribución",
       "treemap": "Mapa de árbol",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: Falta un argumento obligatorio en la posición {index}",
       "fieldNotAllowedForMetric": "El campo {label} no está permitido para el gráfico de métrica",
       "rawValueSampled": "Basado en las primeras {count} filas",
+      "addAtMostOneFieldFor": "Añade como máximo un campo para {label}",
+      "boxplotMin": "Mín",
+      "boxplotMax": "Máx",
+      "boxplotLowerWhisker": "Bigote inferior",
+      "boxplotUpperWhisker": "Bigote superior",
+      "boxplotMedian": "Mediana",
+      "boxplotSamples": "Muestras",
+      "boxplotOutlier": "Valor atípico",
       "fieldNotAllowedForDistribution": "El campo {label} no está permitido en el gráfico de distribución",
       "distributionCount": "Recuento",
       "addAtLeastOneFieldFor": "Añade al menos un campo para {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Sin acceso",
       "urlHiddenHint": "No puedes ver el dashboard de este enlace, así que su URL pública está oculta.",
       "orgDisabledHint": "Los enlaces públicos están desactivados para esta organización",
+      "orgDisabledBanner": "Los enlaces públicos están desactivados para esta organización, por lo que no se sirve ningún enlace. Un administrador puede volver a activarlos.",
+      "disabledPaused": "Desactivado · En pausa",
       "takeOver": "Hacerse cargo",
       "takeOverTitle": "¿Hacerte cargo de este enlace?",
       "takeOverBody": "Pasarás a ser el publicador. La página pública mostrará lo que tienes permiso para ver, que puede ser más o menos que antes. Quien tenga la URL conserva el acceso, y el enlace se activa ahora.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Grupo",
     "wellSubgroup": "Subgrupo",
     "wellSize": "Tamaño",
+    "wellCategory": "Categoría",
     "value": "Valor"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Aleja el valor de disparo del estado estable observado.",
       "lengthenEvaluationWindow": "Ampliar la ventana de evaluación",
       "lengthenEvaluationWindowDesc": "Amplía el período para que un pico breve ya no dispare la alerta.",
-      "enableDeduplication": "Activar la deduplicación",
-      "enableDeduplicationDesc": "Agrupa los disparos repetidos dentro de una ventana de deduplicación.",
+      "enableDeduplication": "Activar la supresión de repeticiones",
+      "enableDeduplicationDesc": "Notificar una vez por cada cambio de estado en lugar de en cada evaluación.",
       "reviewForDeletion": "Revisar para eliminar",
       "reviewForDeletionDesc": "Confirma que la consulta sigue coincidiendo con la realidad antes de retirar la alerta.",
       "fixAlertQuery": "Corregir la consulta de la alerta",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "ID de organización",
     "alertCreationTitle": "Creación de alerta",
     "noAlertsFound": "No se encontraron alertas",
-    "suppressedByDeduplication": "Suprimido por deduplicación",
-    "occurrence": "{count} ocurrencia | {count} ocurrencias",
     "groupedNotification": "Notificación agrupada",
     "alertsBatchedTogether": "alertas agrupadas en lote",
-    "notificationSent": "Notificación enviada",
-    "occurrencesDeduplicated": "ocurrencias deduplicadas",
     "alertExecutionDetails": "Detalles de ejecución de alerta",
     "evaluationTime": "Tiempo de evaluación",
     "queryTime": "Tiempo de consulta",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "Hasta: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Correlación temporal",
     "serviceGraphTooltipServiceDependency": "Dependencia de servicios",
-    "totalAlerts": "Total de alertas",
-    "usingDeduplication": "Usando deduplicación",
-    "deduplicationConfiguredTooltip": "Alertas con deduplicación configurada",
-    "suppressionRate24h": "Tasa de supresión (24h)",
     "suppressed": "suprimidos /",
-    "total": "total",
-    "passedLabel": "Aprobados:",
-    "pendingBatches": "Lotes pendientes",
-    "pendingBatchesTooltip": "Alertas esperando agruparse",
     "historyTimeline": {
       "firing": "Disparada",
       "ok": "Ok",
@@ -10089,7 +10413,8 @@
     "endTime": "Hora de fin",
     "duration": "Duración",
     "retries": "Reintentos",
-    "dedup": "Deduplicación",
+    "suppression": "Supresión",
+    "suppressedAsRepeat": "Suprimida como repetición",
     "validation": {
       "streamTypeRequired": "El tipo de Stream es obligatorio.",
       "streamNameRequired": "El nombre del Stream es obligatorio.",
@@ -10281,15 +10606,6 @@
     "all": "Todas",
     "history": "Historial de alertas",
     "searcHistory": "Introduzca el nombre de la alerta",
-    "deduplication": {
-      "fingerprintFields": "Agrupar alertas similares por",
-      "fingerprintFieldsHint": "Selecciona los campos que hacen que las alertas sean similares (p. ej., hostname, service). Déjalo vacío para detectarlos automáticamente según tu consulta.",
-      "fingerprintFieldsTooltip": "Elige qué campos deben coincidir para que las alertas se consideren duplicadas. Por ejemplo, seleccionar 'hostname' significa que las alertas del mismo host se agruparán. Los distintos tipos de alertas (p. ej., CPU alta frente a memoria alta) nunca se agrupan, aunque procedan del mismo host. Déjalo vacío para la detección automática según el tipo de consulta.",
-      "timeWindow": "Considerar idénticas las alertas dentro de",
-      "timeWindowHint": "Periodo para agrupar alertas similares. Déjalo vacío para usar el intervalo de comprobación.",
-      "timeWindowTooltip": "Cuánto tiempo se recuerdan las alertas recientes para agruparlas. Si se produce una alerta similar dentro de este tiempo, no se volverá a enviar. Déjalo vacío para usar el intervalo de comprobación de la alerta.",
-      "fingerprintFieldsHelp": "Deje vacío para detectar automáticamente según la consulta (SQL: columnas GROUP BY, PromQL: etiquetas, Personalizado: campos de condición)"
-    },
     "summary": {
       "scrollToBottom": "Ir al final",
       "title": "Resumen",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Alertarme cuando se cumplan las condiciones configuradas"
       }
     },
-    "correlation": {
-      "title": "Correlación de alertas",
-      "description": "Configure cómo se correlacionan y deduplican las alertas en toda la organización. Las alertas con valores de huellas digitales coincidentes se agruparán.",
-      "semanticFieldNote": "Nota: Las asignaciones de campos semánticos se configuran en la pestaña Identidad del servicio.",
-      "enableOrgLevel": "Habilite la deduplicación a nivel de organización",
-      "enableOrgLevelTooltip": "Habilite las funciones de deduplicación y correlación para todas las alertas de esta organización",
-      "enableCrossAlert": "Habilitar la deduplicación de alertas cruzadas",
-      "enableCrossAlertTooltip": "Permitir que diferentes alertas se desdupliquen entre sí cuando comparten la misma huella digital",
-      "fingerprintGroups": "Grupos de huellas digitales entre alertas",
-      "fingerprintGroupsTooltip": "Seleccione los grupos semánticos que desea utilizar para las huellas digitales entre alertas. Las alertas se deduplicarán si comparten los mismos valores para estas dimensiones.",
-      "fingerprintGroupsHint": "Seleccione al menos un grupo semántico para la deduplicación de alertas cruzadas",
-      "fingerprintGroupsRequired": "Debe seleccionarse al menos un grupo semántico",
-      "defaultWindow": "Ventana de correlación predeterminada (minutos)",
-      "defaultWindowTooltip": "En ausencia de una coincidencia de campo semántica, las alertas y los datos de una duración determinada se consideran relacionados",
-      "defaultWindowDescription": "En ausencia de una coincidencia de campo semántica, las alertas y los datos de una duración determinada se consideran relacionados",
-      "defaultWindowPlaceholder": "Usa el período de alerta de forma predeterminada",
-      "cancelButton": "Cancelar",
-      "saveButton": "Guardar configuración",
-      "settingsSaved": "Configuración de deduplicación de la organización guardada correctamente",
-      "settingsSaveError": "Error al guardar la configuración"
-    },
     "placeholders": {
       "typeSomething": "Escriba algo",
       "value": "Valor",
       "selectColumn": "Seleccionar columna",
       "savedFunctions": "Funciones guardadas",
-      "autoUsesCheckInterval": "Automático (usa el intervalo de verificación)",
       "addTag": "Agregar etiqueta y presionar Enter"
     },
     "steps": {
       "compareWithPast": "Comparar con Past",
-      "deduplication": "Deduplicación",
       "advanced": "Avanzado"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Qué debería activar la alerta",
       "compareWithPast": "Compare los resultados actuales con los datos de otro período",
       "alertSettings": "Establece tus reglas de alerta y elige cómo quieres recibir las notificaciones.",
-      "deduplication": "Evite enviar la misma alerta varias veces agrupando alertas similares.",
       "advanced": "Variables de contexto, descripción y plantilla de filas"
     },
     "failedToFetchHistory": "No se pudo obtener el historial de alertas",
@@ -10399,8 +10691,6 @@
         "closeActions": "Cerrar acciones",
         "viewAlertHistory": "Ver historial de alertas",
         "actionsFor": "Acciones para:",
-        "configureDedup": "Configurar Dedup",
-        "configureDedupTooltip": "Configurar la deduplicación para esta alerta",
         "editAlert": "Editar alerta",
         "editAlertTooltip": "Editar la configuración de alertas",
         "viewHistory": "Ver historial",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "nuevo mensaje de \"Resuelta\"",
       "keepFiringFor": "Seguir disparando durante",
       "keepFiringForTooltip": "Espera este tiempo después de que la condición deje de cumplirse antes de recuperarse. 0 recupera inmediatamente.",
+      "suppressRepeats": "Suprimir repeticiones",
+      "suppressRepeatsTooltip": "Notificar una vez cuando la alerta empiece a dispararse o cambie de nivel, no en cada evaluación. Déjalo desactivado para seguir recibiendo recordatorios después de cada periodo de silencio.",
       "keepFiringForInvalid": "Introduce 0 o más segundos",
       "keepFiringForTooLong": "Introduce como máximo 86400 segundos (24 horas)"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Esta dirección de correo electrónico ya se ha agregado",
     "confirmRemoveEmail": "¿Seguro que quieres quitar el correo {email}?",
     "domainNeedsEmails": "El dominio '{domain}' debe tener al menos una dirección de correo electrónico si no está permitido a todos los usuarios",
+    "noAllowedEmailsDenyAll": "No hay correos permitidos todavía, por lo que se deniega el acceso a todos los usuarios de {domain}.",
     "domainSettingsSaved": "La configuración del dominio se guardó correctamente",
     "errorSavingDomainSettings": "Error al guardar la configuración del dominio",
     "noDomainMessage": "No hay dominios configurados. Agregue los dominios anteriores para restringir el acceso.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Configura al menos un conjunto de identidades antes de guardar.",
       "discoveredServicesTab": "Servicios descubiertos",
       "serviceDiscoveryTab": "Reglas de detección",
-      "alertCorrelationTab": "Correlación de alertas",
       "fieldAliasesTab": "Asignaciones de campos",
       "fieldAliasesSaved": "Alias de campos guardados correctamente",
       "fieldAliasesSaveError": "No se pudieron guardar los alias de campos",
@@ -14079,27 +14371,144 @@
     "runsIn": "Se ejecuta en",
     "recommendedByFieldCoverage": "Recomendado según la cobertura de campos en sus streams.",
     "listConjunctionAndTwo": "{first} y {last}",
-    "domainOrgMappings": {
-      "title": "Asignaciones de dominio a organización",
-      "subtitle": "Los nuevos usuarios que inicien sesión con un dominio de correo coincidente se añaden a la organización automáticamente.",
+    "orgDomainMapping": {
+      "tabLabel": "Gestión de dominios",
+      "tabDesc": "Vincula tus dominios de correo, asigna sus usuarios a organizaciones y controla quiénes pueden unirse.",
+      "loadFailed": "No se pudo cargar la configuración de la organización",
       "addMapping": "Agregar asignación",
       "editMapping": "Editar asignación",
-      "empty": "Aún no hay asignaciones. Use “{addLabel}” para agregar una.",
       "domain": "Dominio de correo",
-      "domainHelp": "La parte después de {at_sign} en la dirección de correo del usuario.",
+      "domainHelp": "La parte que sigue a {at_sign} en la dirección de correo del usuario. El dominio se vincula a esta organización y debe verificarse mediante DNS.",
+      "domainHelpRequest": "La parte que sigue a {at_sign} en la dirección de correo electrónico del usuario. El dominio se vincula a esta organización una vez que OpenObserve aprueba la solicitud.",
       "organization": "Organización",
-      "organizationPlaceholder": "Identificador de la organización",
-      "organizationHelp": "El identificador de la organización a la que se añaden los usuarios coincidentes.",
+      "organizationHelp": "Esta organización o uno de los miembros de su grupo de facturación.",
       "organizationRequired": "La organización es obligatoria",
       "baseRole": "Rol base",
-      "baseRoleHelp": "El rol que se asigna a los usuarios coincidentes en esa organización.",
-      "roleClaimName": "Claim de roles",
-      "roleClaimNamePlaceholder": "Nombre del claim, p. ej. groups",
-      "roleClaimNameHelp": "Opcional. Claim del token que enumera los roles personalizados del usuario; en cada inicio de sesión, sus roles personalizados en esa organización se sincronizan con él.",
-      "createMissingRoles": "Crear los roles del claim que no existan en la organización",
-      "duplicateDomain": "Ya existe una asignación para este dominio",
-      "confirmRemove": "¿Seguro que quieres eliminar el mapeo de {name}?",
-      "deleteTitle": "Eliminar asignación"
+      "baseRoleHelp": "El rol que se asigna cuando un usuario se agrega a esa organización. Los miembros existentes conservan su rol actual.",
+      "roleClaimName": "Atributo de rol",
+      "roleClaimNamePlaceholder": "Nombre del atributo, p. ej. groups",
+      "roleClaimNameHelp": "Opcional. Atributo del token SSO que enumera los roles personalizados del usuario. En cada inicio de sesión SSO, sus roles personalizados en esa organización se reemplazan por los indicados en el atributo; los roles indicados que no existan se omiten a menos que se creen.",
+      "createMissingRoles": "Crear los roles del atributo que no existan en la organización",
+      "verifyNow": "Verificar ahora",
+      "details": "Detalles",
+      "detailsDialogTitle": "Detalles de la vinculación de {domain}",
+      "approvedLinkInfo": "Vinculado por OpenObserve tras una solicitud de vinculación. No se necesita ningún registro DNS.",
+      "pendingRequestInfo": "OpenObserve está revisando esta solicitud. No hay nada que hacer hasta que se apruebe.",
+      "rejectedRequestInfo": "OpenObserve rechazó esta solicitud.",
+      "verifyDialogTitle": "Verificar {domain}",
+      "recordDialogTitle": "Registro DNS para {domain}",
+      "lastCheckFailed": "Falló la última comprobación: {reason}",
+      "state": {
+        "pending": "Pendiente",
+        "verified": "Verificado",
+        "failed": "Fallido",
+        "requested": "Pendiente de aprobación",
+        "approved": "Aprobado",
+        "rejected": "Rechazado"
+      },
+      "saved": "Mapeo de dominio guardado",
+      "saveFailed": "No se pudieron guardar los ajustes",
+      "linkFailed": "No se pudo vincular el dominio",
+      "unlinkFailed": "No se pudo desvincular el dominio",
+      "verifyFailed": "La verificación falló",
+      "deleted": "Mapeo eliminado",
+      "deleteTitle": "¿Eliminar el mapeo?",
+      "deleteMappingBody": "Los usuarios de {domain} ya no se añadirán a {org} cuando inicien sesión.",
+      "recordInstructions": "Añade este registro TXT de DNS en tu proveedor de DNS:",
+      "txtNameLabel": "Nombre del registro",
+      "txtValueLabel": "Valor del registro",
+      "copyTxtName": "Copiar nombre del registro",
+      "copyTxtValue": "Copiar valor del registro",
+      "txtNameCopied": "Nombre del registro copiado",
+      "txtValueCopied": "Valor del registro copiado",
+      "verifyHint": "La verificación se ejecuta automáticamente cada {minutes} minutos. También puedes verificar ahora.",
+      "alreadyLinked": "Este dominio ya está vinculado a esta organización",
+      "failureReason": {
+        "recordMissing": "No se encontró el registro TXT",
+        "valueMismatch": "Se encontró el registro TXT, pero el valor no coincide",
+        "dnsFailed": "La resolución DNS falló"
+      },
+      "pageSubtitle": "Vincula tus dominios de correo, asigna sus usuarios a organizaciones y controla cuáles de ellos pueden unirse.",
+      "linkedTab": "Dominios vinculados",
+      "mappingsTab": "Mapeos",
+      "accessTab": "Usuarios bloqueados",
+      "requestsTab": "Solicitudes de vinculación",
+      "linkDomain": "Vincular dominio",
+      "sendRequest": "Enviar solicitud",
+      "linkMethod": "Cómo demostrar la propiedad",
+      "method": {
+        "dns": "Registro DNS",
+        "approved": "Solicitud aprobada",
+        "request": "Solicitud de vinculación",
+        "dnsTitle": "Añadir un registro TXT de DNS",
+        "dnsDesc": "Se verifica automáticamente una vez publicado el registro. Es la mejor opción cuando gestionas el DNS del dominio.",
+        "requestTitle": "Solicitar una vinculación a OpenObserve",
+        "requestDesc": "Nuestro equipo revisa la solicitud y vincula el dominio una vez aprobada."
+      },
+      "searchDomains": "Buscar dominios",
+      "searchMappings": "Buscar por dominio u organización",
+      "searchRequests": "Buscar por dominio, organización o solicitante",
+      "status": "Estado",
+      "linkedVia": "Vinculado mediante",
+      "lastChecked": "Última comprobación",
+      "linked": "Dominio vinculado. Añade el registro DNS para verificarlo.",
+      "verified": "Dominio verificado",
+      "notVerifiedYet": "El registro DNS aún no se ha encontrado. Puede tardar un tiempo en propagarse.",
+      "requestSent": "Solicitud de vinculación enviada",
+      "requestFailed": "No se pudo enviar la solicitud de vinculación",
+      "keepRecordHint": "Mantén este registro en su lugar. La propiedad se vuelve a comprobar cada {minutes} minutos; si el registro falta durante más de {grace} minutos, el dominio se marca como fallido y sus asignaciones dejan de aplicarse.",
+      "removeDomain": "Eliminar dominio",
+      "removeTitle": "¿Eliminar dominio?",
+      "removeBody": "{domain} se desvinculará de esta organización.",
+      "removeWithMappingsBody": "{domain} se desvinculará de esta organización y se eliminará su {count} asignación. | {domain} se desvinculará de esta organización y se eliminarán sus {count} asignaciones.",
+      "removed": "Dominio eliminado",
+      "domainRequired": "El dominio es obligatorio",
+      "mappingDomainHelp": "Solo se pueden asignar dominios verificados.",
+      "createsRoles": "Crea roles",
+      "duplicateMapping": "Este dominio ya está asignado a esa organización",
+      "domainNotVerified": "No verificado",
+      "noVerifiedDomains": "Las asignaciones se aplican a dominios verificados. Vincula y verifica un dominio primero.",
+      "goToLinked": "Vincular un dominio",
+      "goToLinkedDesc": "Verifica un dominio que te pertenezca antes de asignar sus usuarios",
+      "enforceTitle": "Eliminar usuarios de otras organizaciones",
+      "enforceDesc": "Cuando un usuario de un dominio asignado inicia sesión mediante SSO, se le elimina de todas las organizaciones fuera de esta y de su grupo de facturación.",
+      "enforceConfirmTitle": "¿Eliminar usuarios de otras organizaciones?",
+      "enforceConfirmBody": "Cada vez que un usuario cuyo dominio de correo tenga una asignación aquí inicie sesión mediante SSO, se le eliminará de todas las organizaciones que no sean esta o no estén en su grupo de facturación, incluidas sus organizaciones personales.",
+      "enforceConfirmAction": "Activar",
+      "enforceSaved": "Ajuste guardado",
+      "blockUsers": "Bloquear usuarios",
+      "editBlockedUsers": "Editar usuarios bloqueados",
+      "block": "Bloquear",
+      "blockedCount": "{count} bloqueado | {count} bloqueados",
+      "blockedEmails": "Correos bloqueados",
+      "blocklistDomainHelp": "Uno de los dominios verificados de esta organización.",
+      "blocklistEmailsHelp": "Estos usuarios no pueden unirse a esta organización ni a los miembros de su grupo de facturación mediante SSO, y se les elimina de ellos en su próximo inicio de sesión.",
+      "ruleBlockedRequired": "Añade al menos un correo para bloquear",
+      "noDomainForBlocklist": "Todos los dominios verificados ya tienen usuarios bloqueados. Edita su fila para cambiarlos.",
+      "unblockAll": "Desbloquear todos",
+      "unblockAllTitle": "¿Desbloquear todos los usuarios?",
+      "unblockAllBody": "Todos los usuarios bloqueados de {domain} podrán unirse de nuevo en su próximo inicio de sesión mediante SSO.",
+      "blocklistSaved": "Usuarios bloqueados guardados",
+      "blocklistDeleted": "Usuarios desbloqueados",
+      "blocklistSection": "Usuarios bloqueados por dominio",
+      "filterPending": "Pendiente",
+      "filterAll": "Todos",
+      "requestedBy": "Solicitado por",
+      "requestedAt": "Solicitado",
+      "verifiedAt": "Verificado",
+      "answeredBy": "Respondido por",
+      "reason": "Motivo",
+      "reasonHelp": "Se muestra a la organización que realizó la solicitud.",
+      "reasonRequired": "Se requiere un motivo para rechazar una solicitud",
+      "approve": "Aprobar",
+      "reject": "Rechazar",
+      "approveTitle": "¿Aprobar la solicitud de vinculación?",
+      "rejectTitle": "¿Rechazar la solicitud de vinculación?",
+      "approveBody": "{domain} se vinculará a {org} sin una comprobación de DNS.",
+      "rejectBody": "{org} no obtendrá {domain}.",
+      "requestApproved": "{domain} vinculado",
+      "requestRejected": "Solicitud de {domain} rechazada",
+      "decisionFailed": "No se pudo actualizar la solicitud"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Selecciona una opción de detección"
   },
   "search_history": {
-    "title": "Historial de búsqueda",
+    "title": "Historial de uso y coste",
     "get_history": "Obtener historial",
     "executed_at": "Ejecutado en",
     "sql_query": "Consulta SQL",
-    "delayMessage": "Es posible que el historial de búsqueda se retrase un"
+    "delayMessage": "El historial de uso y coste puede retrasarse hasta"
   },
   "correlation": {
     "unstableDimensionNote": "Dimensión inestable - cambios al reiniciar el pod. Predeterminado: Todos los valores.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Los datos están actualizados",
     "dataGettingStale": "Los datos se están volviendo obsoletos",
     "dataStale": "Los datos están obsoletos",
-    "lastRefreshed": "Última actualización: {time}"
+    "lastRefreshed": "Última actualización: {time}",
+    "refresh": "Actualizar",
+    "refreshWithAge": "Actualizar, última actualización {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Error de sonda"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "clic",
       "actionType": "escribir",
       "all": "Todos",
@@ -19868,6 +20280,13 @@
       "attemptN": "Intento {n}",
       "detailAction": "Acción",
       "detailSelector": "Selector",
+      "detailStepId": "ID del paso",
+      "detailTargetUrl": "URL de destino",
+      "detailStatus": "Estado",
+      "detailSkipReason": "Motivo de omisión",
+      "stepStatusSkipped": "Omitido",
+      "stepStatusUnknown": "Desconocido",
+      "skippedCount": "{n} omitidos",
       "downloadTrace": "Descargar {filename}",
       "errorFullscreenTitle": "Paso {id}: {action} - Error",
       "failedAtStartLoad": "Fallo al abrir la URL inicial",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Máximo {max}. Los reintentos se ejecutan dentro del mismo trabajo, por lo que toda la secuencia debe caber en el presupuesto de la verificación.",
       "retriesMaxBrowserHint": "Máximo {max} para verificaciones de navegador. Cada intento vuelve a ejecutar el recorrido en cada dispositivo, por lo que más excedería el tiempo de espera de la sonda e informaría de un fallo que su sitio nunca tuvo.",
       "retryDelay": "Espera a",
-      "retryDelaySuffix": "ms entre reintentos.",
+      "retryDelaySuffix": "segundos entre reintentos.",
       "schedule": "Programación",
       "scheduleLater": "Programe más tarde",
       "scheduleLaterTooltip": "Elija una fecha y hora futuras para activar el cheque.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Reiniciar configuración — copie el comando de configuración de este agente para volver a ejecutar la instalación / reinicio de Docker (p. ej., después de una rotación de token)",
         "noAgents": "Aún no se han registrado agentes para esta ubicación.",
         "agentsUnavailable": "Los agentes de esta ubicación se registraron en otro clúster y no son visibles aquí.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Verificaciones ejecutándose desde esta ubicación",
         "checkName": "Nombre",
         "noChecks": "Aún no se asignan verificaciones a esta ubicación.",
@@ -20546,7 +20967,7 @@
       "nodes": "Nodos",
       "modelPricing": "Precios de modelos",
       "searchSchedulers": "Planificadores de búsquedas",
-      "searchHistory": "Historial de búsqueda",
+      "searchHistory": "Historial de uso y coste",
       "sessions": "Sesiones",
       "evalTemplates": "Evaluaciones en línea — Plantillas",
       "scorers": "Evaluaciones en línea — Evaluadores",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Actualizar lista",
       "alertTemplatesAdd": "Añadir nueva plantilla",
       "alertTemplatesRefresh": "Actualizar lista",
-      "logsSearchHistory": "Abrir historial de búsqueda",
+      "logsSearchHistory": "Abrir el historial de uso y coste",
       "alertsImport": "Importar alerta",
       "panelEditorRun": "Ejecutar/aplicar consulta",
       "panelEditorSave": "Guardar y seguir editando",
@@ -21131,6 +21552,7 @@
         "system": "sistema"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Activo",
         "passed": "Aprobado",
         "healthy": "Saludable",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Error al navegar a la alerta",
       "alertNotFound": "Alerta no encontrada",
-      "alertNotFoundInAlerts": "Alerta \"{name}\" no encontrada en {count} alertas",
       "failedToLoadAlerts": "Error al cargar las alertas",
       "alertsDeletedSuccessfully": "Se eliminó correctamente {count} alerta | Se eliminaron correctamente {count} alertas",
       "failedToDeleteAlerts": "No se pudo eliminar {count} alerta | No se pudieron eliminar {count} alertas",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Espere mientras se cargan las plantillas...",
       "alertSavedSuccessfully": "Alerta guardada correctamente.",
       "alertUpdatedSuccessfully": "Alerta actualizada correctamente.",
-      "openingDedupConfig": "Abriendo configuración de deduplicación para: {name}",
       "editingAlert": "Editando alerta: {name}",
       "ack": {
         "acked": "Se confirmó {name}",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Editor de precios de modelos",
     "storageSettings": "Configuración de almacenamiento",
     "domainManagement": "Gestión de dominios",
+    "orgDomainMapping": "Gestión de dominios",
     "slackApp": "Slack",
     "regexPatterns": "Patrones de expresiones regulares",
     "syntheticsLocations": "Ubicaciones de synthetics",
@@ -26099,7 +26520,7 @@
       "logged": "Registrado"
     },
     "policy": {
-      "gateHint": "Entre los cambios a alertas existentes, solo la deduplicación se aplica por sí sola, con una instantánea del estado anterior y una ventana de revisión: se conserva si sus comprobaciones pasan y se revierte si fallan. Todo lo demás espera una aprobación con un solo clic.",
+      "gateHint": "Entre los cambios en alertas existentes, solo activar la supresión de repeticiones se aplica por sí solo, con una instantánea del estado anterior y una ventana de revisión: se conserva si sus comprobaciones pasan y se revierte si fallan. Todo lo demás espera una aprobación con un solo clic.",
       "off": "Desactivado",
       "suggest": "Sugerir",
       "auto": "Auto",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Retiene el aviso hasta que llegue la investigación, durante un máximo de 2 minutos. Falla de forma abierta: si el triaje agota el tiempo o falla, avisa igualmente al guardia, indica que la investigación sigue en curso o ha fallado, y la causa llega en el mismo hilo."
       },
       "classes": {
-        "EnableDeduplication": "Activa la deduplicación para una alerta que se repite en cuestión de minutos.",
+        "EnableDeduplication": "Activar la supresión de repeticiones para una alerta que notifica en cada evaluación.",
         "CreateDetector": "Crea un detector de anomalías sobre las solicitudes, los errores o la latencia de un servicio.",
         "RaiseThreshold": "Eleva un umbral que se dispara en días sin problemas.",
         "LengthenEvaluationWindow": "Alarga la ventana de una alerta que fluctúa.",
@@ -26667,10 +27088,10 @@
           "on": "alerta de conexión"
         },
         "L-302": {
-          "done": "Agrupé las 3 alertas de latencia de checkout en una",
-          "why": "Se activaban juntas el 94% del tiempo, así que una ralentización te avisó 3 veces.",
-          "from": "3 alertas",
-          "to": "1",
+          "done": "Se activó la supresión de repeticiones en las 3 alertas de latencia de checkout",
+          "why": "Notificaban en cada evaluación mientras permanecían disparadas, por lo que una sola ralentización te avisó 120 veces.",
+          "from": "Cada evaluación",
+          "to": "Una vez por cambio",
           "on": "latencia de checkout"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "Avisé a la guardia sobre los pagos fallidos de checkout.",
         "recsHeld": "Dejé en espera un problema menor con recommendations para el resumen del viernes.",
         "diskApproved": "Aprobaste elevar la alerta de disco en ingest-1 a {to}%.",
-        "latencyGrouped": "Agrupé las tres alertas de lentitud de checkout en una sola, así una única ralentización genera un solo aviso.",
+        "latencyGrouped": "Activé la supresión de repeticiones para las tres alertas de lentitud de checkout, así que una sola ralentización avisa una vez.",
         "queueFixed": "Añadí workers de la cola de orders, pero la cola siguió creciendo, así que los revertí y avisé a la guardia.",
         "loginPaged": "Avisé a la guardia sobre el inicio de sesión lento.",
         "queuePermission": "Me permitiste añadir workers de cola por mi cuenta, hasta 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Estado del pipeline",
       "legendToggle": "Mostrar u ocultar este estado en el mapa"
     }
+  },
+  "recentSearches": {
+    "title": "Búsquedas recientes",
+    "aboutKeptDays": "Solo tus búsquedas en {org}, visibles solo para ti. Se conservan {days} día; las búsquedas destacadas permanecen hasta que las elimines. | Solo tus búsquedas en {org}, visibles solo para ti. Se conservan {days} días; las búsquedas destacadas permanecen hasta que las elimines.",
+    "aboutKeptForever": "Solo tus búsquedas en {org}, visibles solo para ti. Se conservan hasta que se eliminen.",
+    "pageTitle": {
+      "logs": "Búsquedas recientes en logs",
+      "traces": "Búsquedas recientes en trazas",
+      "metrics": "Búsquedas recientes en métricas",
+      "dbm": "Búsquedas recientes",
+      "profiles": "Búsquedas recientes"
+    },
+    "page": {
+      "logs": "Logs",
+      "traces": "Trazas",
+      "metrics": "Métricas",
+      "dbm": "Base de datos",
+      "profiles": "Perfiles"
+    },
+    "allPages": "Todas las páginas",
+    "viewAll": "Ver todo",
+    "failedCount": "{count} fallidas",
+    "keyHints": "↑↓ mover · PgUp/PgDn desplazar consulta · Enter ejecutar · Mayús+Enter solo cargar · Esc cerrar",
+    "loadToFix": "Cargar para corregir",
+    "emptyTitle": "Aún no hay búsquedas recientes",
+    "loadError": "No se pudieron cargar las búsquedas recientes",
+    "retry": "Reintentar",
+    "warning": "Finalizó con una advertencia: tiempo de espera agotado o resultados parciales",
+    "failed": "Fallida",
+    "ranCount": "ejecutada {count} veces",
+    "lineCount": "{count} línea | {count} líneas",
+    "relativeWindow": "Último {period}",
+    "rerunNow": "Volver a ejecutar ahora",
+    "rerunOriginal": "En el momento original",
+    "loadOnly": "Cargar sin ejecutar",
+    "copyLink": "Copiar enlace",
+    "copyQuery": "Copiar consulta",
+    "star": "Destacar",
+    "unstar": "Quitar destacado",
+    "linkCopied": "Enlace copiado",
+    "queryCopied": "Consulta copiada",
+    "copyFunction": "Copiar función",
+    "functionCopied": "Función copiada",
+    "functionLabel": "Función (VRL)",
+    "searchPlaceholder": "Buscar consultas y streams",
+    "allStreams": "Todos los streams",
+    "statusAll": "Cualquier estado",
+    "statusOk": "Correcta",
+    "statusError": "Fallida",
+    "starredOnly": "Solo destacadas",
+    "datePlaceholder": "dd/mm/aaaa",
+    "filterByDateRun": "Filtrar por fecha de ejecución",
+    "today": "Hoy",
+    "yesterday": "Ayer",
+    "noMatch": "Ninguna búsqueda coincide con estos filtros",
+    "reset": "Restablecer todo",
+    "resetFilters": "Restablecer filtros",
+    "loadMore": "Cargar más",
+    "clear": "Borrar mi historial",
+    "confirmClear": "Borrar historial",
+    "clearBodyPage": "Esto elimina tu {count} búsqueda reciente en {page} en {org}. Las vistas guardadas no se verán afectadas. | Esto elimina tus {count} búsquedas recientes en {page} en {org}. Las vistas guardadas no se verán afectadas.",
+    "clearBodyAll": "Esto elimina tu {count} búsqueda reciente en {org} en Logs, Trazas y Métricas. Las vistas guardadas no se verán afectadas. | Esto elimina tus {count} búsquedas recientes en {org} en Logs, Trazas y Métricas. Las vistas guardadas no se verán afectadas.",
+    "includeStarred": "También eliminar mi {count} búsqueda favorita | También eliminar mis {count} búsquedas favoritas",
+    "recentRow": "Búsqueda reciente",
+    "deletedQuery": "Se eliminó {query}",
+    "undo": "Deshacer"
   }
 }
diff --git a/web/src/locales/languages/fr-FR.json b/web/src/locales/languages/fr-FR.json
index e6b607f526..784d5b3199 100644
--- a/web/src/locales/languages/fr-FR.json
+++ b/web/src/locales/languages/fr-FR.json
@@ -64,7 +64,7 @@
     "noPatterns": {
       "title": "Aucun motif n'a été trouvé",
       "description": "Essayez d'augmenter la plage de temps ou de sélectionner un autre flux contenant davantage de données de journal. L'extraction de motifs fonctionne mieux avec au moins 1 000 journaux.",
-      "logsAnalyzed": "Seuls {count} logs ont été analysés."
+      "logsAnalyzed": "Seuls {count} journaux ont été analysés."
     },
     "noStreamSelected": {
       "title": "Sélectionnez un stream pour commencer",
@@ -486,7 +486,11 @@
       "monitors": "superviseurs",
       "modelPricing": "définitions de tarification de modèle",
       "variables": "variables",
-      "experiments": "expériences"
+      "experiments": "expériences",
+      "linkedDomains": "domaines liés",
+      "domainMappings": "mappages de domaines",
+      "domainRequests": "demandes de liaison",
+      "blockedUsers": "utilisateurs bloqués"
     },
     "demo": {
       "pageTitle": "États vides — ensemble complet à examiner",
@@ -572,6 +576,30 @@
       "action": "Nouvelle tâche",
       "actionDesc": "Pointez OpenObserve vers votre point de terminaison et testez la connexion."
     },
+    "noLinkedDomains": {
+      "title": "Aucun domaine lié pour l'instant",
+      "description": "Liez un domaine email que vous possédez pour associer ses utilisateurs à vos organisations et contrôler qui peut se connecter.",
+      "dns": "Ajouter un enregistrement DNS",
+      "dnsDesc": "Vérifiez la propriété avec un enregistrement TXT",
+      "request": "Demander une liaison",
+      "requestDesc": "Demandez à OpenObserve de lier le domaine pour vous"
+    },
+    "noDomainMappings": {
+      "title": "Aucun mappage de domaine pour l'instant",
+      "description": "Ajoutez automatiquement les utilisateurs qui se connectent avec un domaine vérifié à cette organisation ou aux membres de son groupe de facturation.",
+      "action": "Ajouter un mappage",
+      "actionDesc": "Choisissez un domaine, une organisation et un rôle"
+    },
+    "noBlockedUsers": {
+      "title": "Aucun utilisateur bloqué",
+      "description": "Tous les utilisateurs de vos domaines vérifiés peuvent rejoindre. Bloquez des utilisateurs spécifiques pour les en empêcher.",
+      "action": "Bloquer des utilisateurs",
+      "actionDesc": "Choisissez un domaine et les emails à bloquer"
+    },
+    "noDomainRequests": {
+      "title": "Aucune demande de liaison",
+      "description": "Les demandes d'organisations pour lier un domaine apparaissent ici."
+    },
     "noDowntimes": {
       "title": "Aucune période de maintenance pour l'instant",
       "description": "Une période de maintenance laisse les alertes, les détections d'anomalies et les contrôles synthétiques s'exécuter et suspend leurs notifications pendant une plage que vous planifiez.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Désactiver le mode Live",
     "autoRefreshWithValue": "Actualisation automatique : {value}",
     "searchHistory": "Historique des recherches",
+    "usageCostHistory": "Historique d'utilisation et de coûts",
     "createScheduledSearch": "Créer une recherche planifiée",
     "listScheduledSearch": "Liste des recherches planifiées",
     "scheduleSearchJob": "Planifier une recherche d'emploi",
@@ -1355,9 +1384,11 @@
     "scanSize": "Taille de scan",
     "deltaScanSize": "Taille de scan delta",
     "scannedSoFar": "{size} analysés",
+    "quickModeHiddenFields": "Le mode rapide est activé. Cette ligne affiche {shown} champs sur {total}.",
+    "turnOffQuickMode": "Désactiver le mode rapide",
     "resultsProgressLabel": "Progression de la recherche",
     "histogramTitleError": "Erreur lors de la génération du titre de l'histogramme.",
-    "selectLogStream": "Sélectionnez le flux de journaux",
+    "selectLogStream": "Sélectionnez le flux de logs",
     "searchInspect": "Rechercher Inspect",
     "vrlOnlyForTableWarning": "La fonction VRL n'est prise en charge que pour les graphiques tabulaires.",
     "customDownloadTitle": "Téléchargement personnalisé",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Aucune donnée réseau pour cette vue",
     "apiEmptyDescription": "Le flux sélectionné ne contient aucune ressource ni requête réseau dans cette plage horaire. Les métriques réseau apparaissent une fois que l'application instrumente ses appels HTTP.",
     "skipInactivity": "Ignorer l'inactivité",
+    "fullScreen": "Plein écran",
+    "exitFullScreen": "Quitter le plein écran",
     "error": "Erreur",
     "errorCount": "Nombre d'erreurs",
     "all": "Tous",
@@ -2590,7 +2623,7 @@
         "invalid": "Cet entonnoir enregistré n'est pas valide",
         "sqlTooLarge": "Le SQL de cet entonnoir dépasse 64 Ko, trop volumineux pour être enregistré. Utilisez moins d'étapes ou des étapes plus courtes.",
         "loadFailed": "Les entonnoirs enregistrés n'ont pas pu être chargés",
-        "saveFailed": "L'entonnoir enregistré n'a pas pu être sauvegardé",
+        "saveFailed": "L'entonnoir enregistré n'a pas pu être enregistré",
         "deleteFailed": "L'entonnoir enregistré n'a pas pu être supprimé",
         "unknownEvent": "Un événement nommé de cet entonnoir n'existe plus ; supprimez d'abord son étape",
         "needsTwoSteps": "Ajoutez au moins 2 étapes pour enregistrer un entonnoir",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Ajoutez une deuxième étape pour ajouter cet entonnoir à un tableau de bord",
         "snapshot": "Le panneau conserve ces étapes, filtres et règles d'événements nommés tels qu'ils sont actuellement."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Vue d'ensemble des performances",
+      "filterService": "Service",
+      "filterEnv": "Environnement",
+      "filterVersion": "Version",
+      "filterAll": "Tous",
+      "verdictPass": "Core Web Vitals validés",
+      "verdictFail": "Core Web Vitals à surveiller",
+      "verdictAllPass": "Tous validés",
+      "verdictNeedWork": "{count} sur {total} à améliorer | {count} sur {total} à améliorer",
+      "percentileLabel": "Percentile",
+      "bandGood": "Bon",
+      "bandNeeds": "À améliorer",
+      "bandPoor": "Mauvais",
+      "bandGoodPct": "{n} % bon",
+      "bandNeedsPct": "{n} % à améliorer",
+      "bandPoorPct": "{n} % mauvais",
+      "bandAria": "{good} % bon, {needs} % à améliorer, {poor} % mauvais",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} plus rapide",
+      "deltaSlower": "{v} plus lent",
+      "deltaNone": "aucun changement",
+      "deltaNoPrev": "données précédentes insuffisantes",
+      "kpiSessions": "Sessions",
+      "kpiErrorFree": "Sessions sans erreur",
+      "kpiErrors": "Total des erreurs",
+      "kpiUnhandled": "Erreurs non gérées",
+      "kpiRegion": "Indicateurs clés",
+      "sparkAria": "Tendance de {label} sur la période sélectionnée",
+      "chartTitle": "Sessions et erreurs",
+      "chartInterval": "par intervalle",
+      "legendSessions": "Sessions",
+      "legendErrors": "Erreurs",
+      "releaseMarker": "Première apparition de {version} : {time}",
+      "chartTableToggle": "Afficher le tableau de données",
+      "chartTableHide": "Masquer le tableau de données",
+      "chartTime": "Heure",
+      "pagesTitle": "Pages à corriger en priorité",
+      "pagesHint": "Classées par impact : trafic pondéré par la part des vues avec un Core Web Vital hors seuil ou une erreur. Cliquez sur une page pour voir ses sessions, sur un nombre d'erreurs pour ouvrir Error Tracking.",
+      "pagesColPage": "Page",
+      "pagesColViews": "Vues",
+      "pagesColErrors": "Erreurs",
+      "pagesColImpact": "Impact",
+      "pagesLegend": "▲ à améliorer · ■ mauvais · non marqué = bon. Les pages de moins de {n} vues sont masquées.",
+      "pagesOpenSessions": "Ouvrir les sessions pour {path}",
+      "pagesOpenErrors": "{count} erreur, ouvrir Error Tracking | {count} erreurs, ouvrir Error Tracking",
+      "pagesImpactAria": "Impact {n} sur 100",
+      "markNeeds": "à améliorer",
+      "markPoor": "mauvais",
+      "diffTitle": "Différence la plus importante",
+      "diffBody": "L'INP p75 est de {inp}, soit {ratio}x les autres segments. Une corrélation à étudier, pas une cause prouvée.",
+      "diffNone": "Aucun segment ne se démarque des autres sur cette période.",
+      "diffLink": "Voir les sessions concernées",
+      "segmentLabel": "Segment",
+      "segBrowser": "Navigateur",
+      "segDevice": "Appareil",
+      "segCountry": "Pays",
+      "segInp": "INP {v}",
+      "segShare": "{n} % des vues",
+      "segNone": "Aucune donnée pour ce segment.",
+      "releaseTitle": "Comparaison des versions",
+      "releaseHint": "{cur} par rapport à {prev}. Le début d'une version correspond à la première fois où elle est observée.",
+      "releaseMetric": "Métrique",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Sans erreur",
+      "releaseSessions": "Sessions",
+      "releaseLink": "Erreurs dans {version}",
+      "frustrationTitle": "Frustration des utilisateurs",
+      "frustrationHint": "Points de friction que les vitals ne détectent pas",
+      "rageClicks": "Clics de rage",
+      "deadClicks": "Clics morts",
+      "stateLoading": "Chargement de {panel}…",
+      "stateEmptyTitle": "Aucune vue de page sur cette période",
+      "stateEmptyBody": "Élargissez la plage temporelle, supprimez un filtre ou vérifiez que le SDK du navigateur envoie des événements de vue.",
+      "stateEmptyAction": "Configurer le SDK",
+      "stateLowTitle": "Seulement {count} vue de page | Seulement {count} vues de page",
+      "stateLowBody": "Les percentiles ne sont pas fiables en dessous de {min} vues, le verdict est donc masqué. Les valeurs sont affichées à titre indicatif.",
+      "stateErrorTitle": "Impossible de charger {panel}",
+      "stateErrorBody": "La requête a échoué ou a expiré. Les autres panneaux ne sont pas affectés.",
+      "retry": "Réessayer",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "indicateurs clés",
+      "panelPages": "pages",
+      "panelSegments": "segments",
+      "panelRelease": "comparaison des versions",
+      "panelFrustration": "frustration des utilisateurs",
+      "schemaErrorTitle": "Impossible de charger le schéma RUM",
+      "schemaErrorBody": "Les champs du flux n'ont pas pu être lus, la vue d'ensemble ne peut donc pas déterminer quels panneaux afficher.",
+      "pagesShowAll": "Afficher les {n} pages",
+      "pagesShowFewer": "Afficher moins de pages",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Aucune page avec suffisamment de vues",
+      "pagesEmptyBody": "Les pages doivent avoir au moins {n} vues sur cette période pour être classées.",
+      "segEmptyTitle": "Aucune donnée de segment",
+      "segEmptyBody": "Aucune valeur de navigateur, d'appareil, de système d'exploitation, de pays ou de connexion n'a été enregistrée pour ces vues.",
+      "releaseEmptyTitle": "Deux versions sont nécessaires",
+      "releaseEmptyBody": "La comparaison des versions nécessite au moins deux versions observées sur cette période.",
+      "releaseBefore": "{version} était déjà active avant cette période ; son heure de première observation n'est donc pas affichée.",
+      "pageErrorTitle": "Impossible de charger la vue d'ensemble des performances",
+      "pageErrorBody": "Les requêtes ont échoué ou expiré. Réessayez pour recharger tous les panneaux.",
+      "verdictOver": "{vital} dépasse le seuil de bonnes performances de {threshold} pour {pct} % des vues de page.",
+      "verdictAllThree": "Les trois Core Web Vitals sont conformes au p75.",
+      "verdictAllSome": "Les {n} Core Web Vitals évalués sont tous conformes au p75.",
+      "releaseNewErrors": "{count} nouvelle erreur dans cette version | {count} nouvelles erreurs dans cette version",
+      "verdictNoData": "Aucune donnée Core Web Vitals",
+      "verdictNoDataLead": "Aucune des {count} vue de page de cette période n'a remonté LCP, INP ou CLS. | Aucune des {count} vues de page de cette période n'a remonté LCP, INP ou CLS.",
+      "bandAtP75": "p75 : {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Ouvrir les sessions.",
+      "pagesTableLabel": "Pages classées par impact",
+      "verdictSessions": "{count} session sur la période. | {count} sessions sur la période.",
+      "verdictCompare": "Comparé à la période précédente.",
+      "deltaLower": "{v} de moins",
+      "deltaHigher": "{v} de plus",
+      "forbiddenTitle": "Aucune autorisation pour afficher {panel}",
+      "forbiddenBody": "Demandez à un administrateur l'accès au flux de données RUM.",
+      "pageForbiddenTitle": "Aucune autorisation pour afficher la vue d'ensemble des performances",
+      "asideLabel": "Où et qu'est-ce qui a changé",
+      "pagesAbout": "À propos de ce classement",
+      "chartPerFiveMinutes": "par 5 minutes",
+      "chartPerThirtyMinutes": "par 30 minutes",
+      "chartPerHour": "par heure",
+      "chartPerSixHours": "par 6 heures",
+      "chartPerDay": "par jour",
+      "chartIntervalOther": "par intervalle",
+      "chartTableCaption": "Sessions et erreurs par intervalle",
+      "deltaChange": "{delta} vs période précédente",
+      "deltaChangePts": "{delta} pts vs période précédente",
+      "deltaFlat": "Aucun changement vs période précédente",
+      "deltaNewMsg": "Nouveau vs période précédente",
+      "verdictP75Note": "Le verdict utilise toujours le p75 ; p50 et p95 ne changent que les valeurs.",
+      "releaseNote": "Compare les deux dernières versions, quel que soit le filtre Version.",
+      "kpiEmptyTitle": "Aucune session sur cette période",
+      "kpiEmptyBody": "Élargissez la plage de temps ou effacez un filtre.",
+      "releaseImproved": "amélioré",
+      "releaseWorse": "dégradé",
+      "segOs": "OS",
+      "segConnection": "Connexion",
+      "pagesAllLink": "Toutes les pages",
+      "pagesAllLinkAria": "Toutes les pages dans Analytique produit",
+      "frustrationReplayLink": "Regarder un replay",
+      "frustrationReplayHint": "Ouvre les sessions frustrées de cette période ; celles qui ont été enregistrées disposent d'un replay.",
+      "diffSegment": "{dim} : {value}",
+      "stateEmptyQuiet": "Rien n'a été enregistré sur cette période. Élargissez la plage de temps, ou configurez le SDK navigateur si cette application n'a pas encore envoyé de données.",
+      "stateEmptyFiltered": "Rien ne correspond à ces filtres sur cette période. Effacez les filtres pour voir tous les services, environnements et versions.",
+      "clearFilters": "Effacer les filtres",
+      "stateRefreshing": "Actualisation de {panel}",
+      "tileOpenSessions": "{label} : {value}. Sessions ouvertes",
+      "tileOpenErrors": "{label} : {value}. Ouvrir le suivi des erreurs",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Cette vue d'ensemble ne compte que les sessions de navigateur. Les métriques de l'application mobile sont ci-dessous.",
+      "mixedMobileNote": "Les filtres ci-dessous s'appliquent uniquement aux métriques de l'application mobile."
     }
   },
   "about": {
@@ -3184,8 +3374,11 @@
     "delete": "Supprimer",
     "confirmDeleteHead": "Supprimer un utilisateur",
     "confirmDeleteMsg": "Voulez-vous vraiment supprimer l’utilisateur {name} ?",
+    "block": "Bloquer",
+    "confirmBlockHead": "Bloquer l'utilisateur",
+    "confirmBlockMsg": "{email} a rejoint via votre domaine vérifié. Le blocage l'ajoute aux restrictions de domaine de cette organisation et le retire de cette organisation. Il est retiré des autres organisations mappées lors de sa prochaine connexion.",
     "cancel": "Annuler",
-    "save": "Sauver",
+    "save": "Enregistrer",
     "ok": "Ok",
     "sendInvite": "Envoyer une invitation",
     "inviteByEmail": "Invitez par e-mail. Plusieurs e-mails séparés par un point-virgule (;) ou une virgule (,)",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Révoquer l'invitation",
     "revokeInvitationMsg": "Êtes-vous sûr de vouloir révoquer l'invitation pour {email} ?",
     "deleteUsersTitle": "Supprimer des utilisateurs",
-    "deleteUsersMsg": "Êtes-vous sûr de vouloir supprimer {count} utilisateur ? | Êtes-vous sûr de vouloir supprimer {count} utilisateurs ?"
+    "deleteUsersMsg": "Êtes-vous sûr de vouloir supprimer {count} utilisateur ? | Êtes-vous sûr de vouloir supprimer {count} utilisateurs ?",
+    "deleteUsersBlockNote": "{count} d'entre eux ont rejoint via votre domaine vérifié et seront bloqués au lieu d'être supprimés."
   },
   "invitation": {
     "pendingInvitations": "Invitations en attente",
@@ -3403,8 +3597,6 @@
       },
       "show": "Afficher",
       "searchPermissions": "Rechercher des permissions",
-      "filterModules": "Filtrer les modules",
-      "noModuleMatch": "Aucun module ne correspond à votre filtre",
       "moduleScopeAll": "Tous",
       "moduleScopeGranted": "Sélectionnés",
       "noGrantedModule": "Aucun module n'est encore sélectionné",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Autorisation | Autorisations",
       "summaryReachSome": "{count} sur {total}",
       "summaryEmptyTitle": "Ce rôle n'accorde encore rien",
-      "summaryEmptyDescription": "Choisissez un module à gauche, ou partez d'un préréglage.",
+      "summaryEmptyDescription": "Partez d'un préréglage, ou choisissez des modules dans la liste.",
       "presetReadonlyTitle": "Lecture seule",
       "presetReadonlyDescription": "Lister et obtenir sur chaque module",
       "presetDbmTitle": "Visionneuse de surveillance des bases de données",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "Aucun des {total} flux de métriques Kubernetes n'existe encore dans cette organisation, rien n'a donc été présélectionné.",
       "rumPresetSeeded": "Accès en lecture présélectionné sur {matched} des {total} flux RUM, ainsi que sur les source maps et toute autorisation Product Analytics RUM. Vérifiez avant d'enregistrer.",
       "rumPresetNoMatch": "Aucun des {total} flux RUM n'existe encore dans cette organisation, donc rien n'a été présélectionné sur ceux-ci ; les source maps et toute autorisation Product Analytics RUM ont tout de même été préparées.",
-      "moduleGroupFleet": "Flotte"
+      "moduleGroupFleet": "Flotte",
+      "filterModulesTasks": "Filtrer les modules",
+      "noModuleMatchQuery": "Aucun module ne correspond à « {query} »",
+      "noModuleMatchHint": "Recherchez par module, groupe ou tâche, par exemple slack, panel ou token.",
+      "presetAlertManagerTitle": "Gestionnaire d'alertes",
+      "presetAlertManagerDescription": "Créer et gérer les alertes, leurs destinations et leurs messages",
+      "presetAlertViewerTitle": "Lecteur d'alertes",
+      "presetAlertViewerDescription": "Voir les alertes, les destinations et les modèles sans les modifier",
+      "presetDashboardEditorTitle": "Éditeur de tableaux de bord",
+      "presetDashboardEditorDescription": "Créer et modifier des tableaux de bord, avec un accès en lecture aux données qu'ils interrogent",
+      "presetDashboardViewerTitle": "Lecteur de tableaux de bord",
+      "presetDashboardViewerDescription": "Ouvrir des tableaux de bord et lire les données derrière leurs panneaux",
+      "presetPipelineEditorTitle": "Éditeur de pipelines",
+      "presetPipelineEditorDescription": "Créer des pipelines et des fonctions, avec un accès en lecture aux flux et aux tableaux d'enrichissement",
+      "presetApplied": "{title} a ajouté {permissions}. Vérifiez les modifications avant d'enregistrer.",
+      "presetPermissionCount": "{count} permission | {count} permissions",
+      "companionReasonAlertStreams": "pour enregistrer les alertes. Le serveur vérifie l'accès aux flux lors de l'enregistrement",
+      "companionReasonAlertDestinations": "pour choisir où les alertes sont envoyées",
+      "companionReasonDestinationTemplates": "pour choisir le modèle de message, requis par chaque destination",
+      "companionReasonDashboardStreams": "pour charger les données des panneaux",
+      "presetsTitle": "Préréglages",
+      "presetsClose": "Fermer les préréglages",
+      "presetsShow": "Afficher les préréglages",
+      "presetsSubtitle": "Ajoutez les autorisations d'un préréglage à ce rôle. Rien n'est retiré.",
+      "presetsSectionBuiltin": "Intégrés",
+      "presetsSectionJob": "Par métier",
+      "presetAddsTooltip": "Ajoute {count} permission | Ajoute {count} permissions",
+      "presetInRole": "Dans le rôle",
+      "presetInRoleTooltip": "Ce rôle possède déjà tout le contenu de ce préréglage",
+      "presetBack": "Tous les préréglages",
+      "presetModuleCount": "{count} module | {count} modules",
+      "presetSummaryAdds": "Ajoute {permissions} dans {modules}.",
+      "presetSummaryWrite": "Accès en écriture dans {modules}.",
+      "presetSummaryViewOnly": "Consultation uniquement : rien ne peut être créé, modifié ou supprimé.",
+      "presetSummaryHasAll": "Ce rôle possède déjà tout le contenu de ce préréglage.",
+      "presetSummarySkipped": "{count} permission déjà présente dans ce rôle est ignorée. | {count} permissions déjà présentes dans ce rôle sont ignorées.",
+      "presetStillMissing": "Toujours manquant après l'ajout : {list}",
+      "presetMissingItem": "{module} : {actions}",
+      "presetNothingMissing": "Rien ne manquera après l'ajout.",
+      "neededBy": "Requis par {modules}",
+      "stillNeededBy": "Toujours requis par {modules}",
+      "presetReadsEveryStream": "Lit tous les flux de cette organisation, y compris les nouveaux.",
+      "presetAddButton": "Ajouter {count} permission | Ajouter {count} permissions",
+      "presetNothingToAdd": "Rien à ajouter",
+      "presetApplyNote": "Les autorisations ajoutées deviennent des modifications non enregistrées. Vérifiez-les avant d'enregistrer.",
+      "presetLoadingStreams": "Chargement des flux",
+      "presetNoMatchingStreams": "Aucun flux correspondant dans cette organisation pour le moment.",
+      "reviewMissingTooltip": "{count} module manquant pour que ce rôle fonctionne | {count} modules manquants pour que ce rôle fonctionne",
+      "notAddedYetTitle": "Pas encore ajoutés · {modules}",
+      "companionAdd": "Ajouter",
+      "companionAddItem": "Ajouter {item}",
+      "companionAddAll": "Tout ajouter",
+      "companionOpenStreams": "Ouvrir les flux",
+      "companionOpenStreamsTooltip": "Choisir les flux que ce rôle peut lire",
+      "companionNeeds": "{module} en a besoin {reason}.",
+      "companionNeedsThis": "{module} a besoin de ceci {reason}.",
+      "companionStillNeedsThis": "{module} en a toujours besoin {reason}.",
+      "yourChanges": "Vos modifications",
+      "yourChangesCount": "{changes} dans {modules}",
+      "yourChangesNone": "Aucune pour l'instant",
+      "changeCount": "{count} modification | {count} modifications",
+      "changeOtherGroup": "Autres",
+      "saveSuccessCounts": "Enregistré : {changes} dans {modules}.",
+      "effectCan": "Peut {actions} {target}.",
+      "effectCannot": "Ne peut plus {actions} {target}.",
+      "effectCanLoadDestinations": "Peut charger la liste des destinations.",
+      "effectCannotLoadDestinations": "Ne peut plus charger la liste des destinations.",
+      "effectCanLoadTemplates": "Peut charger la liste des modèles.",
+      "effectCannotLoadTemplates": "Ne peut plus charger la liste des modèles.",
+      "verbView": "voir",
+      "verbSeeListOf": "voir dans la liste",
+      "verbList": "lister",
+      "verbOpen": "ouvrir",
+      "verbCreate": "créer",
+      "verbEdit": "modifier",
+      "verbDelete": "supprimer",
+      "targetEveryStream": "tous les flux (logs, métriques, traces et index), y compris les nouveaux",
+      "targetTypeStreams": "tous les flux {type}",
+      "targetOneStream": "le flux {type} {name}",
+      "targetAlertsEveryFolder": "les alertes de tous les dossiers, y compris les nouveaux dossiers",
+      "targetAlertsInFolder": "les alertes du dossier {name}",
+      "targetOneAlert": "l'alerte {name}",
+      "targetDashboardsEveryFolder": "les tableaux de bord de tous les dossiers, y compris les nouveaux dossiers",
+      "targetDashboardsInFolder": "les tableaux de bord du dossier {name}",
+      "targetOneDashboard": "le tableau de bord {name}",
+      "targetReportsEveryFolder": "les rapports de tous les dossiers, y compris les nouveaux dossiers",
+      "targetReportsInFolder": "les rapports du dossier {name}",
+      "targetOneReport": "le rapport {name}",
+      "targetEveryDestination": "toutes les destinations d'alerte (Slack, e-mail, webhooks), y compris les nouvelles",
+      "targetOneDestination": "la destination {name}",
+      "targetEveryTemplate": "tous les modèles de notification, y compris les nouveaux",
+      "targetOneTemplate": "le modèle {name}",
+      "targetAllOf": "tous les {module}, y compris les nouveaux",
+      "targetItemIn": "{name} dans {module}",
+      "noteDestinationsFiltered": "Ils ne voient que les destinations qu'ils peuvent aussi ouvrir. Ajoutez « Obtenez » ici, ou sur des destinations individuelles, pour choisir lesquelles.",
+      "noteTemplatesFiltered": "Ils ne voient que les modèles qu'ils peuvent aussi ouvrir. Ajoutez « Obtenez » ici, ou sur des modèles individuels, pour choisir lesquels.",
+      "presetStreamsFailed": "Impossible de charger la liste des flux.",
+      "presetRetry": "Réessayer",
+      "presetRestored": "{title} a restauré {permissions}. Vérifiez les modifications avant d'enregistrer.",
+      "presetSummaryRestores": "Conserve {count} permission que vous avez marquée pour suppression. | Conserve {count} permissions que vous avez marquées pour suppression.",
+      "presetRestoreButton": "Conserver {count} permission | Conserver {count} permissions",
+      "effectStillAllowed": "Aucun changement d'accès : une permission plus large l'autorise toujours."
     },
     "rolesPage": {
       "subtitle": "Les rôles regroupent des autorisations : attribuez-les à des utilisateurs, à des comptes de service ou à des groupes pour accorder l'accès.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Utilisateur mis à jour avec succès.",
       "userDeletedSuccess": "Utilisateur supprimé avec succès.",
       "errorDeletingUser": "Erreur lors de la suppression de l'utilisateur.",
+      "userBlockedSuccess": "Utilisateur bloqué avec succès.",
+      "errorBlockingUser": "Erreur lors du blocage de l'utilisateur.",
+      "blockedButNotRemoved": "L'utilisateur a été bloqué, mais n'a pas pu être retiré de cette organisation.",
+      "blockedUsersSuccess": "{count} utilisateur bloqué avec succès | {count} utilisateurs bloqués avec succès",
+      "blockedUsersPartial": "{count} utilisateur bloqué et retiré, mais {failed} n'a pas pu être retiré de cette organisation | {count} utilisateurs bloqués et retirés, mais {failed} n'ont pas pu être retirés de cette organisation",
+      "blockedUsersNotRemoved": "{count} utilisateur bloqué, mais impossible de le retirer de cette organisation | {count} utilisateurs bloqués, mais impossible de les retirer de cette organisation",
       "pleaseWait": "Veuillez patienter...",
       "invitationRevokedSuccess": "Invitation révoquée avec succès.",
       "errorRevokingInvitation": "Erreur lors de la révocation de l'invitation.",
@@ -3959,7 +4258,7 @@
     "updateOrganization": "Mettre à jour l'organisation",
     "makeBilledMember": "Ajouter cette organisation en tant que membre facturant de l'organisation actuelle.",
     "add": "Ajouter une organisation",
-    "save": "Sauver",
+    "save": "Enregistrer",
     "cancel": "Annuler",
     "search": "Rechercher une organisation",
     "id": "ID de l'organisation",
@@ -4544,7 +4843,7 @@
       "sqlQueryRequired": "Pipeline - {index} : la requête SQL est requise",
       "timezoneRequired": "Pipeline - {index} : le fuseau horaire est requis",
       "orgIdInvalid": "Pipeline - {index} : l'identifiant de l'organisation est obligatoire, doit exister dans la liste des organisations et doit être égal à {orgId} ",
-      "functionNameRequired": "Pipeline - {index}, Fonction-{counter} : le nom de la fonction est requis et doit soit exister dans cette organisation, soit être inclus dans le fichier d'export",
+      "functionNameRequired": "Pipeline - {index}, Function-{counter} : le nom de la fonction est requis et doit soit exister dans cette organisation, soit être inclus dans le fichier d'export",
       "functionCreated": "Pipeline - {index} : fonction « {name} » créée",
       "functionCreatedCopy": "Pipeline - {index} : la fonction « {name} » existe déjà avec une logique différente, « {copy} » a été créée",
       "functionReusedCopy": "Pipeline - {index} : la fonction « {name} » existe déjà avec une logique différente, la copie correspondante « {copy} » a été réutilisée",
@@ -4734,14 +5033,14 @@
     "value": "Valeur",
     "fieldRequired": "Ce champ est obligatoire !",
     "sqlQuery": "Requête SQL",
-    "promqlQuery": "Requête ProMQL",
+    "promqlQuery": "Requête PromQL",
     "output": "sortie",
     "validating": "Validation...",
     "validateAndClose": "Valider et fermer",
     "editPipelineJson": "Modifier le fichier Json du pipeline",
     "editPipelineJSON": "Modifier le JSON du pipeline",
     "savePipeline": "Enregistrer le pipeline",
-    "savePipelineConfirm": "Êtes-vous sûr de vouloir sauver ce pipeline, car cela n'a aucun impact ?",
+    "savePipelineConfirm": "Êtes-vous sûr de vouloir enregistrer ce pipeline, car cela n'a aucun impact ?",
     "sourceStreamTooltip": "Source : Stream Node",
     "sourceQueryTooltip": "Source : Query Node",
     "functionTooltip": "Nœud de fonction",
@@ -4752,10 +5051,10 @@
     "pipelineNameRequired": "Le nom du pipeline est obligatoire",
     "sourceNodeRequired": "Le nœud source est requis",
     "destinationNodeRequired": "Le nœud de destination est requis",
-    "connectAllNodes": "Veuillez connecter tous les nœuds avant de sauvegarder",
+    "connectAllNodes": "Veuillez connecter tous les nœuds avant d'enregistrer",
     "connectAllNodesShort": "Veuillez connecter tous les nœuds",
     "enrichmentTablesScheduledOnly": "Les tables d'enrichissement en tant que flux de destination ne sont disponibles que pour les pipelines planifiés",
-    "savingPipeline": "Sauver un pipeline...",
+    "savingPipeline": "Enregistrement du pipeline...",
     "pipelineUpdated": "Mise à jour réussie du pipeline",
     "pipelineSaved": "Pipeline enregistré avec succès",
     "errorSavingPipeline": "Erreur lors de l'enregistrement du pipeline",
@@ -4767,7 +5066,7 @@
     "chooseSource": "Choisir une source",
     "sourceStreamDesc": "Traiter les données en temps réel lors de leur ingestion dans un flux",
     "sourceQueryDesc": "Exécuter une requête selon un planning et traiter ses résultats",
-    "promqlOnlyForMetrics": "ProMQL n'est disponible que pour le type de flux de métriques",
+    "promqlOnlyForMetrics": "PromQL n'est disponible que pour le type de flux de métriques",
     "invalidCronExpression": "Expression cron non valide",
     "cronRequired": "L'expression cron est obligatoire",
     "destResourceNameInvalid": "Les caractères comme :, ?, /, # et les espaces ne sont pas autorisés.",
@@ -4959,7 +5258,7 @@
     "search": "Rechercher une fonction",
     "name": "Nom",
     "renameHint": "Cliquez pour renommer cette fonction",
-    "save": "Sauver",
+    "save": "Enregistrer",
     "jsfunction": "Fonction",
     "actions": "Des actions",
     "cancel": "Annuler",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Les traces sont capturées avec eBPF : aucune modification de code ni SDK n’est nécessaire. Le contexte de trace ne passe d’un service à l’autre qu’en HTTP en clair (aussi en HTTPS pour les apps Go, sauf sur les nœuds avec le kernel lockdown). Un processus correspondant à l’un des ports, au chemin de l’exécutable ou à la ligne de commande est tracé ; les motifs glob ne peuvent pas contenir `,`, `{'{'}` ni `{'}'}`, et un port correspond à tout processus qui détient un socket sur ce port. Nécessite Helm 3.14+ et l’opérateur OpenTelemetry v0.142.0+ ; si le vôtre est plus ancien, mettez-le d’abord à jour avec `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Si eBPF était déjà activé avec un opérateur plus ancien, relancez la commande avec `--force` (`--force-replace` avec Helm 4). Relancer la commande d’installation ci-dessus réinitialise la release et désactive eBPF : relancez ensuite cette commande. L’espace de noms `openobserve-collector` doit autoriser les pods privilégiés, et les nœuds doivent exécuter Linux sur amd64 ou arm64 avec un noyau 5.8+ (ou la famille RHEL 4.18 avec rétroportages eBPF) et BTF. Ne sélectionnez pas les applications qui envoient déjà leurs propres traces, ni les pods qui utilisent le sidecar Go `inject-go`.",
       "k8sEbpfVariant": "eBPF (tout langage, sans modifier le code)",
       "k8sLibrariesVariant": "Bibliothèques de langage (auto-instrumentation)",
+      "k8sNetworkFlowsDesc": "Le DaemonSet eBPF du collecteur enregistre les **octets envoyés entre les charges de travail sur tout protocole TCP ou UDP** sur chaque nœud Linux, y compris les bases de données, les caches et les autres services qui ne sont pas tracés. Ils arrivent sous forme de métrique `obi_network_flow_bytes`, étiquetée avec le propriétaire source et destination (Deployment, StatefulSet, Node, …) et l’espace de noms. Fonctionne avec ou sans traçage eBPF.",
+      "k8sNetworkFlowsNote": "Nécessite Helm 3.14+ et l'opérateur OpenTelemetry v0.142.0+. L'espace de noms `openobserve-collector` doit autoriser les pods privilégiés, et les nœuds doivent exécuter Linux sur amd64 ou arm64 avec un noyau 5.8+ (ou de la famille RHEL 4.18 avec rétroportages eBPF) et BTF. Les pods eBPF s'exécutent sur le réseau de l'hôte, et les métriques propres au collecteur écoutent sur `127.0.0.1:8888` de chaque nœud ; ce port doit donc y être libre. Les sélecteurs de traces eBPF que vous avez déjà définis sont conservés. Réexécuter la commande d'installation ci-dessus réinitialise la release et désactive cette fonctionnalité ; réexécutez donc cette commande ensuite. Les mêmes octets peuvent être signalés plusieurs fois : le trafic entre nœuds par les deux nœuds, et une connexion à un Service à la fois par le Service et par la charge de travail derrière lui. Le guide des flux réseau eBPF explique comment les interroger sans double comptage.",
+      "k8sNetworkFlowsTitle": "Voir quelles charges de travail communiquent entre elles : flux réseau eBPF",
       "k8sInstallerNote": "Cela installe cert-manager, l'opérateur OpenTelemetry et le collecteur OpenObserve automatiquement.",
       "k8sInternalEndpointNote": "Utilisez ceci lorsque OpenObserve s'exécute dans ce même cluster — le trafic ne le quitte jamais.",
       "k8sTroubleAnnotationA": "L'injection a lieu à la création du pod, donc les pods existants ne sont pas affectés jusqu'à leur redémarrage — exécutez `kubectl rollout restart deployment -n my-namespace`. Confirmez que l'annotation a été posée avec `kubectl get ns my-namespace -o yaml`, et vérifiez que la valeur correspond à `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "L'installation échoue avec une erreur concernant le webhook d'admission",
       "linuxAgentFixBody": "L'installateur démarre l'agent comme un service systemd. Si rien n'arrive, confirmez qu'il est en cours d'exécution et lisez ses logs pour une erreur d'authentification ou de connectivité :",
       "linuxTracesNote": "Les traces sont capturées avec eBPF : aucune modification de code ni SDK n’est nécessaire. Un processus correspondant à l’un des ports, au chemin de l’exécutable ou à la ligne de commande est tracé ; les motifs glob ne peuvent pas contenir `,`, `{'{'}` ni `{'}'}`. Le traçage nécessite Linux 5.8+ (ou la famille RHEL 4.18 avec rétroportages eBPF) avec BTF ; l’agent s’exécute alors en tant que root. Si l’hôte ne peut pas tracer, l’installation s’arrête et laisse l’agent en cours d’exécution intact. Si l’agent ne démarre ensuite pas avec le traçage activé, celui-ci est désactivé — ainsi que les logs et les métriques — jusqu’à ce que vous réexécutiez la commande **Logs & métriques**, ou que vous corrigiez la cause et réexécutiez avec le traçage. Les applications tracées ajoutent un en-tête W3C `traceparent` aux requêtes HTTP en texte brut sortantes. Le guide de traçage eBPF ci-dessous couvre HTTPS et les options répétées.",
+      "linuxNetworkFlowsDesc": "Exécutez l’installateur avec `--network-flows` pour signaler les **octets que cet hôte envoie et reçoit sur tout protocole TCP ou UDP**, sous forme de métrique `obi_network_flow_bytes`. Chaque flux est étiqueté `src_cidr` et `dst_cidr` avec les réseaux que vous listez ; donnez donc la même liste à chaque hôte : une entrée `/32` par hôte donne une carte hôte à hôte.",
+      "linuxNetworkFlowsNote": "Nécessite Linux 5.8+ (ou de la famille RHEL 4.18 avec rétroportages eBPF) avec BTF ; l'agent s'exécute alors en tant que root. Il fonctionne avec ou sans traçage, mais chaque exécution de l'installateur remplace la configuration de l'agent : pour maintenir le traçage actif, ajoutez les options `--trace-*` et `--service-name` de la commande **Logs, métriques et traces eBPF**. Si l'hôte ne peut pas exécuter eBPF, l'installation s'arrête et laisse l'agent en cours d'exécution intact. Si la capture réseau ne parvient alors pas à démarrer, l'agent est désactivé — les logs et les métriques aussi — jusqu'à ce que vous réexécutiez la commande **Logs et métriques**, ou que vous corrigiez la cause et réexécutiez avec `--network-flows`. Le trafic entre deux hôtes qui exécutent tous deux l'agent est signalé par chacun d'eux, et le trafic de bouclage est compté sauf si les deux extrémités ont la même adresse. Le guide des flux réseau eBPF ci-dessous explique les étiquettes et comment les interroger sans double comptage.",
+      "linuxNetworkFlowsTitle": "Voir quels hôtes communiquent entre eux : flux réseau eBPF",
       "linuxTracesVerifyNote": "Avec le traçage activé, les traces apparaissent dès qu'une application tracée traite une requête.",
+      "ebpfNetworkFlowsGuideLink": "Guide des flux réseau eBPF",
       "ebpfTracingGuideLink": "Guide du traçage eBPF",
       "logsMetricsTracesVariant": "Logs, métriques et traces eBPF",
       "logsMetricsVariant": "Logs et métriques",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Pointez n'importe quel exportateur OpenTelemetry vers OpenObserve — collecteur ou SDK, HTTP ou gRPC. Votre point de terminaison et votre jeton sont remplis ci-dessous.",
       "taglineWindows": "Installez l'agent OpenObserve sur n'importe quel hôte Windows — journaux d'événements, compteurs de performance et métriques d'hôte.",
       "testAgain": "Retester",
+      "networkFlowsHelp": "Entrées CIDR ou CIDR=NOM, séparées par des virgules sans espaces ; chaque CIDR doit avoir une longueur de préfixe, par ex. 10.0.1.5/32, et les noms ne peuvent contenir que des lettres, des chiffres, ., _ et -. Les adresses qui ne correspondent à aucune entrée restent sans étiquette ; 0.0.0.0/0=other nomme le reste d’IPv4, ::/0=other6 nomme le reste d’IPv6.",
+      "networkFlowsLabel": "Réseaux à étiqueter",
+      "networkFlowsRequired": "Indiquez au moins un réseau : les flux sont étiquetés avec les réseaux que vous listez.",
       "traceCmdHelp": "Pour les applications Python, Node.js et Java.",
       "traceCmdLabel": "Ligne de commande",
       "traceExeLabel": "Chemin de l'exécutable",
@@ -6536,7 +6845,7 @@
     "noFavoritesTitle": "Aucun tableau de bord favori pour l'instant",
     "noFavoritesMessage": "Cliquez sur l'icône étoile sur n'importe quel tableau de bord pour le voir ici, dans tous les dossiers.",
     "moreActions": "Plus d'actions",
-    "save": "Sauver",
+    "save": "Enregistrer",
     "cancel": "Annuler",
     "delete": "Supprimer le tableau de bord",
     "deleteDashboardConfirmTitle": "Supprimer le tableau de bord",
@@ -7029,7 +7338,7 @@
     "searchAcross": "Recherche dans les dossiers",
     "folder": "Dossier",
     "folders": "Dossiers",
-    "searchFolder": "Dossier de recherche",
+    "searchFolder": "Rechercher un dossier",
     "folderIcon": "Icône",
     "folderIconAria": "Choisissez une icône de dossier",
     "deleteFolder": "Supprimer le dossier",
@@ -7137,7 +7446,7 @@
     "mapsMapType": "Type de carte",
     "tableAggregations": "Agrégations de tableaux",
     "tableCellDrilldownTooltip": "Explorer les journaux correspondants",
-    "promqlTableMode": "Mode Tableau ProMQL",
+    "promqlTableMode": "Mode Tableau PromQL",
     "visibleColumns": "Colonnes visibles",
     "hiddenColumns": "Colonnes masquées",
     "stickyFirstColumn": "Première colonne collante",
@@ -7329,7 +7638,7 @@
     "expandAllSections": "Développer toutes les sections",
     "collapseAllSections": "Réduire toutes les sections",
     "configSectionGeneral": "Général",
-    "configSectionPromqlTable": "Mode Tableau ProMQL",
+    "configSectionPromqlTable": "Mode Tableau PromQL",
     "configSectionGeographic": "Configuration géographique",
     "configSectionLegend": "Légende",
     "configSectionData": "Données",
@@ -7351,7 +7660,7 @@
     "valueMappingTo": "À",
     "valueMappingDisplayValue": "Valeur d'affichage",
     "valueMappingAddNew": "+ Ajouter un nouveau mappage",
-    "valueMappingApply": "Postulez",
+    "valueMappingApply": "Appliquer",
     "valueMappingTypeValue": "Égal à",
     "valueMappingTypeRange": "Entre",
     "valueMappingTypeRegex": "Correspond à l'expression régulière",
@@ -7455,7 +7764,7 @@
     "seriesStyleHideChart": "Graphique",
     "seriesStyleHideLegend": "Légende",
     "seriesStyleHideTooltip": "Info-bulle",
-    "configPanelSearchPlaceholder": "Configuration de recherche...",
+    "configPanelSearchPlaceholder": "Rechercher une configuration...",
     "configPanelNoResultsFound": "Aucun paramètre n'a été trouvé pour « {query} »",
     "intervalInputPlaceholder": "p. ex., {example}",
     "placeholderAll": "TOUS",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Masquer les cellules sous",
     "heatmapHideBelowTooltip": "Les cellules dont la valeur est inférieure restent vides.",
     "heatmapHideBelowNote": "Les cellules inférieures à {value} sont masquées",
+    "boxplotWhisker": "Moustaches",
+    "boxplotWhiskerMinMax": "Du minimum au maximum",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Champ du message",
+    "logsLevelField": "Champ du niveau",
+    "logsTimeField": "Champ de l'heure",
+    "htmlPanelFieldTooltip": "Laissez vide pour détecter la colonne à partir des résultats de la requête",
+    "logsOrder": "Ordre",
+    "logsOrderNewest": "Plus récents d'abord",
+    "logsOrderOldest": "Plus anciens d'abord",
+    "logsOrderTooltip": "Trie les lignes renvoyées par la requête. Une requête de départ non modifiée est aussi récupérée dans cet ordre : « Plus anciens d'abord » affiche les logs les plus anciens.",
+    "logsShowTime": "Afficher l'heure",
+    "logsWrap": "Retour à la ligne",
+    "logsPrettifyJson": "Mettre en forme le JSON",
     "distributionBucketCount": "Nombre d'intervalles",
     "distributionBucketSize": "Taille d'intervalle",
     "distributionBucketSizeTooltip": "Largeur de chaque intervalle dans les unités du champ. Si elle est définie, elle remplace le nombre d'intervalles.",
@@ -7822,6 +8145,8 @@
       "gauge": "Jauge",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Boîte à moustaches",
+      "logs": "Journaux",
       "barGauge": "Jauge à barres",
       "distribution": "Distribution",
       "treemap": "Treemap",
@@ -7899,8 +8224,8 @@
       "panelMoved": "Panneau déplacé avec succès !",
       "panelMoveFailed": "Échec du déplacement du panneau",
       "failedToFetchReports": "Échec de la récupération des rapports",
-      "failedToUpdateJson": "Échec de la mise à jour du JSON du tableau de bord : méthode de sauvegarde non disponible",
-      "failedToSaveChanges": "Échec de la sauvegarde des modifications du tableau de bord"
+      "failedToUpdateJson": "Échec de la mise à jour du JSON du tableau de bord : méthode d'enregistrement non disponible",
+      "failedToSaveChanges": "Échec de l'enregistrement des modifications du tableau de bord"
     },
     "dynamicFunctionPopUp": {
       "property": "Propriété",
@@ -8230,7 +8555,7 @@
     "failedToCancelRunningQuery": "Échec de l'annulation de la requête en cours d'exécution",
     "failedToDownloadCsv": "Échec du téléchargement des données au format CSV",
     "failedToDownloadJson": "Échec du téléchargement des données au format JSON",
-    "failedToNavigateToLogs": "Échec de la navigation vers les journaux",
+    "failedToNavigateToLogs": "Échec de la navigation vers Logs",
     "invalidColumns": "Colonnes invalides",
     "noDataAvailableToDownload": "Aucune donnée disponible à télécharger",
     "noPermissionHomeDashboard": "Vous n'avez pas la permission de modifier le tableau de bord d'accueil",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field} : Argument requis manquant à la position {index}",
       "fieldNotAllowedForMetric": "Le champ {label} n'est pas autorisé pour le graphique métrique",
       "rawValueSampled": "Basé sur les {count} premières lignes",
+      "addAtMostOneFieldFor": "Ajoutez au plus un champ pour {label}",
+      "boxplotMin": "Min",
+      "boxplotMax": "Max",
+      "boxplotLowerWhisker": "Moustache inférieure",
+      "boxplotUpperWhisker": "Moustache supérieure",
+      "boxplotMedian": "Médiane",
+      "boxplotSamples": "Échantillons",
+      "boxplotOutlier": "Valeur aberrante",
       "fieldNotAllowedForDistribution": "Le champ {label} n'est pas autorisé pour le graphique de distribution",
       "distributionCount": "Nombre",
       "addAtLeastOneFieldFor": "Ajoutez au moins un champ pour {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Aucun accès",
       "urlHiddenHint": "Vous ne pouvez pas consulter le tableau de bord de ce lien : son URL publique est donc masquée.",
       "orgDisabledHint": "Les liens publics sont désactivés pour cette organisation",
+      "orgDisabledBanner": "Les liens publics sont désactivés pour cette organisation, aucun lien n'est donc servi. Un administrateur peut les réactiver.",
+      "disabledPaused": "Désactivé · En pause",
       "takeOver": "Prendre le relais",
       "takeOverTitle": "Prendre le relais sur ce lien ?",
       "takeOverBody": "Vous devenez l'éditeur. La page publique affichera ce que vous êtes autorisé à voir, ce qui peut être plus ou moins qu'avant. Toute personne disposant de l'URL y garde accès, et le lien est actif dès maintenant.",
@@ -8648,7 +8983,7 @@
       "singlequote": "Guillemets simples : {example}"
     },
     "add": "Ajouter un panneau",
-    "save": "Sauver",
+    "save": "Enregistrer",
     "cancel": "Annuler",
     "name": "Nom du panel",
     "options": "Options",
@@ -8705,7 +9040,7 @@
     "valueFields": "Champs de valeur",
     "noData": "Aucune donnée",
     "logExplorer": {
-      "title": "Explorateur de logs",
+      "title": "Explorateur de Logs",
       "openInLogs": "Ouvrir dans Logs",
       "invalidParams": "Paramètres d'exploration invalides",
       "noEvents": "Aucun événement ne correspond à ce filtre",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Groupe",
     "wellSubgroup": "Sous-groupe",
     "wellSize": "Taille",
+    "wellCategory": "Catégorie",
     "value": "Valeur"
   },
   "home": {
@@ -8860,7 +9196,7 @@
     "emptyActionAlerts": "Afficher les règles d'alerte",
     "emptyActionAlertsDesc": "Passez en revue les alertes et les seuils configurés",
     "emptyActionLogs": "Explorez les journaux",
-    "emptyActionLogsDesc": "Recherchez et filtrez vos flux de journaux",
+    "emptyActionLogsDesc": "Recherchez et filtrez vos flux de logs",
     "emptyActionTraces": "Explorer les traces",
     "emptyActionTracesDesc": "Inspectez les traces distribuées et la latence des services",
     "anomalyDetectedTitle": "Anomalie détectée — {name}",
@@ -9076,7 +9412,7 @@
       "vrlParseJson": "Écrire VRL pour analyser le JSON à partir de mes journaux nginx",
       "regexRedact": "Générez un motif regex pour expurger les e-mails",
       "mapStreamSchema": "Mapper mon schéma de flux « par défaut »",
-      "promqlCpu": "Écrivez ProMQL pour les pods utilisant > 80 % du processeur",
+      "promqlCpu": "Écrivez PromQL pour les pods utilisant > 80 % du processeur",
       "datadogToO2": "Convertissez cette requête Datadog en OpenObserve SQL",
       "lastAlertFired": "Pourquoi ma dernière alerte a-t-elle été déclenchée ?"
     },
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Éloigner la valeur de déclenchement de l'état stable observé.",
       "lengthenEvaluationWindow": "Allonger la fenêtre d'évaluation",
       "lengthenEvaluationWindowDesc": "Élargir la période pour qu'un pic court ne déclenche plus l'alerte.",
-      "enableDeduplication": "Activer la déduplication",
-      "enableDeduplicationDesc": "Regrouper les déclenchements répétés dans une fenêtre de déduplication.",
+      "enableDeduplication": "Activer la suppression des répétitions",
+      "enableDeduplicationDesc": "Notifier une seule fois par changement d'état plutôt qu'à chaque évaluation.",
       "reviewForDeletion": "Examiner en vue d'une suppression",
       "reviewForDeletionDesc": "Confirmer que la requête correspond toujours à la réalité avant de retirer l'alerte.",
       "fixAlertQuery": "Corriger la requête d'alerte",
@@ -9823,7 +10159,7 @@
       "frequencyHelp": "Entre 1 heure et 30 jours.",
       "window": "Fenêtre d'analyse",
       "windowHelp": "Période remontée par chaque exécution, entre 1 minute et 90 jours. Une fenêtre plus longue que la cadence fait se chevaucher les exécutions consécutives, qui signalent alors à nouveau les mêmes constats.",
-      "noConfig": "Cette organisation n'a pas encore de réglages de calibration des alertes. Les valeurs ci-dessous sont les valeurs par défaut enregistrées lors de votre première sauvegarde.",
+      "noConfig": "Cette organisation n'a pas encore de réglages de calibration des alertes. Les valeurs ci-dessous sont les valeurs par défaut enregistrées lors de votre premier enregistrement.",
       "warnGap": "S'exécute toutes les {every} mais ne remonte que sur {window} : la période entre les fenêtres n'est jamais analysée.",
       "warnStarved": "Une fenêtre de {window} est trop courte pour {rules} ; chaque exécution les écarte donc pour toutes les alertes.",
       "ruleNeeds": "{rule} (nécessite {duration})",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "ID de l'organisation",
     "alertCreationTitle": "Création d'alerte",
     "noAlertsFound": "Aucune alerte trouvée",
-    "suppressedByDeduplication": "Supprimé par déduplication",
-    "occurrence": "{count} occurrence | {count} occurrences",
     "groupedNotification": "Notification groupée",
     "alertsBatchedTogether": "alertes regroupées ensemble",
-    "notificationSent": "Notification envoyée",
-    "occurrencesDeduplicated": "occurrences dédupliquées",
     "alertExecutionDetails": "Détails d'exécution de l'alerte",
     "evaluationTime": "Temps d'évaluation",
     "queryTime": "Temps de requête",
@@ -10036,7 +10368,7 @@
     "guidelinesLabel": "Directives :",
     "selectStreamGuideline": "Sélectionnez un flux existant dans la liste ou saisissez le nom pour en créer un nouveau",
     "enrichmentTablesTerm": "Enrichment_tables",
-    "enrichmentTablesDestinationNote": "comme flux de destination n'est disponible que pour les pipelines planifiés",
+    "enrichmentTablesDestinationNote": "comme flux de destination ne sont disponibles que pour les pipelines planifiés",
     "useCurlyBracesNote": "Utiliser des accolades",
     "configureStreamNameDynamicNote": "pour configurer dynamiquement le nom du flux, p. ex.",
     "staticTextBeforeAfterNote": ". Texte statique avant/après",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "À : {time}",
     "serviceGraphTooltipTemporalCorrelation": "Corrélation temporelle",
     "serviceGraphTooltipServiceDependency": "Dépendance de service",
-    "totalAlerts": "Total des alertes",
-    "usingDeduplication": "Utilisation de la déduplication",
-    "deduplicationConfiguredTooltip": "Alertes avec déduplication configurée",
-    "suppressionRate24h": "Taux de suppression (24h)",
     "suppressed": "supprimées /",
-    "total": "total",
-    "passedLabel": "Réussi :",
-    "pendingBatches": "Lots en attente",
-    "pendingBatchesTooltip": "Alertes en attente d'être regroupées",
     "historyTimeline": {
       "firing": "Déclenchée",
       "ok": "OK",
@@ -10089,7 +10413,8 @@
     "endTime": "Heure de fin",
     "duration": "Durée",
     "retries": "Nouvelles tentatives",
-    "dedup": "Déduplication",
+    "suppression": "Suppression",
+    "suppressedAsRepeat": "Supprimé car répétition",
     "validation": {
       "streamTypeRequired": "Le type de Stream est requis.",
       "streamNameRequired": "Le nom du Stream est requis.",
@@ -10176,7 +10501,7 @@
     "addConditions": "Ajouter des conditions",
     "addCondition": "Ajouter une condition",
     "sqlEditor": "Éditeur SQL",
-    "promqlEditor": "Éditeur ProMQL",
+    "promqlEditor": "Éditeur PromQL",
     "conditionOf": "de",
     "matchingTypeFound": "{type} correspondant trouvé",
     "matchingMetricsFound": "mesures correspondantes trouvées",
@@ -10192,7 +10517,7 @@
     "runQuery": "Exécuter une requête",
     "runQueryForOutput": "Cliquez sur Exécuter la requête pour voir le résultat",
     "applyVRLForOutput": "Cliquez sur Appliquer VRL pour voir la sortie combinée",
-    "save": "Sauver",
+    "save": "Enregistrer",
     "actions": "Des actions",
     "cancel": "Annuler",
     "delete": "Supprimer",
@@ -10281,15 +10606,6 @@
     "all": "Tous",
     "history": "Historique des alertes",
     "searcHistory": "Entrez le nom de l'alerte",
-    "deduplication": {
-      "fingerprintFields": "Champs d'empreintes digitales",
-      "fingerprintFieldsHint": "Sélectionnez les champs à utiliser pour la déduplication. Laissez ce champ vide pour la détection automatique en fonction du type de requête.",
-      "fingerprintFieldsTooltip": "Choisissez les champs qui doivent correspondre pour que des alertes soient considérées comme des doublons. Par exemple, sélectionner 'hostname' regroupe les alertes provenant du même hôte. Des types d'alertes différents (par exemple, CPU élevé et mémoire élevée) ne sont jamais regroupés, même s'ils proviennent du même hôte. Laissez vide pour une détection automatique selon votre type de requête.",
-      "timeWindow": "Fenêtre horaire (minutes)",
-      "timeWindowHint": "Combien de temps faut-il pour suivre les empreintes digitales des alertes ? Laissez ce champ vide pour utiliser la période d'alerte.",
-      "timeWindowTooltip": "Durée nécessaire pour suivre et dédupliquer les empreintes digitales des alertes. Si une alerte avec la même empreinte digitale apparaît dans cette fenêtre, elle sera supprimée. Laissez ce champ vide pour utiliser la période d'évaluation des alertes.",
-      "fingerprintFieldsHelp": "Laissez vide pour une détection automatique basée sur la requête (SQL : colonnes GROUP BY, PromQL : étiquettes, Personnalisé : champs de condition)"
-    },
     "summary": {
       "scrollToBottom": "Faire défiler vers le bas",
       "title": "Résumé",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "M'avertir lorsque les conditions configurées sont remplies"
       }
     },
-    "correlation": {
-      "title": "Corrélation des alertes",
-      "description": "Configurez la manière dont les alertes sont corrélées et dédupliquées au sein de l'organisation. Les alertes dont les valeurs d'empreintes digitales correspondent seront regroupées.",
-      "semanticFieldNote": "Remarque : Les mappages de champs sémantiques sont configurés dans l'onglet Service Identity.",
-      "enableOrgLevel": "Activez la déduplication au niveau de l'organisation",
-      "enableOrgLevelTooltip": "Activez les fonctionnalités de déduplication et de corrélation pour toutes les alertes de cette organisation",
-      "enableCrossAlert": "Activer la déduplication des alertes croisées",
-      "enableCrossAlertTooltip": "Autoriser différentes alertes à se dédupliquer lorsqu'elles partagent la même empreinte digitale",
-      "fingerprintGroups": "Groupes d'empreintes digitales Cross-Alert",
-      "fingerprintGroupsTooltip": "Sélectionnez les groupes sémantiques à utiliser pour la prise d'empreintes digitales par alerte croisée. Les alertes seront dédupliquées si elles partagent les mêmes valeurs pour ces dimensions.",
-      "fingerprintGroupsHint": "Sélectionnez au moins un groupe sémantique pour la déduplication des alertes croisées",
-      "fingerprintGroupsRequired": "Au moins un groupe sémantique doit être sélectionné",
-      "defaultWindow": "Fenêtre de corrélation par défaut (minutes)",
-      "defaultWindowTooltip": "En l'absence de correspondance sémantique, les alertes et les données d'une durée donnée sont considérées comme liées",
-      "defaultWindowDescription": "En l'absence de correspondance sémantique, les alertes et les données d'une durée donnée sont considérées comme liées",
-      "defaultWindowPlaceholder": "Utiliser la période d'alerte par défaut",
-      "cancelButton": "Annuler",
-      "saveButton": "Enregistrer les paramètres",
-      "settingsSaved": "Paramètres de déduplication de l'organisation enregistrés avec succès",
-      "settingsSaveError": "Échec de l'enregistrement des paramètres"
-    },
     "placeholders": {
       "typeSomething": "Tapez quelque chose",
       "value": "Valeur",
       "selectColumn": "Sélectionnez une colonne",
       "savedFunctions": "Fonctions enregistrées",
-      "autoUsesCheckInterval": "Auto (utilise l'intervalle de vérification)",
       "addTag": "Ajoutez un tag et appuyez sur Entrée"
     },
     "steps": {
       "compareWithPast": "Comparer avec Past",
-      "deduplication": "Déduplication",
       "advanced": "Avancé"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Qu'est-ce qui doit déclencher l'alerte",
       "compareWithPast": "Comparez les résultats actuels avec les données d'une autre période",
       "alertSettings": "Définissez vos règles d'alerte et choisissez la manière dont vous souhaitez être averti.",
-      "deduplication": "Évitez d'envoyer plusieurs fois la même alerte en regroupant les alertes similaires.",
       "advanced": "Variables de contexte, description et modèle de ligne"
     },
     "failedToFetchHistory": "Impossible de récupérer l'historique des alertes",
@@ -10399,8 +10691,6 @@
         "closeActions": "Fermer les actions",
         "viewAlertHistory": "Voir l'historique des alertes",
         "actionsFor": "Actions pour :",
-        "configureDedup": "Configurer Dedup",
-        "configureDedupTooltip": "Configurer la déduplication pour cette alerte",
         "editAlert": "Modifier l'alerte",
         "editAlertTooltip": "Modifier la configuration des alertes",
         "viewHistory": "Afficher l'historique",
@@ -11013,7 +11303,7 @@
       "sql": "SQL",
       "rowsSeparator": "lignes ·",
       "sqlQuery": "Requête SQL",
-      "promqlQuery": "Requête ProMQL",
+      "promqlQuery": "Requête PromQL",
       "conditions": "Conditions",
       "copy": "Copier",
       "noCondition": "Aucune condition",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "nouveau message « Résolu »",
       "keepFiringFor": "Maintenir le déclenchement pendant",
       "keepFiringForTooltip": "Attendez cette durée après la disparition de la condition avant de rétablir. 0 rétablit immédiatement.",
+      "suppressRepeats": "Suppression des répétitions",
+      "suppressRepeatsTooltip": "Notifier une seule fois lorsque l'alerte commence à se déclencher ou change de niveau, et non à chaque évaluation. Laissez cette option désactivée pour continuer à recevoir des rappels après chaque période de silence.",
       "keepFiringForInvalid": "Saisissez 0 seconde ou plus",
       "keepFiringForTooLong": "Saisissez au maximum 86400 secondes (24 heures)"
     },
@@ -13106,7 +13398,7 @@
           "alerts": "Alertes ({count})",
           "slos": "SLO ({count})",
           "pipelines": "Pipelines planifiés ({count})",
-          "empty": "Aucun tableau de bord, aucune alerte, aucun SLO ni aucun pipeline planifié que vous pouvez voir n'utilise cette métrique.",
+          "empty": "Aucun tableau de bord, aucune alerte, aucun SLO ni aucun pipeline planifié que vous pouvez voir n'utilise cette métrique",
           "error": "Impossible de déterminer où cette métrique est utilisée",
           "unparsed": "{count} requête n'a pas pu être analysée et a été mise en correspondance par nom | {count} requêtes n'ont pas pu être analysées et ont été mises en correspondance par nom",
           "textMatch": "Correspondance par nom",
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Cette adresse e-mail a déjà été ajoutée",
     "confirmRemoveEmail": "Voulez-vous vraiment supprimer l’adresse e-mail {email} ?",
     "domainNeedsEmails": "Le domaine « {domain} » doit avoir au moins une adresse e-mail lorsque tous les utilisateurs ne sont pas autorisés",
+    "noAllowedEmailsDenyAll": "Aucun email n'est encore autorisé, donc tous les utilisateurs de {domain} sont refusés.",
     "domainSettingsSaved": "Les paramètres du domaine ont été enregistrés avec succès",
     "errorSavingDomainSettings": "Erreur lors de l'enregistrement des paramètres du domaine",
     "noDomainMessage": "Aucun domaine n'a été configuré. Ajoutez des domaines ci-dessus pour restreindre l'accès.",
@@ -13594,8 +13887,8 @@
     "scrapeIntervalPositive": "L'intervalle de raclage doit être un nombre positif",
     "scrapeIntervalDescription": "L'intervalle de scrape est la fréquence, en secondes, à laquelle le système de surveillance collecte les métriques.",
     "maxSeriesPerQueryLabel": "Nombre maximum de séries par requête",
-    "maxSeriesPerQueryDescription": "Nombre maximum de séries pouvant être renvoyées à partir d'une seule requête ProMQL. Aide à prévenir le gel de l'interface utilisateur en cas de grands ensembles de résultats. Laissez ce champ vide pour utiliser la valeur par défaut du système (40 000).",
-    "maxSeriesPerQueryTooltip": "Lorsqu'une requête ProMQL telle que « count (metric) by (label) » renvoie trop de séries, elle peut geler l'interface utilisateur. Cette limite empêche cela. Définissez la valeur par défaut du système sur null ou spécifiez une valeur comprise entre 1 000 et 1 000 000.",
+    "maxSeriesPerQueryDescription": "Nombre maximum de séries pouvant être renvoyées à partir d'une seule requête PromQL. Aide à prévenir le gel de l'interface utilisateur en cas de grands ensembles de résultats. Laissez ce champ vide pour utiliser la valeur par défaut du système (40 000).",
+    "maxSeriesPerQueryTooltip": "Lorsqu'une requête PromQL telle que « count (metric) by (label) » renvoie trop de séries, elle peut geler l'interface utilisateur. Cette limite empêche cela. Définissez la valeur par défaut du système sur null ou spécifiez une valeur comprise entre 1 000 et 1 000 000.",
     "maxSeriesPerQueryValidation": "La valeur doit être comprise entre 1 000 et 1 000 000, ou laisser vide par défaut",
     "systemDefault": "défaut du système",
     "manageTheme": "Gérer le thème",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Configurez au moins un ensemble d'identités avant d'enregistrer.",
       "discoveredServicesTab": "Services découverts",
       "serviceDiscoveryTab": "Règles de détection",
-      "alertCorrelationTab": "Corrélation des alertes",
       "fieldAliasesTab": "Mappages de champs",
       "fieldAliasesSaved": "Alias de champs enregistrés avec succès",
       "fieldAliasesSaveError": "Échec de l'enregistrement des alias de champs",
@@ -14079,27 +14371,144 @@
     "runsIn": "S'exécute dans",
     "recommendedByFieldCoverage": "Recommandé en fonction de la couverture des champs dans vos flux.",
     "listConjunctionAndTwo": "{first} et {last}",
-    "domainOrgMappings": {
-      "title": "Domaines vers les organisations",
-      "subtitle": "Les nouveaux utilisateurs se connectant avec un domaine de messagerie correspondant sont ajoutés automatiquement à l'organisation.",
-      "addMapping": "Ajouter une correspondance",
-      "editMapping": "Modifier la correspondance",
-      "empty": "Aucune correspondance pour l'instant. Utilisez « {addLabel} » pour en ajouter une.",
-      "domain": "Domaine de messagerie",
-      "domainHelp": "La partie après {at_sign} dans l'adresse e-mail de l'utilisateur.",
+    "orgDomainMapping": {
+      "tabLabel": "Gestion des domaines",
+      "tabDesc": "Liez vos domaines email, associez leurs utilisateurs aux organisations et contrôlez lesquels peuvent rejoindre.",
+      "loadFailed": "Échec du chargement des réglages de l'organisation",
+      "addMapping": "Ajouter un mappage",
+      "editMapping": "Modifier le mappage",
+      "domain": "Domaine email",
+      "domainHelp": "La partie après {at_sign} dans l'adresse email de l'utilisateur. Le domaine est lié à cette organisation et doit être vérifié via DNS.",
+      "domainHelpRequest": "La partie après {at_sign} dans l'adresse e-mail de l'utilisateur. Le domaine est lié à cette organisation dès qu'OpenObserve approuve la demande.",
       "organization": "Organisation",
-      "organizationPlaceholder": "Identifiant de l'organisation",
-      "organizationHelp": "L'identifiant de l'organisation à laquelle les utilisateurs correspondants sont ajoutés.",
+      "organizationHelp": "Cette organisation ou l'un des membres de son groupe de facturation.",
       "organizationRequired": "L'organisation est requise",
       "baseRole": "Rôle de base",
-      "baseRoleHelp": "Le rôle attribué aux utilisateurs correspondants dans cette organisation.",
-      "roleClaimName": "Claim de rôles",
+      "baseRoleHelp": "Le rôle attribué lorsqu'un utilisateur est ajouté à cette organisation. Les membres existants conservent leur rôle actuel.",
+      "roleClaimName": "Claim de rôle",
       "roleClaimNamePlaceholder": "Nom du claim, par ex. groups",
-      "roleClaimNameHelp": "Facultatif. Claim du jeton listant les rôles personnalisés de l'utilisateur ; à chaque connexion, ses rôles personnalisés dans cette organisation y sont synchronisés.",
-      "createMissingRoles": "Créer les rôles du claim qui n'existent pas dans l'organisation",
-      "duplicateDomain": "Une correspondance pour ce domaine existe déjà",
-      "confirmRemove": "Voulez-vous vraiment supprimer le mappage pour {name} ?",
-      "deleteTitle": "Supprimer la correspondance"
+      "roleClaimNameHelp": "Facultatif. Claim du jeton SSO listant les rôles personnalisés de l'utilisateur. À chaque connexion SSO, ses rôles personnalisés dans cette organisation sont remplacés par ceux revendiqués ; les rôles revendiqués qui n'existent pas sont ignorés, sauf s'ils sont créés.",
+      "createMissingRoles": "Créer les rôles revendiqués qui n'existent pas dans l'organisation",
+      "verifyNow": "Vérifier maintenant",
+      "details": "Détails",
+      "detailsDialogTitle": "Détails de la liaison pour {domain}",
+      "approvedLinkInfo": "Lié par OpenObserve après une demande de liaison. Aucun enregistrement DNS n'est nécessaire.",
+      "pendingRequestInfo": "OpenObserve examine cette demande. Aucune action n'est requise tant qu'elle n'est pas approuvée.",
+      "rejectedRequestInfo": "OpenObserve a rejeté cette demande.",
+      "verifyDialogTitle": "Vérifier {domain}",
+      "recordDialogTitle": "Enregistrement DNS pour {domain}",
+      "lastCheckFailed": "Échec de la dernière vérification : {reason}",
+      "state": {
+        "pending": "En attente",
+        "verified": "Vérifié",
+        "failed": "Échec",
+        "requested": "En attente d'approbation",
+        "approved": "Approuvé",
+        "rejected": "Rejeté"
+      },
+      "saved": "Mappage de domaine enregistré",
+      "saveFailed": "Échec de l'enregistrement des réglages",
+      "linkFailed": "Échec de la liaison du domaine",
+      "unlinkFailed": "Échec de la dissociation du domaine",
+      "verifyFailed": "Échec de la vérification",
+      "deleted": "Mappage supprimé",
+      "deleteTitle": "Supprimer le mappage ?",
+      "deleteMappingBody": "Les utilisateurs de {domain} ne seront plus ajoutés à {org} lors de leur connexion.",
+      "recordInstructions": "Ajoutez cet enregistrement DNS TXT chez votre fournisseur DNS :",
+      "txtNameLabel": "Nom de l'enregistrement",
+      "txtValueLabel": "Valeur de l'enregistrement",
+      "copyTxtName": "Copier le nom de l'enregistrement",
+      "copyTxtValue": "Copier la valeur de l'enregistrement",
+      "txtNameCopied": "Nom de l'enregistrement copié",
+      "txtValueCopied": "Valeur de l'enregistrement copiée",
+      "verifyHint": "La vérification s'exécute automatiquement toutes les {minutes} minutes. Vous pouvez aussi vérifier maintenant.",
+      "alreadyLinked": "Ce domaine est déjà lié à cette organisation",
+      "failureReason": {
+        "recordMissing": "Enregistrement TXT introuvable",
+        "valueMismatch": "Enregistrement TXT trouvé, mais la valeur ne correspond pas",
+        "dnsFailed": "Échec de la résolution DNS"
+      },
+      "pageSubtitle": "Liez vos domaines e-mail, associez leurs utilisateurs aux organisations et contrôlez lesquels peuvent les rejoindre.",
+      "linkedTab": "Domaines liés",
+      "mappingsTab": "Mappages",
+      "accessTab": "Utilisateurs bloqués",
+      "requestsTab": "Demandes de liaison",
+      "linkDomain": "Lier un domaine",
+      "sendRequest": "Envoyer la demande",
+      "linkMethod": "Comment prouver la propriété",
+      "method": {
+        "dns": "Enregistrement DNS",
+        "approved": "Demande approuvée",
+        "request": "Demande de liaison",
+        "dnsTitle": "Ajouter un enregistrement DNS TXT",
+        "dnsDesc": "Vérifié automatiquement une fois l'enregistrement publié. Idéal si vous gérez le DNS du domaine.",
+        "requestTitle": "Demander une liaison à OpenObserve",
+        "requestDesc": "Notre équipe examine la demande et lie le domaine une fois approuvée."
+      },
+      "searchDomains": "Rechercher des domaines",
+      "searchMappings": "Rechercher par domaine ou organisation",
+      "searchRequests": "Rechercher par domaine, organisation ou demandeur",
+      "status": "Statut",
+      "linkedVia": "Lié via",
+      "lastChecked": "Dernière vérification",
+      "linked": "Domaine lié. Ajoutez l'enregistrement DNS pour le vérifier.",
+      "verified": "Domaine vérifié",
+      "notVerifiedYet": "L'enregistrement DNS n'a pas encore été trouvé. La propagation peut prendre un certain temps.",
+      "requestSent": "Demande de liaison envoyée",
+      "requestFailed": "Échec de l'envoi de la demande de liaison",
+      "keepRecordHint": "Conservez cet enregistrement en place. La propriété est revérifiée toutes les {minutes} minutes ; si l'enregistrement est absent pendant plus de {grace} minutes, le domaine est marqué comme en échec et ses mappages cessent de s'appliquer.",
+      "removeDomain": "Supprimer le domaine",
+      "removeTitle": "Supprimer le domaine ?",
+      "removeBody": "{domain} ne sera plus lié à cette organisation.",
+      "removeWithMappingsBody": "{domain} ne sera plus lié à cette organisation, et son mappage {count} sera supprimé. | {domain} ne sera plus lié à cette organisation, et ses {count} mappages seront supprimés.",
+      "removed": "Domaine supprimé",
+      "domainRequired": "Le domaine est requis",
+      "mappingDomainHelp": "Seuls les domaines vérifiés peuvent être mappés.",
+      "createsRoles": "Crée des rôles",
+      "duplicateMapping": "Ce domaine est déjà mappé à cette organisation",
+      "domainNotVerified": "Non vérifié",
+      "noVerifiedDomains": "Les mappages s'appliquent aux domaines vérifiés. Liez et vérifiez d'abord un domaine.",
+      "goToLinked": "Lier un domaine",
+      "goToLinkedDesc": "Vérifiez un domaine que vous possédez avant de mapper ses utilisateurs",
+      "enforceTitle": "Retirer les utilisateurs des autres organisations",
+      "enforceDesc": "Lorsqu'un utilisateur d'un domaine mappé se connecte via SSO, il est retiré de toutes les organisations en dehors de celle-ci et de son groupe de facturation.",
+      "enforceConfirmTitle": "Retirer les utilisateurs des autres organisations ?",
+      "enforceConfirmBody": "Chaque fois qu'un utilisateur dont le domaine e-mail a un mappage ici se connecte via SSO, il sera retiré de toutes les organisations qui ne sont pas celle-ci ou dans son groupe de facturation, y compris ses organisations personnelles.",
+      "enforceConfirmAction": "Activer",
+      "enforceSaved": "Paramètre enregistré",
+      "blockUsers": "Bloquer les utilisateurs",
+      "editBlockedUsers": "Modifier les utilisateurs bloqués",
+      "block": "Bloquer",
+      "blockedCount": "{count} bloqué | {count} bloqués",
+      "blockedEmails": "E-mails bloqués",
+      "blocklistDomainHelp": "L'un des domaines vérifiés de cette organisation.",
+      "blocklistEmailsHelp": "Ces utilisateurs ne peuvent pas rejoindre cette organisation ni les membres de son groupe de facturation via SSO, et en sont retirés lors de leur prochaine connexion.",
+      "ruleBlockedRequired": "Ajoutez au moins un e-mail à bloquer",
+      "noDomainForBlocklist": "Chaque domaine vérifié a déjà des utilisateurs bloqués. Modifiez sa ligne pour les changer.",
+      "unblockAll": "Débloquer tout",
+      "unblockAllTitle": "Débloquer tous les utilisateurs ?",
+      "unblockAllBody": "Chaque utilisateur bloqué de {domain} pourra à nouveau rejoindre lors de sa prochaine connexion SSO.",
+      "blocklistSaved": "Utilisateurs bloqués enregistrés",
+      "blocklistDeleted": "Utilisateurs débloqués",
+      "blocklistSection": "Utilisateurs bloqués par domaine",
+      "filterPending": "En attente",
+      "filterAll": "Tous",
+      "requestedBy": "Demandé par",
+      "requestedAt": "Demandé le",
+      "verifiedAt": "Vérifié",
+      "answeredBy": "Répondu par",
+      "reason": "Motif",
+      "reasonHelp": "Affiché à l'organisation qui a émis la demande.",
+      "reasonRequired": "Un motif est requis pour rejeter une demande",
+      "approve": "Approuver",
+      "reject": "Rejeter",
+      "approveTitle": "Approuver la demande de liaison ?",
+      "rejectTitle": "Rejeter la demande de liaison ?",
+      "approveBody": "{domain} sera lié à {org} sans vérification DNS.",
+      "rejectBody": "{org} ne recevra pas {domain}.",
+      "requestApproved": "{domain} lié",
+      "requestRejected": "Demande pour {domain} rejetée",
+      "decisionFailed": "Échec de la mise à jour de la demande"
     }
   },
   "reports": {
@@ -14499,7 +14908,7 @@
     "backToLogs": "Retour aux Logs",
     "openInTraces": "Ouvrir dans Traces",
     "loadingStream": "Chargement du flux...",
-    "noLogsAvailableForService": "Aucun log disponible pour ce service",
+    "noLogsAvailableForService": "Aucun journal disponible pour ce service",
     "noCorrelatedLogsFound": "Aucun log corrélé trouvé pour ce span",
     "spanHasNoLogsShowingTrace": "Ce span n'a aucun log. Affichage des logs pour toute la trace.",
     "noData": {
@@ -14637,7 +15046,7 @@
       "viewPretty": "Joli",
       "rail": {
         "slowestTurns": "Virages les plus lents",
-        "costHotspots": "Points chauds de coût",
+        "costHotspots": "Principaux postes de coût",
         "toolHotspots": "Hotspots d'outils",
         "call": "{n} appel | {n} appels",
         "usedIn": "Utilisé dans",
@@ -15279,7 +15688,7 @@
     "closewaitLabel": "Fermer Attendre",
     "waittimeLabel": "Temps d'attente",
     "applyFilter": "Appliquer des filtres",
-    "searchCluster": "Cluster de recherche",
+    "searchCluster": "Rechercher un cluster",
     "searchRegion": "Rechercher une région"
   },
   "regex_patterns": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Veuillez sélectionner une option de détection"
   },
   "search_history": {
-    "title": "Historique des recherches",
+    "title": "Historique d'utilisation et de coûts",
     "get_history": "Obtenir l'historique",
     "executed_at": "Exécuté à",
     "sql_query": "Requête SQL",
-    "delayMessage": "L'historique des recherches peut être retardé par"
+    "delayMessage": "L'historique d'utilisation et de coûts peut être retardé de"
   },
   "correlation": {
     "unstableDimensionNote": "Dimension instable - change au redémarrage du pod. Par défaut : toutes les valeurs.",
@@ -15406,7 +15815,7 @@
       "allValues": "Toutes les valeurs",
       "loading": "Chargement de journaux corrélés...",
       "errorDetails": "Une erreur s'est produite lors de la récupération des données de log. Veuillez réessayer.",
-      "noData": "Aucun log trouvé",
+      "noData": "Aucun journal trouvé",
       "noDataDetails": "Aucun journal correspondant aux filtres de corrélation n'a été trouvé.",
       "unstableDimension": "Dimension instable : peut changer au redémarrage du pod",
       "resultsCount": "{count} journaux trouvés dans {stream} ({time} ms)",
@@ -15416,7 +15825,7 @@
       }
     },
     "loadingLogs": "Chargement des journaux...",
-    "noLogsFound": "Aucun log trouvé",
+    "noLogsFound": "Aucun journal trouvé",
     "noDataFound": "Aucune donnée trouvée",
     "noLogsDescription": "Aucun journal n'a été trouvé pour cette corrélation dans la plage de temps sélectionnée.",
     "correlatedTracesFor": "Traces corrélées pour le service : {service}",
@@ -15602,7 +16011,7 @@
     "currencySymbol": "$",
     "header": "Tarification du modèle LLM",
     "matchingPriorityTooltip": "Priorité de correspondance des modèles : Votre organisation > Global > Intégré",
-    "searchPlaceholder": "Modèles de recherche...",
+    "searchPlaceholder": "Rechercher des modèles...",
     "syncBuiltInPrices": "Synchroniser les prix intégrés",
     "importBtn": "Importer",
     "newModel": "Nouveau modèle",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Les données sont récentes",
     "dataGettingStale": "Les données deviennent obsolètes",
     "dataStale": "Les données sont périmées",
-    "lastRefreshed": "Dernière actualisation : {time}"
+    "lastRefreshed": "Dernière actualisation : {time}",
+    "refresh": "Actualiser",
+    "refreshWithAge": "Actualiser, dernière actualisation : {age}"
   },
   "synthetics": {
     "variables": {
@@ -19086,7 +19497,7 @@
       "buildManually": "Construire manuellement",
       "continue": "Continuer",
       "gateDescription": "Dites-nous par où commencer -- vous enregistrerez le parcours ensuite. Tout le reste (planification, alertes, RUM) sera configuré après.",
-      "gateFooter": "C'est tout ce dont nous avons besoin pour commencer. Après l'enregistrement, vous pouvez le rejouer ici, puis sauvegarder pour configurer la planification, les alertes et plus encore.",
+      "gateFooter": "C'est tout ce dont nous avons besoin pour commencer. Après l'enregistrement, vous pouvez le rejouer ici, puis enregistrer pour configurer la planification, les alertes et plus encore.",
       "loadFailed": "Échec du chargement de la configuration de la vérification.",
       "loadFailedTitle": "Échec du chargement",
       "loading": "Chargement de la vérification…",
@@ -19153,6 +19564,7 @@
       "probeError": "Erreur de sonde"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "clic",
       "actionType": "saisie",
       "all": "Tous",
@@ -19830,7 +20242,7 @@
       "colStep": "Étape",
       "colDuration": "Durée",
       "filterAll": "All",
-      "firstPartyOnly": "Ressources propriétaires uniquement",
+      "firstPartyOnly": "Ressources du domaine uniquement",
       "noEventsInStep": "Aucun événement dans la fenêtre de cette étape.",
       "noEvents": "Aucun événement de console, de réseau ou de page n'a été capturé.",
       "unattributed": "Non attribué à une étape",
@@ -19868,6 +20280,13 @@
       "attemptN": "Attempt {n}",
       "detailAction": "Action",
       "detailSelector": "Sélecteur",
+      "detailStepId": "ID de l'étape",
+      "detailTargetUrl": "URL cible",
+      "detailStatus": "Statut",
+      "detailSkipReason": "Raison de l'omission",
+      "stepStatusSkipped": "Ignoré",
+      "stepStatusUnknown": "Inconnu",
+      "skippedCount": "{n} ignorés",
       "downloadTrace": "Télécharger {filename}",
       "errorFullscreenTitle": "Étape {id} : {action} - Erreur",
       "failedAtStartLoad": "Échec de l'ouverture de l'URL de départ",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Maximum {max}. Les nouvelles tentatives s'exécutent dans le même travail, donc toute la séquence doit tenir dans le budget de vérification.",
       "retriesMaxBrowserHint": "Maximum {max} pour les vérifications de navigateur. Chaque tentative relance le parcours sur chaque appareil, donc un nombre plus élevé dépasserait le délai de la sonde et signalerait une défaillance que votre site n'a jamais connue.",
       "retryDelay": "Attendre",
-      "retryDelaySuffix": "ms entre deux tentatives.",
+      "retryDelaySuffix": "secondes entre les tentatives.",
       "schedule": "Programmation",
       "scheduleLater": "Planifier plus tard",
       "scheduleLaterTooltip": "Choisissez une date et une heure futures pour activer le chèque.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Redémarrer la configuration — copiez la commande d'installation de cet agent pour relancer l'installation / le redémarrage Docker (par exemple après une rotation de jeton).",
         "noAgents": "Aucun agent ne s'est encore enregistré pour cet emplacement.",
         "agentsUnavailable": "Les agents de cet emplacement sont enregistrés auprès d'un autre cluster et ne sont pas visibles ici.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Vérifications en cours depuis cet emplacement",
         "checkName": "Nom",
         "noChecks": "Aucune vérification n'est encore assignée à cet emplacement.",
@@ -20482,7 +20903,7 @@
     "escKey": "Échap",
     "title": "Raccourcis clavier",
     "subtitle": "Presse ? n'importe où · cliquez sur n'importe quelle ligne pour déclencher",
-    "search": "Raccourcis de recherche...",
+    "search": "Rechercher des raccourcis...",
     "noResults": "Aucun raccourci n'a été trouvé",
     "footerClose": "proche",
     "footerReopen": "rouvrir",
@@ -20500,7 +20921,7 @@
       "reports": "Rapports",
       "iam": "GIA",
       "settings": "Réglages",
-      "onlineEvals": "Evaluations en ligne",
+      "onlineEvals": "Évaluations en ligne",
       "actions": "Actions",
       "rum": "RHUM",
       "runningQueries": "Exécution de requêtes",
@@ -20546,13 +20967,13 @@
       "nodes": "Nœuds",
       "modelPricing": "Tarification des modèles",
       "searchSchedulers": "Planificateurs de recherche",
-      "searchHistory": "Historique des recherches",
+      "searchHistory": "Historique d'utilisation et de coûts",
       "sessions": "Séances",
-      "evalTemplates": "Evaluations en ligne — Modèles",
+      "evalTemplates": "Évaluations en ligne — Modèles",
       "scorers": "Évaluations en ligne — Évaluateurs",
-      "evalJobs": "Evals en ligne — Offres d'emploi",
-      "quality": "Evals en ligne — Qualité",
-      "scoreConfigs": "Evaluations en ligne — Configurations des scores",
+      "evalJobs": "Évaluations en ligne — Tâches d'évaluation",
+      "quality": "Évaluations en ligne — Qualité",
+      "scoreConfigs": "Évaluations en ligne — Configurations des scores",
       "actions": "Actions",
       "llmProviders": "Fournisseurs de LLM",
       "aiToolsets": "Ensembles d'outils d'IA",
@@ -20603,7 +21024,7 @@
       "panelDuplicate": "Dupliquer le panneau",
       "panelDelete": "Supprimer le panneau",
       "panelEditorQueryInspector": "Ouvrez l'inspecteur de requêtes",
-      "metricsRunQuery": "Exécuter une requête ProMQL",
+      "metricsRunQuery": "Exécuter une requête PromQL",
       "metricsRefresh": "Actualiser",
       "metricsAddToDashboard": "Ajouter au tableau de bord",
       "metricsCopyUrl": "Copier le lien de partage",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Actualiser la liste",
       "alertTemplatesAdd": "Ajouter un nouveau modèle",
       "alertTemplatesRefresh": "Actualiser la liste",
-      "logsSearchHistory": "Ouvrir l'historique des recherches",
+      "logsSearchHistory": "Ouvrir l'historique d'utilisation et de coûts",
       "alertsImport": "Importer une alerte",
       "panelEditorRun": "Exécuter/appliquer une requête",
       "panelEditorSave": "Enregistrer et continuer la modification",
@@ -21131,6 +21552,7 @@
         "system": "système"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Actif",
         "passed": "Réussi",
         "healthy": "Sain",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Échec de la navigation vers l'alerte",
       "alertNotFound": "Alerte introuvable",
-      "alertNotFoundInAlerts": "Alerte \"{name}\" introuvable parmi {count} alertes",
       "failedToLoadAlerts": "Échec du chargement des alertes",
       "alertsDeletedSuccessfully": "{count} alerte supprimée avec succès | {count} alertes supprimées avec succès",
       "failedToDeleteAlerts": "Échec de la suppression de {count} alerte | Échec de la suppression de {count} alertes",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Veuillez patienter pendant le chargement des modèles...",
       "alertSavedSuccessfully": "Alerte enregistrée avec succès.",
       "alertUpdatedSuccessfully": "Alerte mise à jour avec succès.",
-      "openingDedupConfig": "Ouverture de la configuration de déduplication pour : {name}",
       "editingAlert": "Modification de l'alerte : {name}",
       "ack": {
         "acked": "Accusé de réception pour {name}",
@@ -21627,7 +22047,7 @@
     "title": "SLOs",
     "notFound": "SLO introuvable",
     "notFoundDescription": "Ce SLO n'existe plus, ou vous n'y avez pas accès. Il a peut-être été supprimé.",
-    "subtitle": "Objectifs de niveau de service : cibles, budgets d'erreur, alertes de taux d'épuisement.",
+    "subtitle": "Objectifs de niveau de service : cibles, budgets d'erreur, alertes de taux d'épuisement",
     "new": "Nouveau SLO",
     "newTitle": "Nouveau SLO",
     "editTitle": "Modifier le SLO",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Éditeur de tarification du modèle",
     "storageSettings": "Paramètres de stockage",
     "domainManagement": "Gestion des domaines",
+    "orgDomainMapping": "Gestion des domaines",
     "slackApp": "Slack",
     "regexPatterns": "Expressions régulières",
     "syntheticsLocations": "Emplacements des tests synthétiques",
@@ -25011,7 +25432,7 @@
     "handoffHint": "Transférer la propriété à une autre équipe. Elle est alertée selon sa propre rotation et son planning.",
     "escalateVsHandoff": "L'escalade : vous restez propriétaire. Le transfert : l'autre équipe devient propriétaire.",
     "escalated": "Escaladé au sein de {team} — vous êtes toujours le propriétaire.",
-    "escalatedTo": "{who} a été contacté — vous restez le propriétaire pour {team}.",
+    "escalatedTo": "{who} a été contacté — vous restez le propriétaire pour {team}",
     "statReachedRung": "Échelon actuel",
     "statReachedRungOf": "{n} sur {total}",
     "escalatedNobody": "Escaladé au sein de {team}, mais cet échelon n'a atteint personne.",
@@ -25304,7 +25725,7 @@
     "teamSubtitleFull": "{tz} · {members} · {rules}",
     "attentionOpenPolicy": "Ouvrir l'escalade",
     "attentionOpenRouting": "Ouvrir le routage",
-    "attentionNoTransport": "Aucun transport n'est configuré — aucune notification de ce déploiement n'atteint qui que ce soit.",
+    "attentionNoTransport": "Aucun transport n'est configuré — aucune notification de ce déploiement n'atteint qui que ce soit",
     "escalationTab": "Politiques d'escalade",
     "contactReadinessTitle": "Préparation des contacts",
     "contactReadinessHint": "Une notification arriverait-elle réellement ?",
@@ -25312,7 +25733,7 @@
     "contactUnreachable": "Injoignable",
     "contactNoTransport": "Aucun transport n'est configuré sur ce déploiement, donc aucune notification ne peut être envoyée à qui que ce soit.",
     "contactNoMembers": "Cette équipe n'a pas encore de membres.",
-    "contactNoChannel": "Aucun canal ne peut acheminer de notification.",
+    "contactNoChannel": "Aucun canal ne peut acheminer de notification",
     "contactAffects": "concerne {names}",
     "contactAndMore": "{names} et {count} autres",
     "loadBalanceTitle": "Répartition de charge sur les {days} derniers jours",
@@ -25580,8 +26001,8 @@
     "section_snoozed": "En pause",
     "section_handled": "Pris en charge",
     "section_resolved": "Résolus",
-    "sectionHint_ringing": "Personne n'a accusé réception — les notifications continuent.",
-    "sectionHint_snoozed": "Notifications en pause — elles reprennent automatiquement.",
+    "sectionHint_ringing": "Personne n'a accusé réception — les notifications continuent",
+    "sectionHint_snoozed": "Notifications en pause — elles reprennent automatiquement",
     "sectionHint_handled": "Pris en charge — une personne est responsable de chacun.",
     "sectionHint_resolved": "Clôturés — conservés pour les archives.",
     "lastAlertAt": "Créé",
@@ -25612,7 +26033,7 @@
     "routingDetails": "Détails de routage",
     "whatFired": "Déclencheur",
     "alertId": "ID d'alerte",
-    "historyFirstPage": "Première notification pour ce sujet.",
+    "historyFirstPage": "Première notification pour ce sujet",
     "historyFirings": "{count} déclenchement antérieur | {count} déclenchements antérieurs",
     "responseSubtitle": "{team} · déclenché {firing} · ouvert {opened}",
     "onCallNowCount": "Équipes d'astreinte ({count})",
@@ -26099,7 +26520,7 @@
       "logged": "Enregistré"
     },
     "policy": {
-      "gateHint": "Parmi les modifications apportées aux alertes existantes, seule la déduplication s'applique d'elle-même, avec un instantané de l'état précédent et une fenêtre de révision : conservée si ses vérifications réussissent, annulée si elles échouent. Tout le reste attend une approbation en un clic.",
+      "gateHint": "Parmi les modifications apportées aux alertes existantes, seule l'activation de la suppression des répétitions s'applique automatiquement, avec un instantané de l'état précédent et une fenêtre de révision : conservée si ses contrôles réussissent, annulée s'ils échouent. Tout le reste attend une approbation en un clic.",
       "off": "Désactivé",
       "suggest": "Suggestion",
       "auto": "Auto",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Retient l'alerte jusqu'à ce que l'enquête aboutisse, pendant 2 minutes au maximum. Échoue en mode ouvert : si le triage expire ou échoue, l'alerte est envoyée quand même, indique que l'enquête est toujours en cours ou a échoué, et la cause suit dans le fil."
       },
       "classes": {
-        "EnableDeduplication": "Activer la déduplication pour une alerte qui se répète en quelques minutes.",
+        "EnableDeduplication": "Activer la suppression des répétitions pour une alerte qui notifie à chaque évaluation.",
         "CreateDetector": "Créer un détecteur d'anomalies sur les requêtes, les erreurs ou la latence d'un service.",
         "RaiseThreshold": "Relever un seuil qui se déclenche les jours où tout va bien.",
         "LengthenEvaluationWindow": "Allonger la fenêtre d'une alerte qui oscille.",
@@ -26667,10 +27088,10 @@
           "on": "alerte de connexion"
         },
         "L-302": {
-          "done": "J'ai regroupé les 3 alertes de latence checkout en une seule",
-          "why": "Elles se déclenchaient ensemble 94 % du temps, donc un seul ralentissement vous a alerté 3 fois.",
-          "from": "3 alertes",
-          "to": "1",
+          "done": "Suppression des répétitions activée pour les 3 alertes de latence de paiement",
+          "why": "Elles notifiaient à chaque évaluation tant qu'elles restaient déclenchées, si bien qu'un seul ralentissement vous a envoyé 120 notifications.",
+          "from": "À chaque évaluation",
+          "to": "Une fois par changement",
           "on": "latence checkout"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "J'ai alerté l'astreinte au sujet des paiements en échec sur checkout.",
         "recsHeld": "J'ai gardé de côté un problème mineur avec recommendations pour le résumé de vendredi.",
         "diskApproved": "Vous avez approuvé de relever l'alerte disque sur ingest-1 à {to} %.",
-        "latencyGrouped": "J'ai regroupé les trois alertes de lenteur de checkout en une seule, pour qu'un seul ralentissement ne déclenche qu'une seule alerte.",
+        "latencyGrouped": "J'ai activé la suppression des répétitions pour les trois alertes de lenteur de paiement, de sorte qu'un seul ralentissement n'envoie qu'une notification.",
         "queueFixed": "J'ai ajouté des workers à la file orders, mais la file continuait de grandir, alors je les ai retirés et j'ai alerté l'astreinte.",
         "loginPaged": "J'ai alerté l'astreinte au sujet de la lenteur de connexion.",
         "queuePermission": "Vous m'avez autorisé à ajouter moi-même des workers de file d'attente, jusqu'à 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Statut des pipelines",
       "legendToggle": "Afficher ou masquer ce statut sur la carte"
     }
+  },
+  "recentSearches": {
+    "title": "Recherches récentes",
+    "aboutKeptDays": "Uniquement vos recherches dans {org}, visibles uniquement par vous. Conservées pendant {days} jour ; les recherches favorites restent jusqu'à leur suppression. | Uniquement vos recherches dans {org}, visibles uniquement par vous. Conservées pendant {days} jours ; les recherches favorites restent jusqu'à leur suppression.",
+    "aboutKeptForever": "Uniquement vos recherches dans {org}, visibles uniquement par vous. Conservées jusqu'à leur suppression.",
+    "pageTitle": {
+      "logs": "Recherches récentes dans les logs",
+      "traces": "Recherches récentes dans les traces",
+      "metrics": "Recherches récentes dans les métriques",
+      "dbm": "Recherches récentes",
+      "profiles": "Recherches récentes"
+    },
+    "page": {
+      "logs": "Logs",
+      "traces": "Traces",
+      "metrics": "Métriques",
+      "dbm": "Base de données",
+      "profiles": "Profils"
+    },
+    "allPages": "Toutes les pages",
+    "viewAll": "Voir tout",
+    "failedCount": "{count} en échec",
+    "keyHints": "↑↓ déplacer · PgUp/PgDn faire défiler la requête · Entrée exécuter · Maj+Entrée charger uniquement · Échap fermer",
+    "loadToFix": "Charger pour corriger",
+    "emptyTitle": "Aucune recherche récente pour l'instant",
+    "loadError": "Impossible de charger les recherches récentes",
+    "retry": "Réessayer",
+    "warning": "Terminé avec un avertissement : délai dépassé ou résultats partiels",
+    "failed": "Échec",
+    "ranCount": "exécutée {count} fois",
+    "lineCount": "{count} ligne | {count} lignes",
+    "relativeWindow": "Dernières {period}",
+    "rerunNow": "Relancer maintenant",
+    "rerunOriginal": "À l'heure d'origine",
+    "loadOnly": "Charger sans exécuter",
+    "copyLink": "Copier le lien",
+    "copyQuery": "Copier la requête",
+    "star": "Ajouter aux favoris",
+    "unstar": "Retirer des favoris",
+    "linkCopied": "Lien copié",
+    "queryCopied": "Requête copiée",
+    "copyFunction": "Copier la fonction",
+    "functionCopied": "Fonction copiée",
+    "functionLabel": "Fonction (VRL)",
+    "searchPlaceholder": "Rechercher des requêtes et des flux",
+    "allStreams": "Tous les flux",
+    "statusAll": "Tous les statuts",
+    "statusOk": "Succès",
+    "statusError": "Échec",
+    "starredOnly": "Favoris uniquement",
+    "datePlaceholder": "jj/mm/aaaa",
+    "filterByDateRun": "Filtrer par date d'exécution",
+    "today": "Aujourd'hui",
+    "yesterday": "Hier",
+    "noMatch": "Aucune recherche ne correspond à ces filtres",
+    "reset": "Tout réinitialiser",
+    "resetFilters": "Réinitialiser les filtres",
+    "loadMore": "Charger plus",
+    "clear": "Effacer mon historique",
+    "confirmClear": "Effacer l'historique",
+    "clearBodyPage": "Cela supprime {count} recherche récente dans {page} de votre historique pour {org}. Les vues enregistrées ne sont pas affectées. | Cela supprime {count} recherches récentes dans {page} de votre historique pour {org}. Les vues enregistrées ne sont pas affectées.",
+    "clearBodyAll": "Cela supprime {count} recherche récente de votre historique dans {org}, sur Logs, Traces et Métriques. Les vues enregistrées ne sont pas affectées. | Cela supprime {count} recherches récentes de votre historique dans {org}, sur Logs, Traces et Métriques. Les vues enregistrées ne sont pas affectées.",
+    "includeStarred": "Supprimer aussi ma recherche favorite ({count}) | Supprimer aussi mes {count} recherches favorites",
+    "recentRow": "Recherche récente",
+    "deletedQuery": "Recherche supprimée : {query}",
+    "undo": "Annuler"
   }
 }
diff --git a/web/src/locales/languages/it-IT.json b/web/src/locales/languages/it-IT.json
index 52c05704c6..35046b23ef 100644
--- a/web/src/locales/languages/it-IT.json
+++ b/web/src/locales/languages/it-IT.json
@@ -486,7 +486,11 @@
       "monitors": "monitor",
       "modelPricing": "definizioni di prezzo del modello",
       "variables": "variabili",
-      "experiments": "esperimenti"
+      "experiments": "esperimenti",
+      "linkedDomains": "domini collegati",
+      "domainMappings": "mappature dei domini",
+      "domainRequests": "richieste di collegamento",
+      "blockedUsers": "utenti bloccati"
     },
     "demo": {
       "pageTitle": "Stati vuoti — set completo per la revisione",
@@ -572,6 +576,30 @@
       "action": "Nuova attività",
       "actionDesc": "Punta OpenObserve al tuo endpoint e testa la connessione."
     },
+    "noLinkedDomains": {
+      "title": "Nessun dominio collegato",
+      "description": "Collega un dominio email di tua proprietà per associare i suoi utenti alle tue organizzazioni e controllare chi può accedere.",
+      "dns": "Aggiungi un record DNS",
+      "dnsDesc": "Verifica la proprietà con un record TXT",
+      "request": "Richiedi un collegamento",
+      "requestDesc": "Chiedi a OpenObserve di collegare il dominio per te"
+    },
+    "noDomainMappings": {
+      "title": "Nessuna mappatura dei domini",
+      "description": "Aggiungi automaticamente a questa organizzazione, o ai membri del suo gruppo di fatturazione, gli utenti che accedono con un dominio verificato.",
+      "action": "Aggiungi mappatura",
+      "actionDesc": "Scegli un dominio, un'organizzazione e un ruolo"
+    },
+    "noBlockedUsers": {
+      "title": "Nessun utente bloccato",
+      "description": "Tutti gli utenti dei tuoi domini verificati possono accedere. Blocca utenti specifici per tenerli fuori.",
+      "action": "Blocca utenti",
+      "actionDesc": "Scegli un dominio e le email da bloccare"
+    },
+    "noDomainRequests": {
+      "title": "Nessuna richiesta di collegamento",
+      "description": "Le richieste delle organizzazioni di collegare un dominio vengono mostrate qui."
+    },
     "noDowntimes": {
       "title": "Ancora nessun downtime",
       "description": "Un downtime mantiene in esecuzione avvisi, rilevamento anomalie e controlli Synthetics e interrompe le relative notifiche per una finestra da te pianificata.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Disattiva la modalità Live",
     "autoRefreshWithValue": "Aggiornamento automatico: {value}",
     "searchHistory": "Cronologia delle ricerche",
+    "usageCostHistory": "Cronologia utilizzo e costi",
     "createScheduledSearch": "Crea ricerca pianificata",
     "listScheduledSearch": "Elenca ricerca pianificata",
     "scheduleSearchJob": "Pianifica job di ricerca",
@@ -1355,6 +1384,8 @@
     "scanSize": "Dimensione scansione",
     "deltaScanSize": "Dimensione scansione delta",
     "scannedSoFar": "Scansionati {size}",
+    "quickModeHiddenFields": "La modalità rapida è attiva. Questa riga mostra {shown} campi su {total}.",
+    "turnOffQuickMode": "Disattiva modalità rapida",
     "resultsProgressLabel": "Avanzamento ricerca",
     "histogramTitleError": "Errore durante la generazione del titolo dell'istogramma.",
     "selectLogStream": "Seleziona lo stream dei log",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Nessun dato di rete per questa vista",
     "apiEmptyDescription": "Lo stream selezionato non ha richieste di risorse o di rete in questo intervallo di tempo. Le metriche di rete compaiono quando l'app strumenta le sue chiamate HTTP.",
     "skipInactivity": "Salta l'inattività",
+    "fullScreen": "Schermo intero",
+    "exitFullScreen": "Esci da schermo intero",
     "error": "Errore",
     "errorCount": "Numero errori",
     "all": "Tutti",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Aggiungi un secondo passaggio per aggiungere questo funnel a una dashboard",
         "snapshot": "Il pannello mantiene questi passaggi, filtri e regole degli eventi denominati così come sono ora."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Panoramica prestazioni",
+      "filterService": "Servizio",
+      "filterEnv": "Ambiente",
+      "filterVersion": "Versione",
+      "filterAll": "Tutti",
+      "verdictPass": "Core Web Vitals superati",
+      "verdictFail": "Core Web Vitals richiedono attenzione",
+      "verdictAllPass": "Tutti superati",
+      "verdictNeedWork": "{count} di {total} da migliorare | {count} di {total} da migliorare",
+      "percentileLabel": "Percentile",
+      "bandGood": "Buono",
+      "bandNeeds": "Da migliorare",
+      "bandPoor": "Scarso",
+      "bandGoodPct": "{n}% buono",
+      "bandNeedsPct": "{n}% da migliorare",
+      "bandPoorPct": "{n}% scarso",
+      "bandAria": "{good}% buono, {needs}% da migliorare, {poor}% scarso",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} più veloce",
+      "deltaSlower": "{v} più lento",
+      "deltaNone": "nessuna variazione",
+      "deltaNoPrev": "dati precedenti insufficienti",
+      "kpiSessions": "Sessioni",
+      "kpiErrorFree": "Sessioni senza errori",
+      "kpiErrors": "Errori totali",
+      "kpiUnhandled": "Errori non gestiti",
+      "kpiRegion": "Indicatori chiave",
+      "sparkAria": "Andamento di {label} nell'intervallo selezionato",
+      "chartTitle": "Sessioni ed errori",
+      "chartInterval": "per intervallo",
+      "legendSessions": "Sessioni",
+      "legendErrors": "Errori",
+      "releaseMarker": "{version} visto per la prima volta {time}",
+      "chartTableToggle": "Mostra tabella dati",
+      "chartTableHide": "Nascondi tabella dati",
+      "chartTime": "Ora",
+      "pagesTitle": "Pagine da correggere per prime",
+      "pagesHint": "Ordinate per impatto: traffico ponderato per la quota di visualizzazioni con un vital oltre la soglia o con un errore. Fai clic su una pagina per le sue sessioni, su un conteggio errori per Error Tracking.",
+      "pagesColPage": "Pagina",
+      "pagesColViews": "Visualizzazioni",
+      "pagesColErrors": "Errori",
+      "pagesColImpact": "Impatto",
+      "pagesLegend": "▲ da migliorare · ■ scarso · non contrassegnato è buono. Le pagine con meno di {n} visualizzazioni sono nascoste.",
+      "pagesOpenSessions": "Apri le sessioni per {path}",
+      "pagesOpenErrors": "{count} errore, apri Error Tracking | {count} errori, apri Error Tracking",
+      "pagesImpactAria": "Impatto {n} su 100",
+      "markNeeds": "da migliorare",
+      "markPoor": "scarso",
+      "diffTitle": "Differenza maggiore",
+      "diffBody": "INP p75 è {inp}, {ratio}x rispetto agli altri segmenti. Una correlazione da approfondire, non una causa dimostrata.",
+      "diffNone": "Nessun segmento si distingue dagli altri in questo intervallo.",
+      "diffLink": "Visualizza le sessioni interessate",
+      "segmentLabel": "Segmento",
+      "segBrowser": "Browser",
+      "segDevice": "Dispositivo",
+      "segCountry": "Paese",
+      "segInp": "INP {v}",
+      "segShare": "{n}% delle visualizzazioni",
+      "segNone": "Nessun dato per questo segmento.",
+      "releaseTitle": "Confronto tra release",
+      "releaseHint": "{cur} rispetto a {prev}. L'inizio della release è la prima volta in cui una versione viene rilevata.",
+      "releaseMetric": "Metrica",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Senza errori",
+      "releaseSessions": "Sessioni",
+      "releaseLink": "Errori in {version}",
+      "frustrationTitle": "Frustrazione dell'utente",
+      "frustrationHint": "Criticità non rilevate dai vitals",
+      "rageClicks": "Rage click",
+      "deadClicks": "Dead click",
+      "stateLoading": "Caricamento di {panel}…",
+      "stateEmptyTitle": "Nessuna visualizzazione di pagina in questo intervallo",
+      "stateEmptyBody": "Amplia l'intervallo di tempo, rimuovi un filtro o verifica che l'SDK del browser stia inviando eventi di visualizzazione.",
+      "stateEmptyAction": "Configura l'SDK",
+      "stateLowTitle": "Solo {count} visualizzazione di pagina | Solo {count} visualizzazioni di pagina",
+      "stateLowBody": "I percentili non sono affidabili con meno di {min} visualizzazioni, quindi il verdetto è nascosto. I valori sono mostrati a titolo di riferimento.",
+      "stateErrorTitle": "Impossibile caricare {panel}",
+      "stateErrorBody": "La query non è riuscita o è scaduta. Gli altri pannelli non sono interessati.",
+      "retry": "Riprova",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "indicatori chiave",
+      "panelPages": "pagine",
+      "panelSegments": "segmenti",
+      "panelRelease": "confronto tra release",
+      "panelFrustration": "frustrazione dell'utente",
+      "schemaErrorTitle": "Impossibile caricare lo schema RUM",
+      "schemaErrorBody": "Non è stato possibile leggere i campi dello stream, quindi la panoramica non può decidere quali pannelli mostrare.",
+      "pagesShowAll": "Mostra tutte le {n} pagine",
+      "pagesShowFewer": "Mostra meno pagine",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Nessuna pagina con visualizzazioni sufficienti",
+      "pagesEmptyBody": "Le pagine necessitano di almeno {n} visualizzazioni in questo intervallo per essere classificate.",
+      "segEmptyTitle": "Nessun dato di segmento",
+      "segEmptyBody": "Per queste visualizzazioni non sono stati registrati valori di browser, dispositivo, sistema operativo, paese o connessione.",
+      "releaseEmptyTitle": "Sono necessarie due versioni",
+      "releaseEmptyBody": "Il confronto tra release richiede almeno due versioni rilevate in questo intervallo.",
+      "releaseBefore": "{version} era già live prima di questo intervallo, quindi l'ora della prima rilevazione non è mostrata.",
+      "pageErrorTitle": "Impossibile caricare la panoramica delle prestazioni",
+      "pageErrorBody": "Le query non sono riuscite o sono scadute. Riprova per caricare di nuovo ogni pannello.",
+      "verdictOver": "{vital} supera la soglia buona di {threshold} per il {pct}% delle visualizzazioni di pagina.",
+      "verdictAllThree": "Tutti e tre i Core Web Vitals rientrano nella soglia al p75.",
+      "verdictAllSome": "Tutti i {n} Core Web Vitals valutati rientrano nella soglia al p75.",
+      "releaseNewErrors": "{count} nuovo errore in questa release | {count} nuovi errori in questa release",
+      "verdictNoData": "Nessun dato sui Core Web Vitals",
+      "verdictNoDataLead": "Nessuna delle {count} visualizzazione di pagina in questo intervallo ha riportato LCP, INP o CLS. | Nessuna delle {count} visualizzazioni di pagina in questo intervallo ha riportato LCP, INP o CLS.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Apri le sessioni.",
+      "pagesTableLabel": "Pagine ordinate per impatto",
+      "verdictSessions": "{count} sessione nell'intervallo. | {count} sessioni nell'intervallo.",
+      "verdictCompare": "Rispetto al periodo precedente.",
+      "deltaLower": "{v} in meno",
+      "deltaHigher": "{v} in più",
+      "forbiddenTitle": "Nessuna autorizzazione per visualizzare {panel}",
+      "forbiddenBody": "Chiedi a un amministratore l'accesso allo stream di dati RUM.",
+      "pageForbiddenTitle": "Nessuna autorizzazione per visualizzare la panoramica delle prestazioni",
+      "asideLabel": "Dove e cosa è cambiato",
+      "pagesAbout": "Informazioni su questa classifica",
+      "chartPerFiveMinutes": "ogni 5 minuti",
+      "chartPerThirtyMinutes": "ogni 30 minuti",
+      "chartPerHour": "ogni ora",
+      "chartPerSixHours": "ogni 6 ore",
+      "chartPerDay": "ogni giorno",
+      "chartIntervalOther": "per bucket",
+      "chartTableCaption": "Sessioni ed errori per bucket",
+      "deltaChange": "{delta} rispetto al periodo precedente",
+      "deltaChangePts": "{delta} punti rispetto al periodo precedente",
+      "deltaFlat": "Nessuna variazione rispetto al periodo precedente",
+      "deltaNewMsg": "Nuovo rispetto al periodo precedente",
+      "verdictP75Note": "Il verdetto usa sempre p75; p50 e p95 cambiano solo i valori.",
+      "releaseNote": "Confronta le due versioni più recenti, indipendentemente da ciò che indica il filtro Versione.",
+      "kpiEmptyTitle": "Nessuna sessione in questo intervallo",
+      "kpiEmptyBody": "Amplia l'intervallo di tempo o rimuovi un filtro.",
+      "releaseImproved": "migliorato",
+      "releaseWorse": "peggiorato",
+      "segOs": "OS",
+      "segConnection": "Connessione",
+      "pagesAllLink": "Tutte le pagine",
+      "pagesAllLinkAria": "Tutte le pagine in Analisi di prodotto",
+      "frustrationReplayLink": "Guarda un replay",
+      "frustrationReplayHint": "Apre le sessioni frustrate in questo intervallo; quelle registrate hanno un replay.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "Non è stato registrato nulla in questo intervallo. Amplia l'intervallo di tempo oppure configura il browser SDK se questa app non ha ancora inviato dati.",
+      "stateEmptyFiltered": "Nessun risultato corrisponde a questi filtri in questo intervallo. Rimuovi i filtri per vedere tutti i servizi, gli ambienti e le versioni.",
+      "clearFilters": "Rimuovi filtri",
+      "stateRefreshing": "Aggiornamento di {panel}",
+      "tileOpenSessions": "{label}: {value}. Sessioni aperte",
+      "tileOpenErrors": "{label}: {value}. Apri tracciamento errori",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Questa panoramica conta solo le sessioni browser. Le metriche delle app mobile sono riportate di seguito.",
+      "mixedMobileNote": "I filtri seguenti si applicano solo alle metriche delle app mobile."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Elimina",
     "confirmDeleteHead": "Elimina utente",
     "confirmDeleteMsg": "Sei sicuro di voler eliminare l'utente {name}?",
+    "block": "Blocca",
+    "confirmBlockHead": "Blocca utente",
+    "confirmBlockMsg": "{email} ha effettuato l'accesso tramite il tuo dominio verificato. Il blocco lo aggiunge alle restrizioni di dominio di questa organizzazione e lo rimuove da questa organizzazione. Verrà rimosso dalle altre organizzazioni mappate al prossimo accesso.",
     "cancel": "Annulla",
     "save": "Salva",
     "ok": "Ok",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Revoca l'invito",
     "revokeInvitationMsg": "Sei sicuro di voler revocare l'invito per {email}?",
     "deleteUsersTitle": "Elimina utenti",
-    "deleteUsersMsg": "Sei sicuro di voler eliminare {count} utente? | Sei sicuro di voler eliminare {count} utenti?"
+    "deleteUsersMsg": "Sei sicuro di voler eliminare {count} utente? | Sei sicuro di voler eliminare {count} utenti?",
+    "deleteUsersBlockNote": "Di questi, {count} hanno effettuato l'accesso tramite il tuo dominio verificato e verranno bloccati anziché eliminati."
   },
   "invitation": {
     "pendingInvitations": "Inviti in sospeso",
@@ -3403,8 +3597,6 @@
       },
       "show": "Mostra",
       "searchPermissions": "Cerca permessi",
-      "filterModules": "Filtra moduli",
-      "noModuleMatch": "Nessun modulo corrisponde al filtro",
       "moduleScopeAll": "Tutti",
       "moduleScopeGranted": "Selezionati",
       "noGrantedModule": "Nessun modulo è ancora selezionato",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Concessione | Concessioni",
       "summaryReachSome": "{count} di {total}",
       "summaryEmptyTitle": "Questo ruolo non concede ancora nulla",
-      "summaryEmptyDescription": "Seleziona un modulo a sinistra oppure parti da un preset.",
+      "summaryEmptyDescription": "Parti da un preset oppure scegli i moduli dall'elenco.",
       "presetReadonlyTitle": "Sola lettura",
       "presetReadonlyDescription": "Elenco e lettura su ogni modulo",
       "presetDbmTitle": "Visualizzatore monitoraggio database",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "Nessuno dei {total} stream di metriche Kubernetes esiste ancora in questa organizzazione, quindi non è stato preselezionato nulla.",
       "rumPresetSeeded": "Accesso in sola lettura preselezionato su {matched} di {total} stream RUM, più le source map e qualsiasi autorizzazione RUM Product Analytics. Rivedi prima di salvare.",
       "rumPresetNoMatch": "Nessuno dei {total} stream RUM esiste ancora in questa organizzazione, quindi non è stato preselezionato nulla su di essi; le source map e qualsiasi autorizzazione RUM Product Analytics sono state comunque predisposte.",
-      "moduleGroupFleet": "Flotta"
+      "moduleGroupFleet": "Flotta",
+      "filterModulesTasks": "Filtra moduli",
+      "noModuleMatchQuery": "Nessun modulo corrisponde a «{query}»",
+      "noModuleMatchHint": "Cerca per modulo, gruppo o attività, ad esempio slack, panel o token.",
+      "presetAlertManagerTitle": "Gestore avvisi",
+      "presetAlertManagerDescription": "Crea e gestisci gli avvisi, le loro destinazioni e i loro messaggi",
+      "presetAlertViewerTitle": "Visualizzatore avvisi",
+      "presetAlertViewerDescription": "Visualizza avvisi, destinazioni e template senza modificarli",
+      "presetDashboardEditorTitle": "Editor dashboard",
+      "presetDashboardEditorDescription": "Crea e modifica dashboard, con accesso in lettura ai dati che interrogano",
+      "presetDashboardViewerTitle": "Visualizzatore dashboard",
+      "presetDashboardViewerDescription": "Apri le dashboard e leggi i dati dietro i loro pannelli",
+      "presetPipelineEditorTitle": "Editor pipeline",
+      "presetPipelineEditorDescription": "Crea pipeline e funzioni, con accesso in lettura agli stream e alle tabelle di arricchimento",
+      "presetApplied": "{title} ha aggiunto {permissions}. Verifica le modifiche prima di salvare.",
+      "presetPermissionCount": "{count} permesso | {count} permessi",
+      "companionReasonAlertStreams": "per salvare gli avvisi. Il server verifica l'accesso agli stream al salvataggio",
+      "companionReasonAlertDestinations": "per scegliere dove vengono inviati gli avvisi",
+      "companionReasonDestinationTemplates": "per scegliere il template del messaggio, richiesto da ogni destinazione",
+      "companionReasonDashboardStreams": "per caricare i dati dei pannelli",
+      "presetsTitle": "Preset",
+      "presetsClose": "Chiudi preset",
+      "presetsShow": "Mostra preset",
+      "presetsSubtitle": "Aggiungi a questo ruolo le concessioni di un preset. Non viene rimosso nulla.",
+      "presetsSectionBuiltin": "Integrati",
+      "presetsSectionJob": "Per mansione",
+      "presetAddsTooltip": "Aggiunge {count} permesso | Aggiunge {count} permessi",
+      "presetInRole": "Nel ruolo",
+      "presetInRoleTooltip": "Questo ruolo ha già tutto ciò che c'è in questo preset",
+      "presetBack": "Tutti i preset",
+      "presetModuleCount": "{count} modulo | {count} moduli",
+      "presetSummaryAdds": "Aggiunge {permissions} in {modules}.",
+      "presetSummaryWrite": "Accesso in scrittura in {modules}.",
+      "presetSummaryViewOnly": "Sola visualizzazione: non è possibile creare, modificare o eliminare nulla.",
+      "presetSummaryHasAll": "Questo ruolo ha già tutto ciò che c'è in questo preset.",
+      "presetSummarySkipped": "{count} permesso già presente in questo ruolo viene saltato. | {count} permessi già presenti in questo ruolo vengono saltati.",
+      "presetStillMissing": "Mancherà ancora dopo l'aggiunta: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "Dopo l'aggiunta non mancherà nulla.",
+      "neededBy": "Richiesto da {modules}",
+      "stillNeededBy": "Ancora richiesto da {modules}",
+      "presetReadsEveryStream": "Legge tutti gli stream di questa organizzazione, inclusi quelli nuovi.",
+      "presetAddButton": "Aggiungi {count} permesso | Aggiungi {count} permessi",
+      "presetNothingToAdd": "Niente da aggiungere",
+      "presetApplyNote": "Le concessioni aggiunte diventano modifiche non salvate. Verificale prima di salvare.",
+      "presetLoadingStreams": "Caricamento degli stream",
+      "presetNoMatchingStreams": "Ancora nessuno stream corrispondente in questa organizzazione.",
+      "reviewMissingTooltip": "Manca {count} modulo perché questo ruolo funzioni | Mancano {count} moduli perché questo ruolo funzioni",
+      "notAddedYetTitle": "Non ancora aggiunti · {modules}",
+      "companionAdd": "Aggiungi",
+      "companionAddItem": "Aggiungi {item}",
+      "companionAddAll": "Aggiungi tutto",
+      "companionOpenStreams": "Apri stream",
+      "companionOpenStreamsTooltip": "Scegli quali stream può leggere questo ruolo",
+      "companionNeeds": "{module} ne ha bisogno {reason}.",
+      "companionNeedsThis": "{module} ha bisogno di questo {reason}.",
+      "companionStillNeedsThis": "{module} ne ha ancora bisogno {reason}.",
+      "yourChanges": "Le tue modifiche",
+      "yourChangesCount": "{changes} in {modules}",
+      "yourChangesNone": "Ancora nessuna",
+      "changeCount": "{count} modifica | {count} modifiche",
+      "changeOtherGroup": "Altro",
+      "saveSuccessCounts": "Salvataggio completato: {changes} in {modules}.",
+      "effectCan": "Può {actions} {target}.",
+      "effectCannot": "Non può più {actions} {target}.",
+      "effectCanLoadDestinations": "Può caricare l'elenco delle destinazioni.",
+      "effectCannotLoadDestinations": "Non può più caricare l'elenco delle destinazioni.",
+      "effectCanLoadTemplates": "Può caricare l'elenco dei template.",
+      "effectCannotLoadTemplates": "Non può più caricare l'elenco dei template.",
+      "verbView": "visualizzare",
+      "verbSeeListOf": "vedere nell'elenco",
+      "verbList": "elencare",
+      "verbOpen": "aprire",
+      "verbCreate": "creare",
+      "verbEdit": "modificare",
+      "verbDelete": "eliminare",
+      "targetEveryStream": "tutti gli stream (log, metriche, tracce e indici), compresi quelli nuovi",
+      "targetTypeStreams": "tutti gli stream {type}",
+      "targetOneStream": "lo stream {type} {name}",
+      "targetAlertsEveryFolder": "gli avvisi in tutte le cartelle, comprese quelle nuove",
+      "targetAlertsInFolder": "gli avvisi nella cartella {name}",
+      "targetOneAlert": "l'avviso {name}",
+      "targetDashboardsEveryFolder": "le dashboard in tutte le cartelle, comprese quelle nuove",
+      "targetDashboardsInFolder": "le dashboard nella cartella {name}",
+      "targetOneDashboard": "la dashboard {name}",
+      "targetReportsEveryFolder": "i report in tutte le cartelle, comprese quelle nuove",
+      "targetReportsInFolder": "i report nella cartella {name}",
+      "targetOneReport": "il report {name}",
+      "targetEveryDestination": "tutte le destinazioni degli avvisi (Slack, email, webhook), comprese quelle nuove",
+      "targetOneDestination": "la destinazione {name}",
+      "targetEveryTemplate": "tutti i template di notifica, compresi quelli nuovi",
+      "targetOneTemplate": "il template {name}",
+      "targetAllOf": "tutti i {module}, compresi quelli nuovi",
+      "targetItemIn": "{name} in {module}",
+      "noteDestinationsFiltered": "Vedono solo le destinazioni che possono anche aprire. Aggiungi «Ottieni» qui, o su singole destinazioni, per scegliere quali.",
+      "noteTemplatesFiltered": "Vedono solo i template che possono anche aprire. Aggiungi «Ottieni» qui, o su singoli template, per scegliere quali.",
+      "presetStreamsFailed": "Impossibile caricare l'elenco degli stream.",
+      "presetRetry": "Riprova",
+      "presetRestored": "{title} ha ripristinato {permissions}. Verifica le modifiche prima di salvare.",
+      "presetSummaryRestores": "Mantiene {count} permesso che hai contrassegnato per la rimozione. | Mantiene {count} permessi che hai contrassegnato per la rimozione.",
+      "presetRestoreButton": "Mantieni {count} permesso | Mantieni {count} permessi",
+      "effectStillAllowed": "Nessuna modifica all'accesso: un permesso più ampio lo consente ancora."
     },
     "rolesPage": {
       "subtitle": "I ruoli raggruppano le autorizzazioni: assegnali a utenti, account di servizio o gruppi per concedere l'accesso.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Utente aggiornato con successo.",
       "userDeletedSuccess": "Utente eliminato con successo.",
       "errorDeletingUser": "Errore durante l'eliminazione dell'utente.",
+      "userBlockedSuccess": "Utente bloccato correttamente.",
+      "errorBlockingUser": "Errore durante il blocco dell'utente.",
+      "blockedButNotRemoved": "L'utente è stato bloccato, ma non è stato possibile rimuoverlo da questa organizzazione.",
+      "blockedUsersSuccess": "Bloccato con successo {count} utente | Bloccati con successo {count} utenti",
+      "blockedUsersPartial": "Bloccato e rimosso {count} utente, ma non è stato possibile rimuoverne {failed} da questa organizzazione | Bloccati e rimossi {count} utenti, ma non è stato possibile rimuoverne {failed} da questa organizzazione",
+      "blockedUsersNotRemoved": "Bloccato {count} utente, ma non è stato possibile rimuoverlo da questa organizzazione | Bloccati {count} utenti, ma non è stato possibile rimuoverli da questa organizzazione",
       "pleaseWait": "Attendi...",
       "invitationRevokedSuccess": "Invito revocato con successo.",
       "errorRevokingInvitation": "Errore durante la revoca dell'invito.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Le tracce vengono acquisite con eBPF: non servono modifiche al codice o SDK. Il contesto di traccia passa tra i servizi solo su HTTP in chiaro (per le app Go anche su HTTPS, tranne sui nodi con kernel lockdown). Viene tracciato un processo che corrisponde a una qualsiasi tra porte, percorso dell'eseguibile o riga di comando; i glob non possono contenere `,`, `{'{'}` o `{'}'}`, e una porta corrisponde a qualsiasi processo con un socket su di essa. Richiede Helm 3.14+ e l'operatore OpenTelemetry v0.142.0+; se il tuo è più vecchio, aggiornalo prima con `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Se eBPF era già attivo con un operatore precedente, riesegui il comando con `--force` (`--force-replace` su Helm 4). Rieseguire il comando di installazione qui sopra reimposta la release e disattiva eBPF, quindi riesegui poi questo comando. Il namespace `openobserve-collector` deve consentire pod privilegiati e i nodi devono eseguire Linux su amd64 o arm64 con kernel 5.8+ (o la famiglia RHEL 4.18 con backport eBPF) e BTF. Non selezionare app che inviano già le proprie tracce, né pod che usano il sidecar Go `inject-go`.",
       "k8sEbpfVariant": "eBPF (qualsiasi linguaggio, senza modifiche al codice)",
       "k8sLibrariesVariant": "Librerie di linguaggio (strumentazione automatica)",
+      "k8sNetworkFlowsDesc": "Il DaemonSet eBPF del collector registra i **byte inviati tra i workload su qualsiasi protocollo TCP o UDP** su ogni nodo Linux, compresi database, cache e altri servizi che non sono tracciati. Arrivano come metrica `obi_network_flow_bytes`, etichettata con il proprietario di origine e destinazione (Deployment, StatefulSet, Node, …) e il namespace. Funziona con o senza il tracing eBPF.",
+      "k8sNetworkFlowsNote": "Richiede Helm 3.14+ e OpenTelemetry operator v0.142.0+. Il namespace `openobserve-collector` deve consentire pod privilegiati e i nodi devono eseguire Linux su amd64 o arm64 con kernel 5.8+ (o famiglia RHEL 4.18 con backport eBPF) e BTF. I pod eBPF vengono eseguiti sulla rete host e le metriche del collector stesso sono in ascolto su `127.0.0.1:8888` di ogni nodo, quindi quella porta deve essere libera lì. I selettori di traccia eBPF già impostati vengono mantenuti. Rieseguire il comando di installazione sopra reimposta la release e disattiva questa opzione, quindi esegui di nuovo questo comando in seguito. Gli stessi byte possono essere segnalati più di una volta: il traffico tra nodi viene segnalato da entrambi i nodi e una connessione a un Service viene rilevata sia per il Service sia per il workload sottostante. La guida ai flussi di rete eBPF spiega come interrogarli senza doppio conteggio.",
+      "k8sNetworkFlowsTitle": "Scopri quali workload comunicano tra loro: flussi di rete eBPF",
       "k8sInstallerNote": "Questo installa automaticamente cert-manager, l'operatore OpenTelemetry e il collector OpenObserve.",
       "k8sInternalEndpointNote": "Usa questa opzione quando OpenObserve è in esecuzione nello stesso cluster — il traffico non lo lascia mai.",
       "k8sTroubleAnnotationA": "L'iniezione avviene alla creazione del pod, quindi i pod esistenti non vengono influenzati fino al riavvio — esegui `kubectl rollout restart deployment -n my-namespace`. Conferma che l'annotazione sia stata applicata con `kubectl get ns my-namespace -o yaml` e verifica che il valore corrisponda a `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "L'installazione fallisce con un errore relativo al webhook di ammissione",
       "linuxAgentFixBody": "Il programma di installazione avvia l'agente come servizio systemd. Se non arriva nulla, conferma che sia in esecuzione e leggi i suoi log per un errore di autenticazione o connettività:",
       "linuxTracesNote": "Le tracce vengono acquisite con eBPF: non servono modifiche al codice o SDK. Viene tracciato un processo che corrisponde a una qualsiasi tra porte, percorso dell'eseguibile o riga di comando; i glob non possono contenere `,`, `{'{'}` o `{'}'}`. Il tracciamento richiede Linux 5.8+ (o la famiglia RHEL 4.18 con backport eBPF) con BTF; l'agente viene quindi eseguito come root. Se l'host non può tracciare, l'installazione si arresta e lascia intatto l'agente in esecuzione. Se poi l'agente non si avvia con il tracciamento attivo, questo viene disabilitato — anche log e metriche — finché non riesegui il comando **Log e metriche**, oppure risolvi la causa e riesegui con il tracciamento. Le app tracciate aggiungono un header W3C `traceparent` alle richieste HTTP in testo normale in uscita. La guida al tracciamento eBPF di seguito copre HTTPS e i flag ripetuti.",
+      "linuxNetworkFlowsDesc": "Esegui l'installer con `--network-flows` per riportare i **byte che questo host invia e riceve su qualsiasi protocollo TCP o UDP**, come metrica `obi_network_flow_bytes`. Ogni flusso è etichettato con `src_cidr` e `dst_cidr` in base alle reti elencate, quindi assegna a ogni host lo stesso elenco: una voce `/32` per host fornisce una mappa host-to-host.",
+      "linuxNetworkFlowsNote": "Richiede Linux 5.8+ (o famiglia RHEL 4.18 con backport eBPF) con BTF; l'agente viene quindi eseguito come root. Funziona con o senza tracciamento, ma ogni esecuzione dell'installer sostituisce la configurazione dell'agente: per mantenere attivo il tracciamento, aggiungi i flag `--trace-*` e `--service-name` dal comando **Log, metriche e tracce eBPF**. Se l'host non può eseguire eBPF, l'installazione si interrompe e lascia invariato l'agente in esecuzione. Se la cattura di rete non riesce quindi ad avviarsi, l'agente viene disabilitato — anche log e metriche — finché non esegui di nuovo il comando **Log e metriche**, oppure correggi la causa e riesegui con `--network-flows`. Il traffico tra due host che eseguono entrambi l'agente viene segnalato da ciascuno di essi, e il traffico di loopback viene conteggiato a meno che entrambe le estremità abbiano lo stesso indirizzo. La guida ai flussi di rete eBPF riportata di seguito spiega le etichette e come interrogarli senza doppio conteggio.",
+      "linuxNetworkFlowsTitle": "Scopri quali host comunicano tra loro: flussi di rete eBPF",
       "linuxTracesVerifyNote": "Con il tracciamento attivo, le tracce compaiono non appena un'app tracciata gestisce una richiesta.",
+      "ebpfNetworkFlowsGuideLink": "Guida ai flussi di rete eBPF",
       "ebpfTracingGuideLink": "Guida al tracciamento eBPF",
       "logsMetricsTracesVariant": "Log, metriche e tracce eBPF",
       "logsMetricsVariant": "Log e metriche",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Punta qualsiasi exporter OpenTelemetry su OpenObserve — collector o SDK, HTTP o gRPC. Il tuo endpoint e token sono compilati qui sotto.",
       "taglineWindows": "Installa l'agente OpenObserve su qualsiasi host Windows — Log eventi, contatori delle prestazioni e metriche host.",
       "testAgain": "Verifica di nuovo",
+      "networkFlowsHelp": "Voci CIDR o CIDR=NAME, separate da virgole senza spazi; ogni CIDR richiede una lunghezza di prefisso, ad es. 10.0.1.5/32, e i nomi possono contenere solo lettere, cifre, ., _ e -. Gli indirizzi che non corrispondono a nessuna voce restano senza etichetta; 0.0.0.0/0=other assegna un nome al resto di IPv4, ::/0=other6 al resto di IPv6.",
+      "networkFlowsLabel": "Reti da etichettare",
+      "networkFlowsRequired": "Elenca almeno una rete: i flussi vengono etichettati con le reti elencate.",
       "traceCmdHelp": "Per app Python, Node.js e Java.",
       "traceCmdLabel": "Riga di comando",
       "traceExeLabel": "Percorso dell'eseguibile",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Nascondi celle sotto",
     "heatmapHideBelowTooltip": "Le celle con un valore inferiore restano vuote.",
     "heatmapHideBelowNote": "Le celle sotto {value} sono nascoste",
+    "boxplotWhisker": "Baffi",
+    "boxplotWhiskerMinMax": "Dal minimo al massimo",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Campo messaggio",
+    "logsLevelField": "Campo livello",
+    "logsTimeField": "Campo ora",
+    "htmlPanelFieldTooltip": "Lascia vuoto per rilevare la colonna dai risultati della query",
+    "logsOrder": "Ordine",
+    "logsOrderNewest": "Più recenti prima",
+    "logsOrderOldest": "Più vecchi prima",
+    "logsOrderTooltip": "Ordina le righe restituite dalla query. Anche una query iniziale non modificata viene recuperata in questo ordine, quindi «Più vecchi prima» mostra i log più vecchi.",
+    "logsShowTime": "Mostra ora",
+    "logsWrap": "A capo automatico",
+    "logsPrettifyJson": "Formatta JSON",
     "distributionBucketCount": "Numero di intervalli",
     "distributionBucketSize": "Ampiezza intervallo",
     "distributionBucketSizeTooltip": "Ampiezza di ogni intervallo nelle unità del campo. Se impostata, sostituisce il numero di intervalli.",
@@ -7822,6 +8145,8 @@
       "gauge": "Indicatore",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Box plot",
+      "logs": "Log",
       "barGauge": "Indicatore a barre",
       "distribution": "Distribuzione",
       "treemap": "Treemap",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: Argomento obbligatorio mancante alla posizione {index}",
       "fieldNotAllowedForMetric": "Il campo {label} non è consentito per il grafico metrico",
       "rawValueSampled": "Basato sulle prime {count} righe",
+      "addAtMostOneFieldFor": "Aggiungi al massimo un campo per {label}",
+      "boxplotMin": "Min",
+      "boxplotMax": "Max",
+      "boxplotLowerWhisker": "Baffo inferiore",
+      "boxplotUpperWhisker": "Baffo superiore",
+      "boxplotMedian": "Mediana",
+      "boxplotSamples": "Campioni",
+      "boxplotOutlier": "Valore anomalo",
       "fieldNotAllowedForDistribution": "Il campo {label} non è consentito per il grafico di distribuzione",
       "distributionCount": "Conteggio",
       "addAtLeastOneFieldFor": "Aggiungi almeno un campo per {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Nessun accesso",
       "urlHiddenHint": "Non puoi visualizzare la dashboard di questo link, quindi il suo URL pubblico è nascosto.",
       "orgDisabledHint": "I link pubblici sono disattivati per questa organizzazione",
+      "orgDisabledBanner": "I link pubblici sono disattivati per questa organizzazione, quindi nessun link viene servito. Un amministratore può riattivarli.",
+      "disabledPaused": "Disattivato · In pausa",
       "takeOver": "Prendi in carico",
       "takeOverTitle": "Prendere in carico questo link?",
       "takeOverBody": "Diventi tu l'autore della pubblicazione. La pagina pubblica mostrerà ciò che sei autorizzato a vedere, che può essere più o meno di prima. Chi ha l'URL mantiene l'accesso e il link torna attivo subito.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Gruppo",
     "wellSubgroup": "Sottogruppo",
     "wellSize": "Dimensione",
+    "wellCategory": "Categoria",
     "value": "Valore"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Allontana il valore di attivazione dallo stato stazionario osservato.",
       "lengthenEvaluationWindow": "Allunga la finestra di valutazione",
       "lengthenEvaluationWindowDesc": "Amplia il periodo in modo che un picco breve non attivi più l'avviso.",
-      "enableDeduplication": "Abilita la deduplicazione",
-      "enableDeduplicationDesc": "Raggruppa le attivazioni ripetute all'interno di una finestra di deduplicazione.",
+      "enableDeduplication": "Attiva soppressione ripetizioni",
+      "enableDeduplicationDesc": "Notifica una volta per cambio di stato invece che a ogni valutazione.",
       "reviewForDeletion": "Verifica per l'eliminazione",
       "reviewForDeletionDesc": "Verifica che la query corrisponda ancora alla realtà prima di dismettere l'avviso.",
       "fixAlertQuery": "Correggi la query dell'avviso",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "ID organizzazione",
     "alertCreationTitle": "Creazione avviso",
     "noAlertsFound": "Nessun avviso trovato",
-    "suppressedByDeduplication": "Soppresso dalla deduplicazione",
-    "occurrence": "{count} occorrenza | {count} occorrenze",
     "groupedNotification": "Notifica raggruppata",
     "alertsBatchedTogether": "avvisi raggruppati insieme",
-    "notificationSent": "Notifica inviata",
-    "occurrencesDeduplicated": "occorrenze deduplicate",
     "alertExecutionDetails": "Dettagli esecuzione avviso",
     "evaluationTime": "Tempo di valutazione",
     "queryTime": "Tempo di query",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "A: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Correlazione temporale",
     "serviceGraphTooltipServiceDependency": "Dipendenza del servizio",
-    "totalAlerts": "Totale avvisi",
-    "usingDeduplication": "Uso della deduplicazione",
-    "deduplicationConfiguredTooltip": "Avvisi con deduplicazione configurata",
-    "suppressionRate24h": "Tasso di soppressione (24h)",
     "suppressed": "soppressi /",
-    "total": "totale",
-    "passedLabel": "Superati:",
-    "pendingBatches": "Batch in sospeso",
-    "pendingBatchesTooltip": "Avvisi in attesa di essere raggruppati",
     "historyTimeline": {
       "firing": "Attivo",
       "ok": "Ok",
@@ -10089,7 +10413,8 @@
     "endTime": "Ora di fine",
     "duration": "Durata",
     "retries": "Tentativi",
-    "dedup": "Dedup",
+    "suppression": "Soppressione",
+    "suppressedAsRepeat": "Soppresso come ripetizione",
     "validation": {
       "streamTypeRequired": "Il tipo di Stream è obbligatorio.",
       "streamNameRequired": "Il nome dello Stream è obbligatorio.",
@@ -10281,15 +10606,6 @@
     "all": "Tutti",
     "history": "Cronologia avvisi",
     "searcHistory": "Inserisci il nome dell'avviso",
-    "deduplication": {
-      "fingerprintFields": "Raggruppa avvisi simili per",
-      "fingerprintFieldsHint": "Seleziona i campi da utilizzare per la deduplicazione. Lascia vuoto per il rilevamento automatico in base al tipo di query.",
-      "fingerprintFieldsTooltip": "Scegli quali campi devono corrispondere perché gli avvisi siano considerati duplicati. Ad esempio, selezionando 'hostname' gli avvisi provenienti dallo stesso host verranno raggruppati. Tipi di avviso diversi (ad esempio, CPU elevata e memoria elevata) non vengono mai raggruppati, anche se provengono dallo stesso host. Lascia vuoto per il rilevamento automatico in base al tipo di query.",
-      "timeWindow": "Finestra temporale (minuti)",
-      "timeWindowHint": "Per quanto tempo tenere traccia delle impronte digitali degli avvisi. Lascia vuoto per utilizzare il periodo di avviso.",
-      "timeWindowTooltip": "Durata del monitoraggio e della deduplicazione delle impronte digitali degli avvisi. Se viene visualizzato un avviso con la stessa impronta digitale all'interno di questa finestra, verrà soppresso. Lascia vuoto per utilizzare il periodo di valutazione degli avvisi.",
-      "fingerprintFieldsHelp": "Lascia vuoto per rilevamento automatico basato sulla query (SQL: colonne GROUP BY, PromQL: etichette, Personalizzato: campi condizione)"
-    },
     "summary": {
       "scrollToBottom": "Scorri verso il basso",
       "title": "Riepilogo",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Avvisami quando le condizioni configurate sono soddisfatte"
       }
     },
-    "correlation": {
-      "title": "Correlazione degli avvisi",
-      "description": "Configura il modo in cui gli avvisi sono correlati e deduplicati in tutta l'organizzazione. Gli avvisi con valori di impronte digitali corrispondenti verranno raggruppati.",
-      "semanticFieldNote": "Nota: le mappature semantiche dei campi sono configurate nella scheda Identità del servizio.",
-      "enableOrgLevel": "Abilita la deduplicazione a livello di organizzazione",
-      "enableOrgLevelTooltip": "Abilita le funzionalità di deduplicazione e correlazione per tutti gli avvisi di questa organizzazione",
-      "enableCrossAlert": "Abilita la deduplicazione tra avvisi",
-      "enableCrossAlertTooltip": "Consenti la deduplicazione reciproca di diversi avvisi quando condividono la stessa impronta digitale",
-      "fingerprintGroups": "Gruppi di impronte digitali tra avvisi",
-      "fingerprintGroupsTooltip": "Seleziona i gruppi semantici da utilizzare per il fingerprinting tra avvisi incrociati. Gli avvisi verranno deduplicati se condividono gli stessi valori per queste dimensioni.",
-      "fingerprintGroupsHint": "Seleziona almeno un gruppo semantico per la deduplicazione tra avvisi",
-      "fingerprintGroupsRequired": "È necessario selezionare almeno un gruppo semantico",
-      "defaultWindow": "Finestra di correlazione predefinita (minuti)",
-      "defaultWindowTooltip": "In assenza di corrispondenza semantica dei campi, gli avvisi e i dati di una determinata durata sono considerati correlati",
-      "defaultWindowDescription": "In assenza di corrispondenza semantica dei campi, gli avvisi e i dati di una determinata durata sono considerati correlati",
-      "defaultWindowPlaceholder": "Usa il periodo di avviso per impostazione predefinita",
-      "cancelButton": "Annulla",
-      "saveButton": "Salva",
-      "settingsSaved": "Impostazioni di deduplicazione dell'organizzazione salvate con successo",
-      "settingsSaveError": "Salvataggio impostazioni fallito"
-    },
     "placeholders": {
       "typeSomething": "Digita qualcosa",
       "value": "Valore",
       "selectColumn": "Seleziona colonna",
       "savedFunctions": "Funzioni salvate",
-      "autoUsesCheckInterval": "Auto (utilizza l'intervallo di controllo)",
       "addTag": "Aggiungi un tag e premi Invio"
     },
     "steps": {
       "compareWithPast": "Confronta con il passato",
-      "deduplication": "Deduplicazione",
       "advanced": "Avanzato"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Cosa dovrebbe attivare l'avviso",
       "compareWithPast": "Confronta i risultati attuali con i dati di un altro periodo di tempo",
       "alertSettings": "Imposta le regole per gli avvisi e scegli come ricevere le notifiche.",
-      "deduplication": "Evita di inviare lo stesso avviso più volte raggruppando avvisi simili.",
       "advanced": "Variabili di contesto, descrizione e template di riga"
     },
     "failedToFetchHistory": "Impossibile recuperare la cronologia degli avvisi",
@@ -10399,8 +10691,6 @@
         "closeActions": "Chiudi azioni",
         "viewAlertHistory": "Visualizza cronologia avvisi",
         "actionsFor": "Azioni per:",
-        "configureDedup": "Configura Dedup",
-        "configureDedupTooltip": "Configura la deduplicazione per questo avviso",
         "editAlert": "Modifica avviso",
         "editAlertTooltip": "Modifica la configurazione degli avvisi",
         "viewHistory": "Visualizza cronologia",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "nuovo messaggio \"Risolto\"",
       "keepFiringFor": "Mantieni attivo per",
       "keepFiringForTooltip": "Attendi questo tempo dopo che la condizione è cessata prima di ripristinare. 0 ripristina immediatamente.",
+      "suppressRepeats": "Sopprimi ripetizioni",
+      "suppressRepeatsTooltip": "Notifica una volta quando l'avviso inizia a essere attivo o cambia livello, non a ogni valutazione. Lascialo disattivato per continuare a ricevere promemoria dopo ogni periodo di silenzio.",
       "keepFiringForInvalid": "Inserisci 0 o più secondi",
       "keepFiringForTooLong": "Inserisci al massimo 86400 secondi (24 ore)"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Questo indirizzo email è già stato aggiunto",
     "confirmRemoveEmail": "Sei sicuro di voler rimuovere l'email {email}?",
     "domainNeedsEmails": "Il dominio '{domain}' deve avere almeno un indirizzo email quando non è consentito a tutti gli utenti",
+    "noAllowedEmailsDenyAll": "Nessuna email è ancora consentita, quindi ogni utente di {domain} viene rifiutato.",
     "domainSettingsSaved": "Impostazioni del dominio salvate con successo",
     "errorSavingDomainSettings": "Errore durante il salvataggio delle impostazioni del dominio",
     "noDomainMessage": "Nessun dominio configurato. Aggiungi i domini sopra per limitare l'accesso.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Configura almeno un set di identità prima di salvare.",
       "discoveredServicesTab": "Servizi scoperti",
       "serviceDiscoveryTab": "Regole di rilevamento",
-      "alertCorrelationTab": "Correlazione degli avvisi",
       "fieldAliasesTab": "Mappature dei campi",
       "fieldAliasesSaved": "Alias dei campi salvati con successo",
       "fieldAliasesSaveError": "Impossibile salvare gli alias dei campi",
@@ -14079,27 +14371,144 @@
     "runsIn": "Esecuzione in",
     "recommendedByFieldCoverage": "Consigliato in base alla copertura dei campi nei tuoi stream.",
     "listConjunctionAndTwo": "{first} e {last}",
-    "domainOrgMappings": {
-      "title": "Mappature da dominio a organizzazione",
-      "subtitle": "I nuovi utenti che accedono con un dominio email corrispondente vengono aggiunti automaticamente all'organizzazione.",
+    "orgDomainMapping": {
+      "tabLabel": "Gestione domini",
+      "tabDesc": "Collega i tuoi domini email, mappa i loro utenti alle organizzazioni e controlla chi di loro può accedere.",
+      "loadFailed": "Impossibile caricare le impostazioni dell'organizzazione",
       "addMapping": "Aggiungi mappatura",
       "editMapping": "Modifica mappatura",
-      "empty": "Nessuna mappatura. Usa “{addLabel}” per aggiungerne una.",
       "domain": "Dominio email",
-      "domainHelp": "La parte dopo {at_sign} nell'indirizzo email dell'utente.",
+      "domainHelp": "La parte dopo {at_sign} nell'indirizzo email dell'utente. Il dominio è collegato a questa organizzazione e deve essere verificato tramite DNS.",
+      "domainHelpRequest": "La parte dopo {at_sign} nell'indirizzo email dell'utente. Il dominio viene collegato a questa organizzazione dopo che OpenObserve approva la richiesta.",
       "organization": "Organizzazione",
-      "organizationPlaceholder": "Identificatore dell'organizzazione",
-      "organizationHelp": "L'identificatore dell'organizzazione a cui vengono aggiunti gli utenti corrispondenti.",
+      "organizationHelp": "Questa organizzazione o uno dei membri del suo gruppo di fatturazione.",
       "organizationRequired": "L'organizzazione è obbligatoria",
       "baseRole": "Ruolo di base",
-      "baseRoleHelp": "Il ruolo assegnato agli utenti corrispondenti in tale organizzazione.",
-      "roleClaimName": "Claim dei ruoli",
+      "baseRoleHelp": "Il ruolo assegnato quando un utente viene aggiunto a quell'organizzazione. I membri esistenti mantengono il ruolo attuale.",
+      "roleClaimName": "Claim del ruolo",
       "roleClaimNamePlaceholder": "Nome del claim, ad es. groups",
-      "roleClaimNameHelp": "Facoltativo. Claim del token che elenca i ruoli personalizzati dell'utente; a ogni accesso i suoi ruoli personalizzati in tale organizzazione vengono sincronizzati con esso.",
-      "createMissingRoles": "Crea i ruoli del claim che non esistono nell'organizzazione",
-      "duplicateDomain": "Esiste già una mappatura per questo dominio",
-      "confirmRemove": "Sei sicuro di voler eliminare la mappatura per {name}?",
-      "deleteTitle": "Elimina mappatura"
+      "roleClaimNameHelp": "Facoltativo. Claim del token SSO che elenca i ruoli personalizzati dell'utente. A ogni accesso SSO, i suoi ruoli personalizzati in quell'organizzazione vengono sostituiti con quelli dichiarati nel claim; i ruoli dichiarati che non esistono vengono ignorati, a meno che non vengano creati.",
+      "createMissingRoles": "Crea i ruoli dichiarati nel claim che non esistono nell'organizzazione",
+      "verifyNow": "Verifica ora",
+      "details": "Dettagli",
+      "detailsDialogTitle": "Dettagli del collegamento per {domain}",
+      "approvedLinkInfo": "Collegato da OpenObserve dopo una richiesta di collegamento. Non è necessario alcun record DNS.",
+      "pendingRequestInfo": "OpenObserve sta esaminando questa richiesta. Non devi fare nulla finché non viene approvata.",
+      "rejectedRequestInfo": "OpenObserve ha rifiutato questa richiesta.",
+      "verifyDialogTitle": "Verifica {domain}",
+      "recordDialogTitle": "Record DNS per {domain}",
+      "lastCheckFailed": "Ultimo controllo non riuscito: {reason}",
+      "state": {
+        "pending": "In sospeso",
+        "verified": "Verificato",
+        "failed": "Non riuscito",
+        "requested": "In attesa di approvazione",
+        "approved": "Approvato",
+        "rejected": "Rifiutato"
+      },
+      "saved": "Mappatura del dominio salvata",
+      "saveFailed": "Impossibile salvare le impostazioni",
+      "linkFailed": "Impossibile collegare il dominio",
+      "unlinkFailed": "Impossibile scollegare il dominio",
+      "verifyFailed": "Verifica non riuscita",
+      "deleted": "Mappatura rimossa",
+      "deleteTitle": "Rimuovere la mappatura?",
+      "deleteMappingBody": "Gli utenti di {domain} non verranno più aggiunti a {org} quando effettuano l'accesso.",
+      "recordInstructions": "Aggiungi questo record DNS TXT presso il tuo provider DNS:",
+      "txtNameLabel": "Nome record",
+      "txtValueLabel": "Valore record",
+      "copyTxtName": "Copia nome record",
+      "copyTxtValue": "Copia valore record",
+      "txtNameCopied": "Nome record copiato",
+      "txtValueCopied": "Valore record copiato",
+      "verifyHint": "La verifica viene eseguita automaticamente ogni {minutes} minuti. Puoi anche verificare ora.",
+      "alreadyLinked": "Questo dominio è già collegato a questa organizzazione",
+      "failureReason": {
+        "recordMissing": "Record TXT non trovato",
+        "valueMismatch": "Record TXT trovato, ma il valore non corrisponde",
+        "dnsFailed": "Risoluzione DNS non riuscita"
+      },
+      "pageSubtitle": "Collega i tuoi domini email, mappa i relativi utenti alle organizzazioni e controlla quali possono unirsi.",
+      "linkedTab": "Domini collegati",
+      "mappingsTab": "Mappature",
+      "accessTab": "Utenti bloccati",
+      "requestsTab": "Richieste di collegamento",
+      "linkDomain": "Collega dominio",
+      "sendRequest": "Invia richiesta",
+      "linkMethod": "Come dimostrare la proprietà",
+      "method": {
+        "dns": "Record DNS",
+        "approved": "Richiesta approvata",
+        "request": "Richiesta di collegamento",
+        "dnsTitle": "Aggiungi un record DNS TXT",
+        "dnsDesc": "Viene verificato automaticamente una volta pubblicato il record. Ideale quando gestisci il DNS del dominio.",
+        "requestTitle": "Richiedi un collegamento a OpenObserve",
+        "requestDesc": "Il nostro team esamina la richiesta e collega il dominio una volta approvata."
+      },
+      "searchDomains": "Cerca domini",
+      "searchMappings": "Cerca per dominio o organizzazione",
+      "searchRequests": "Cerca per dominio, organizzazione o richiedente",
+      "status": "Stato",
+      "linkedVia": "Collegato tramite",
+      "lastChecked": "Ultimo controllo",
+      "linked": "Dominio collegato. Aggiungi il record DNS per verificarlo.",
+      "verified": "Dominio verificato",
+      "notVerifiedYet": "Il record DNS non è ancora stato trovato. La propagazione può richiedere del tempo.",
+      "requestSent": "Richiesta di collegamento inviata",
+      "requestFailed": "Invio della richiesta di collegamento non riuscito",
+      "keepRecordHint": "Mantieni questo record. La proprietà viene ricontrollata ogni {minutes} minuti; se il record manca per più di {grace} minuti, il dominio viene contrassegnato come non riuscito e le sue mappature smettono di essere applicate.",
+      "removeDomain": "Rimuovi dominio",
+      "removeTitle": "Rimuovere il dominio?",
+      "removeBody": "{domain} verrà scollegato da questa organizzazione.",
+      "removeWithMappingsBody": "{domain} verrà scollegato da questa organizzazione e la sua mappatura {count} verrà rimossa. | {domain} verrà scollegato da questa organizzazione e le sue {count} mappature verranno rimosse.",
+      "removed": "Dominio rimosso",
+      "domainRequired": "Il dominio è obbligatorio",
+      "mappingDomainHelp": "È possibile mappare solo i domini verificati.",
+      "createsRoles": "Crea ruoli",
+      "duplicateMapping": "Questo dominio è già mappato su quell'organizzazione",
+      "domainNotVerified": "Non verificato",
+      "noVerifiedDomains": "Le mappature si applicano ai domini verificati. Collega e verifica prima un dominio.",
+      "goToLinked": "Collega un dominio",
+      "goToLinkedDesc": "Verifica un dominio di tua proprietà prima di mapparne gli utenti",
+      "enforceTitle": "Rimuovi gli utenti dalle altre organizzazioni",
+      "enforceDesc": "Quando un utente di un dominio mappato accede tramite SSO, viene rimosso da ogni organizzazione al di fuori di questa e del suo gruppo di fatturazione.",
+      "enforceConfirmTitle": "Rimuovere gli utenti dalle altre organizzazioni?",
+      "enforceConfirmBody": "Ogni volta che un utente il cui dominio email ha una mappatura qui accede tramite SSO, verrà rimosso da ogni organizzazione che non sia questa o che non faccia parte del suo gruppo di fatturazione, comprese le sue organizzazioni personali.",
+      "enforceConfirmAction": "Attiva",
+      "enforceSaved": "Impostazione salvata",
+      "blockUsers": "Blocca utenti",
+      "editBlockedUsers": "Modifica utenti bloccati",
+      "block": "Blocca",
+      "blockedCount": "{count} bloccato | {count} bloccati",
+      "blockedEmails": "Email bloccate",
+      "blocklistDomainHelp": "Uno dei domini verificati di questa organizzazione.",
+      "blocklistEmailsHelp": "Questi utenti non possono unirsi a questa organizzazione né ai membri del suo gruppo di fatturazione tramite SSO e vengono rimossi al loro prossimo accesso.",
+      "ruleBlockedRequired": "Aggiungi almeno un'email da bloccare",
+      "noDomainForBlocklist": "Ogni dominio verificato ha già utenti bloccati. Modifica la sua riga per cambiarli.",
+      "unblockAll": "Sblocca tutti",
+      "unblockAllTitle": "Sbloccare tutti gli utenti?",
+      "unblockAllBody": "Ogni utente bloccato di {domain} potrà unirsi di nuovo al prossimo accesso SSO.",
+      "blocklistSaved": "Utenti bloccati salvati",
+      "blocklistDeleted": "Utenti sbloccati",
+      "blocklistSection": "Utenti bloccati per dominio",
+      "filterPending": "In sospeso",
+      "filterAll": "Tutti",
+      "requestedBy": "Richiesto da",
+      "requestedAt": "Richiesto",
+      "verifiedAt": "Verificato",
+      "answeredBy": "Risposto da",
+      "reason": "Motivo",
+      "reasonHelp": "Mostrato all'organizzazione che ha inviato la richiesta.",
+      "reasonRequired": "Per rifiutare una richiesta è necessario un motivo",
+      "approve": "Approva",
+      "reject": "Rifiuta",
+      "approveTitle": "Approvare la richiesta di collegamento?",
+      "rejectTitle": "Rifiutare la richiesta di collegamento?",
+      "approveBody": "{domain} verrà collegato a {org} senza una verifica DNS.",
+      "rejectBody": "{org} non otterrà {domain}.",
+      "requestApproved": "{domain} collegato",
+      "requestRejected": "Richiesta per {domain} rifiutata",
+      "decisionFailed": "Impossibile aggiornare la richiesta"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Seleziona l'opzione di rilevamento"
   },
   "search_history": {
-    "title": "Cronologia delle ricerche",
+    "title": "Cronologia utilizzo e costi",
     "get_history": "Ottieni la cronologia",
     "executed_at": "Eseguito a",
     "sql_query": "Query SQL",
-    "delayMessage": "La cronologia delle ricerche potrebbe essere ritardata"
+    "delayMessage": "La cronologia utilizzo e costi potrebbe essere ritardata di"
   },
   "correlation": {
     "unstableDimensionNote": "Dimensione instabile - cambia al riavvio del pod. Predefinito: tutti i valori.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "I dati sono freschi",
     "dataGettingStale": "I dati stanno diventando obsoleti",
     "dataStale": "I dati sono obsoleti",
-    "lastRefreshed": "Ultimo aggiornamento: {time}"
+    "lastRefreshed": "Ultimo aggiornamento: {time}",
+    "refresh": "Aggiorna",
+    "refreshWithAge": "Aggiorna, ultimo aggiornamento {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Errore probe"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "clic",
       "actionType": "digita",
       "all": "Tutti",
@@ -19868,6 +20280,13 @@
       "attemptN": "Tentativo {n}",
       "detailAction": "Azione",
       "detailSelector": "Selettore",
+      "detailStepId": "ID passaggio",
+      "detailTargetUrl": "URL di destinazione",
+      "detailStatus": "Stato",
+      "detailSkipReason": "Motivo del salto",
+      "stepStatusSkipped": "Saltato",
+      "stepStatusUnknown": "Sconosciuto",
+      "skippedCount": "{n} saltati",
       "downloadTrace": "Scarica {filename}",
       "errorFullscreenTitle": "Step {id}: {action} - Errore",
       "failedAtStartLoad": "Apertura dell'URL iniziale non riuscita",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Massimo {max}. I tentativi vengono eseguiti nello stesso job, quindi l'intera sequenza deve rientrare nel budget del controllo.",
       "retriesMaxBrowserHint": "Massimo {max} per i controlli browser. Ogni tentativo riesegue il percorso su ogni dispositivo, quindi un numero maggiore supererebbe il timeout della sonda e segnalerebbe un guasto che il tuo sito non ha mai avuto.",
       "retryDelay": "Aspetta",
-      "retryDelaySuffix": "ms tra un tentativo e l'altro.",
+      "retryDelaySuffix": "secondi tra un tentativo e l'altro.",
       "schedule": "Programmazione",
       "scheduleLater": "Pianifica più tardi",
       "scheduleLaterTooltip": "Scegli una data e un'ora future per attivare il controllo.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Riavvio configurazione — copia il comando di configurazione di questo agente per rieseguire l'installazione / il riavvio di docker (ad es. dopo una rotazione del token)",
         "noAgents": "Nessun agente si è ancora registrato per questa posizione.",
         "agentsUnavailable": "Gli agenti di questa posizione sono registrati con un altro cluster e non sono visibili qui.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Controlli in esecuzione da questa posizione",
         "checkName": "Nome",
         "noChecks": "Nessun controllo è ancora assegnato a questa posizione.",
@@ -20546,7 +20967,7 @@
       "nodes": "Nodi",
       "modelPricing": "Prezzi del modello",
       "searchSchedulers": "Pianificatori di ricerca",
-      "searchHistory": "Cronologia delle ricerche",
+      "searchHistory": "Cronologia utilizzo e costi",
       "sessions": "Sessioni",
       "evalTemplates": "Valutazioni online — Template",
       "scorers": "Valutazioni online — Valutatori",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Aggiorna elenco",
       "alertTemplatesAdd": "Aggiungi nuovo template",
       "alertTemplatesRefresh": "Aggiorna elenco",
-      "logsSearchHistory": "Apri la cronologia delle ricerche",
+      "logsSearchHistory": "Apri cronologia utilizzo e costi",
       "alertsImport": "Importa avviso",
       "panelEditorRun": "Esegui/applica query",
       "panelEditorSave": "Salva e continua a modificare",
@@ -21131,6 +21552,7 @@
         "system": "sistema"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Operativo",
         "passed": "Superato",
         "healthy": "Sano",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Impossibile passare all'avviso",
       "alertNotFound": "Avviso non trovato",
-      "alertNotFoundInAlerts": "Avviso \"{name}\" non trovato tra {count} avvisi",
       "failedToLoadAlerts": "Impossibile caricare gli avvisi",
       "alertsDeletedSuccessfully": "{count} avviso eliminato con successo | {count} avvisi eliminati con successo",
       "failedToDeleteAlerts": "Impossibile eliminare {count} avviso | Impossibile eliminare {count} avvisi",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Attendere mentre si caricano i template...",
       "alertSavedSuccessfully": "Avviso salvato con successo.",
       "alertUpdatedSuccessfully": "Avviso aggiornato con successo.",
-      "openingDedupConfig": "Apertura configurazione di deduplicazione per: {name}",
       "editingAlert": "Modifica avviso: {name}",
       "ack": {
         "acked": "Presa in carico: {name}",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Editor Prezzi Modello",
     "storageSettings": "Impostazioni Archiviazione",
     "domainManagement": "Gestione Domini",
+    "orgDomainMapping": "Gestione dei domini",
     "slackApp": "Slack",
     "regexPatterns": "Pattern Regex",
     "syntheticsLocations": "Posizioni Synthetics",
@@ -26099,7 +26520,7 @@
       "logged": "Registrato"
     },
     "policy": {
-      "gateHint": "Tra le modifiche agli avvisi esistenti, solo la deduplicazione si applica da sola, con un'istantanea dello stato precedente e una finestra di revisione: mantenuta se i suoi controlli passano, ripristinata se falliscono. Tutto il resto attende l'approvazione con un clic.",
+      "gateHint": "Tra le modifiche agli avvisi esistenti, solo l'attivazione della soppressione delle ripetizioni viene applicata automaticamente, con uno snapshot dello stato precedente e una finestra di revisione: mantenuta se le verifiche hanno esito positivo, annullata se falliscono. Tutto il resto attende l'approvazione con un clic.",
       "off": "Disattivato",
       "suggest": "Suggerisci",
       "auto": "Auto",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Trattiene la notifica finché l'indagine non si conclude, per un massimo di 2 minuti. Fails open: se il triage va in timeout o fallisce, invia comunque la notifica, indica che l'indagine è ancora in corso o è fallita, e la causa segue nel thread."
       },
       "classes": {
-        "EnableDeduplication": "Attiva la deduplicazione per un avviso che si ripete nel giro di pochi minuti.",
+        "EnableDeduplication": "Attiva la soppressione delle ripetizioni per un avviso che notifica a ogni valutazione.",
         "CreateDetector": "Crea un rilevatore di anomalie su richieste, errori o latenza di un servizio.",
         "RaiseThreshold": "Alza una soglia che scatta in giorni sani.",
         "LengthenEvaluationWindow": "Allunga la finestra di un avviso che oscilla.",
@@ -26667,10 +27088,10 @@
           "on": "avviso di connessione"
         },
         "L-302": {
-          "done": "Ho raggruppato i 3 avvisi di latenza di checkout in uno",
-          "why": "Scattavano insieme nel 94% dei casi, quindi un rallentamento ti ha avvisato 3 volte.",
-          "from": "3 avvisi",
-          "to": "1",
+          "done": "Attivata la soppressione delle ripetizioni per i 3 avvisi di latenza del checkout",
+          "why": "Notificavano a ogni valutazione mentre rimanevano attivi, quindi un singolo rallentamento ti ha inviato 120 notifiche.",
+          "from": "Ogni valutazione",
+          "to": "Una volta per cambio",
           "on": "latenza di checkout"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "Ho avvisato la reperibilità per i pagamenti non riusciti di checkout.",
         "recsHeld": "Ho messo da parte un problema minore con recommendations per il riepilogo di venerdì.",
         "diskApproved": "Hai approvato l'innalzamento dell'avviso sul disco di ingest-1 al {to}%.",
-        "latencyGrouped": "Ho raggruppato i tre avvisi di lentezza di checkout in uno solo, così un singolo rallentamento genera una sola notifica.",
+        "latencyGrouped": "Ho attivato la soppressione delle ripetizioni per i tre avvisi di lentezza del checkout, così un singolo rallentamento invia una sola notifica.",
         "queueFixed": "Ho aggiunto worker alla coda di orders, ma la coda continuava a crescere, quindi li ho ripristinati e ho avvisato la reperibilità.",
         "loginPaged": "Ho avvisato la reperibilità per l'accesso lento.",
         "queuePermission": "Mi hai autorizzato ad aggiungere worker alla coda in autonomia, fino a 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Stato della pipeline",
       "legendToggle": "Mostra o nascondi questo stato sulla mappa"
     }
+  },
+  "recentSearches": {
+    "title": "Ricerche recenti",
+    "aboutKeptDays": "Solo le tue ricerche in {org}, visibili solo a te. Conservate per {days} giorno; le ricerche con stella restano finché non le rimuovi. | Solo le tue ricerche in {org}, visibili solo a te. Conservate per {days} giorni; le ricerche con stella restano finché non le rimuovi.",
+    "aboutKeptForever": "Solo le tue ricerche in {org}, visibili solo a te. Conservate fino all'eliminazione.",
+    "pageTitle": {
+      "logs": "Ricerche log recenti",
+      "traces": "Ricerche tracce recenti",
+      "metrics": "Ricerche metriche recenti",
+      "dbm": "Ricerche recenti",
+      "profiles": "Ricerche recenti"
+    },
+    "page": {
+      "logs": "Log",
+      "traces": "Tracce",
+      "metrics": "Metriche",
+      "dbm": "Database",
+      "profiles": "Profili"
+    },
+    "allPages": "Tutte le pagine",
+    "viewAll": "Visualizza tutto",
+    "failedCount": "{count} non riuscite",
+    "keyHints": "↑↓ sposta · PgUp/PgDn scorri query · Invio esegui · Shift+Invio solo carica · Esc chiudi",
+    "loadToFix": "Carica per correggere",
+    "emptyTitle": "Nessuna ricerca recente",
+    "loadError": "Impossibile caricare le ricerche recenti",
+    "retry": "Riprova",
+    "warning": "Terminata con un avviso: timeout o risultati parziali",
+    "failed": "Non riuscita",
+    "ranCount": "eseguita {count}x",
+    "lineCount": "{count} riga | {count} righe",
+    "relativeWindow": "Ultimi {period}",
+    "rerunNow": "Riesegui ora",
+    "rerunOriginal": "All'ora originale",
+    "loadOnly": "Carica senza eseguire",
+    "copyLink": "Copia link",
+    "copyQuery": "Copia query",
+    "star": "Aggiungi stella",
+    "unstar": "Rimuovi stella",
+    "linkCopied": "Link copiato",
+    "queryCopied": "Query copiata",
+    "copyFunction": "Copia funzione",
+    "functionCopied": "Funzione copiata",
+    "functionLabel": "Funzione (VRL)",
+    "searchPlaceholder": "Cerca query e stream",
+    "allStreams": "Tutti gli stream",
+    "statusAll": "Qualsiasi stato",
+    "statusOk": "Riuscita",
+    "statusError": "Non riuscita",
+    "starredOnly": "Solo con stella",
+    "datePlaceholder": "gg/mm/aaaa",
+    "filterByDateRun": "Filtra per data di esecuzione",
+    "today": "Oggi",
+    "yesterday": "Ieri",
+    "noMatch": "Nessuna ricerca corrisponde a questi filtri",
+    "reset": "Reimposta tutto",
+    "resetFilters": "Reimposta filtri",
+    "loadMore": "Carica altro",
+    "clear": "Cancella la mia cronologia",
+    "confirmClear": "Cancella cronologia",
+    "clearBodyPage": "Verrà rimossa la tua ricerca recente ({count}) in {page} in {org}. Le viste salvate non sono interessate. | Verranno rimosse le tue {count} ricerche recenti in {page} in {org}. Le viste salvate non sono interessate.",
+    "clearBodyAll": "Verrà rimossa la tua ricerca recente ({count}) in {org} tra Log, Tracce e Metriche. Le viste salvate non sono interessate. | Verranno rimosse le tue {count} ricerche recenti in {org} tra Log, Tracce e Metriche. Le viste salvate non sono interessate.",
+    "includeStarred": "Rimuovi anche la mia ricerca preferita ({count}) | Rimuovi anche le mie {count} ricerche preferite",
+    "recentRow": "Ricerca recente",
+    "deletedQuery": "Eliminata {query}",
+    "undo": "Annulla"
   }
 }
diff --git a/web/src/locales/languages/ja-JP.json b/web/src/locales/languages/ja-JP.json
index df95a3291c..24a8a28cae 100644
--- a/web/src/locales/languages/ja-JP.json
+++ b/web/src/locales/languages/ja-JP.json
@@ -486,7 +486,11 @@
       "monitors": "モニター",
       "modelPricing": "モデルの価格設定",
       "variables": "変数",
-      "experiments": "実験"
+      "experiments": "実験",
+      "linkedDomains": "リンク済みドメイン",
+      "domainMappings": "ドメインマッピング",
+      "domainRequests": "リンクリクエスト",
+      "blockedUsers": "ブロック済みユーザー"
     },
     "demo": {
       "pageTitle": "空の状態 — レビュー用の完全セット",
@@ -572,6 +576,30 @@
       "action": "新規タスク",
       "actionDesc": "OpenObserveをエンドポイントに指定して接続をテストします。"
     },
+    "noLinkedDomains": {
+      "title": "リンク済みドメインはまだありません",
+      "description": "所有するメールドメインをリンクして、そのユーザーを組織にマッピングし、サインインできるユーザーを制御します。",
+      "dns": "DNS レコードを追加",
+      "dnsDesc": "TXT レコードで所有権を確認",
+      "request": "リンクをリクエスト",
+      "requestDesc": "OpenObserve にドメインのリンクを依頼"
+    },
+    "noDomainMappings": {
+      "title": "ドメインマッピングはまだありません",
+      "description": "検証済みドメインでサインインするユーザーを、この組織またはその請求グループのメンバーに自動的に追加します。",
+      "action": "マッピングを追加",
+      "actionDesc": "ドメイン、組織、ロールを選択"
+    },
+    "noBlockedUsers": {
+      "title": "ブロック済みユーザーはいません",
+      "description": "検証済みドメインのすべてのユーザーが参加できます。特定のユーザーをブロックして参加を防ぎます。",
+      "action": "ユーザーをブロック",
+      "actionDesc": "ドメインとブロックするメールアドレスを選択"
+    },
+    "noDomainRequests": {
+      "title": "リンクリクエストはありません",
+      "description": "組織からのドメインリンクのリクエストがここに表示されます。"
+    },
     "noDowntimes": {
       "title": "ダウンタイムはまだありません",
       "description": "ダウンタイムは、指定した時間枠の間、アラート、異常検知、合成モニタリングチェックを実行したまま、それらの通知を停止します。",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "ライブモードをオフにする",
     "autoRefreshWithValue": "自動更新：{value}",
     "searchHistory": "検索履歴",
+    "usageCostHistory": "使用量とコストの履歴",
     "createScheduledSearch": "スケジュール検索の作成",
     "listScheduledSearch": "スケジュール検索を一覧表示",
     "scheduleSearchJob": "検索ジョブをスケジュール",
@@ -1355,6 +1384,8 @@
     "scanSize": "スキャンサイズ",
     "deltaScanSize": "デルタスキャンサイズ",
     "scannedSoFar": "{size} をスキャン済み",
+    "quickModeHiddenFields": "クイックモードがオンです。この行には {total} 個中 {shown} 個のフィールドが表示されています。",
+    "turnOffQuickMode": "クイックモードをオフにする",
     "resultsProgressLabel": "検索の進捗",
     "histogramTitleError": "ヒストグラムタイトルの生成中にエラーが発生しました。",
     "selectLogStream": "ログストリームを選択",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "このビューのネットワークデータがありません",
     "apiEmptyDescription": "選択したストリームには、この時間範囲のリソースまたはネットワーク リクエストがありません。ネットワーク メトリクスは、アプリが HTTP 呼び出しを計測すると表示されます。",
     "skipInactivity": "非アクティブ期間をスキップ",
+    "fullScreen": "全画面表示",
+    "exitFullScreen": "全画面表示を終了",
     "error": "エラー",
     "errorCount": "エラー数",
     "all": "すべて",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "このファネルをダッシュボードに追加するには、2 番目のステップを追加してください",
         "snapshot": "パネルは、これらのステップ、フィルター、名前付きイベントのルールを現状のまま保持します。"
       }
+    },
+    "overviewPage": {
+      "regionLabel": "パフォーマンス概要",
+      "filterService": "サービス",
+      "filterEnv": "環境",
+      "filterVersion": "バージョン",
+      "filterAll": "すべて",
+      "verdictPass": "Core Web Vitals 合格",
+      "verdictFail": "Core Web Vitals 要注意",
+      "verdictAllPass": "すべて合格",
+      "verdictNeedWork": "{total} 件中 {count} 件が要改善 | {total} 件中 {count} 件が要改善",
+      "percentileLabel": "パーセンタイル",
+      "bandGood": "良好",
+      "bandNeeds": "要改善",
+      "bandPoor": "不良",
+      "bandGoodPct": "{n}% 良好",
+      "bandNeedsPct": "{n}% 要改善",
+      "bandPoorPct": "{n}% 不良",
+      "bandAria": "良好 {good}%、要改善 {needs}%、不良 {poor}%",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} 高速",
+      "deltaSlower": "{v} 低速",
+      "deltaNone": "変化なし",
+      "deltaNoPrev": "以前のデータが不足しています",
+      "kpiSessions": "セッション",
+      "kpiErrorFree": "エラーのないセッション",
+      "kpiErrors": "エラー合計",
+      "kpiUnhandled": "未処理のエラー",
+      "kpiRegion": "主要指標",
+      "sparkAria": "選択範囲における {label} の推移",
+      "chartTitle": "セッションとエラー",
+      "chartInterval": "バケットごと",
+      "legendSessions": "セッション",
+      "legendErrors": "エラー",
+      "releaseMarker": "{version} 初回検出 {time}",
+      "chartTableToggle": "データテーブルを表示",
+      "chartTableHide": "データテーブルを非表示",
+      "chartTime": "時刻",
+      "pagesTitle": "優先して修正すべきページ",
+      "pagesHint": "影響度順: バイタルがしきい値を超えたビューまたはエラーが発生したビューの割合で重み付けしたトラフィック。ページをクリックするとセッション、エラー件数をクリックするとエラートラッキングを表示します。",
+      "pagesColPage": "ページ",
+      "pagesColViews": "ビュー",
+      "pagesColErrors": "エラー",
+      "pagesColImpact": "影響度",
+      "pagesLegend": "▲ 要改善 · ■ 不良 · 印なしは良好。{n} ビュー未満のページは非表示です。",
+      "pagesOpenSessions": "{path} のセッションを開く",
+      "pagesOpenErrors": "{count} 件のエラー、エラートラッキングを開く | {count} 件のエラー、エラートラッキングを開く",
+      "pagesImpactAria": "影響度 100 中 {n}",
+      "markNeeds": "要改善",
+      "markPoor": "不良",
+      "diffTitle": "最大の差異",
+      "diffBody": "INP p75 は {inp} で、他のセグメントの {ratio}x です。調査すべき相関であり、証明された原因ではありません。",
+      "diffNone": "この範囲では、他のセグメントから際立つセグメントはありません。",
+      "diffLink": "影響を受けたセッションを表示",
+      "segmentLabel": "セグメント",
+      "segBrowser": "ブラウザ",
+      "segDevice": "デバイス",
+      "segCountry": "国",
+      "segInp": "INP {v}",
+      "segShare": "ビューの {n}%",
+      "segNone": "このセグメントのデータはありません。",
+      "releaseTitle": "リリース比較",
+      "releaseHint": "{cur} と {prev} の比較。リリース開始は、バージョンが最初に確認された時点です。",
+      "releaseMetric": "メトリクス",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "エラーなし",
+      "releaseSessions": "セッション",
+      "releaseLink": "{version} のエラー",
+      "frustrationTitle": "ユーザーフラストレーション",
+      "frustrationHint": "バイタルでは捉えられない問題",
+      "rageClicks": "レイジクリック",
+      "deadClicks": "デッドクリック",
+      "stateLoading": "{panel} を読み込み中…",
+      "stateEmptyTitle": "この範囲にページビューはありません",
+      "stateEmptyBody": "時間範囲を広げるか、フィルターをクリアするか、ブラウザ SDK がビューイベントを送信しているか確認してください。",
+      "stateEmptyAction": "SDK を設定",
+      "stateLowTitle": "{count} ページビューのみ | {count} ページビューのみ",
+      "stateLowBody": "{min} ビュー未満ではパーセンタイルは信頼できないため、判定は非表示です。値は参考として表示されています。",
+      "stateErrorTitle": "{panel} を読み込めませんでした",
+      "stateErrorBody": "クエリが失敗したか、タイムアウトしました。他のパネルには影響しません。",
+      "retry": "再試行",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "主要指標",
+      "panelPages": "ページ",
+      "panelSegments": "セグメント",
+      "panelRelease": "リリース比較",
+      "panelFrustration": "ユーザーフラストレーション",
+      "schemaErrorTitle": "RUM スキーマを読み込めませんでした",
+      "schemaErrorBody": "ストリームのフィールドを読み取れなかったため、概要で表示するパネルを決定できません。",
+      "pagesShowAll": "{n} ページをすべて表示",
+      "pagesShowFewer": "表示するページを減らす",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "十分なビューがあるページはありません",
+      "pagesEmptyBody": "ページがランク付けされるには、この範囲で少なくとも {n} ビューが必要です。",
+      "segEmptyTitle": "セグメントデータがありません",
+      "segEmptyBody": "これらのビューには、ブラウザ、デバイス、OS、国、接続の値が記録されていません。",
+      "releaseEmptyTitle": "2 つのバージョンが必要",
+      "releaseEmptyBody": "リリース比較には、この範囲で確認された少なくとも2つのバージョンが必要です。",
+      "releaseBefore": "{version} はこの範囲より前からライブだったため、初回検出時刻は表示されません。",
+      "pageErrorTitle": "パフォーマンス概要を読み込めませんでした",
+      "pageErrorBody": "クエリが失敗したかタイムアウトしました。再試行してすべてのパネルを読み込み直してください。",
+      "verdictOver": "{vital} はページビューの {pct}% で良好しきい値 {threshold} を超えています。",
+      "verdictAllThree": "3つすべての Core Web Vitals が p75 で合格しています。",
+      "verdictAllSome": "評価対象の Core Web Vitals {n} 件すべてが p75 で合格しています。",
+      "releaseNewErrors": "{count} 件の新しいエラーがこのリリースにあります | {count} 件の新しいエラーがこのリリースにあります",
+      "verdictNoData": "Core Web Vitals のデータがありません",
+      "verdictNoDataLead": "この範囲の {count} 件のページビューはいずれも LCP、INP、CLS を報告していません。 | この範囲の {count} 件のページビューはいずれも LCP、INP、CLS を報告していません。",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}、{band}、{delta}。セッションを開きます。",
+      "pagesTableLabel": "影響度順のページ",
+      "verdictSessions": "この範囲のセッションは {count} 件です。 | この範囲のセッションは {count} 件です。",
+      "verdictCompare": "前期間と比較しています。",
+      "deltaLower": "{v} 低下",
+      "deltaHigher": "{v} 上昇",
+      "forbiddenTitle": "{panel} を表示する権限がありません",
+      "forbiddenBody": "RUM データストリームへのアクセス権を管理者に依頼してください。",
+      "pageForbiddenTitle": "パフォーマンス概要を表示する権限がありません",
+      "asideLabel": "どこで何が変わったか",
+      "pagesAbout": "このランキングについて",
+      "chartPerFiveMinutes": "5分ごと",
+      "chartPerThirtyMinutes": "30分ごと",
+      "chartPerHour": "1時間ごと",
+      "chartPerSixHours": "6時間ごと",
+      "chartPerDay": "1日ごと",
+      "chartIntervalOther": "バケットごと",
+      "chartTableCaption": "バケットごとのセッションとエラー",
+      "deltaChange": "前期間比 {delta}",
+      "deltaChangePts": "前期間比 {delta} ポイント",
+      "deltaFlat": "前期間から変化なし",
+      "deltaNewMsg": "前期間比で新規",
+      "verdictP75Note": "判定には常に p75 を使用します。p50 と p95 は値のみを変えます。",
+      "releaseNote": "バージョンフィルターの設定に関係なく、最新の2つのバージョンを比較します。",
+      "kpiEmptyTitle": "この範囲にセッションがありません",
+      "kpiEmptyBody": "時間範囲を広げるか、フィルターを解除してください。",
+      "releaseImproved": "改善",
+      "releaseWorse": "悪化",
+      "segOs": "OS",
+      "segConnection": "接続",
+      "pagesAllLink": "すべてのページ",
+      "pagesAllLinkAria": "プロダクト分析のすべてのページ",
+      "frustrationReplayLink": "リプレイを視聴",
+      "frustrationReplayHint": "この範囲のフラストレーションの高いセッションを開きます。記録済みのセッションにはリプレイがあります。",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "この範囲には何も記録されていません。時間範囲を広げるか、このアプリがまだデータを送信していない場合はブラウザ SDK を設定してください。",
+      "stateEmptyFiltered": "この範囲でこれらのフィルターに一致するものはありません。フィルターを解除すると、すべてのサービス、環境、バージョンが表示されます。",
+      "clearFilters": "フィルターを解除",
+      "stateRefreshing": "{panel} を更新中",
+      "tileOpenSessions": "{label}: {value}。開いているセッション",
+      "tileOpenErrors": "{label}: {value}。エラートラッキングを開く",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "この概要はブラウザセッションのみを集計しています。モバイルアプリのメトリクスは以下に表示されます。",
+      "mixedMobileNote": "以下のフィルターはモバイルアプリのメトリクスにのみ適用されます。"
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "削除",
     "confirmDeleteHead": "ユーザーを削除",
     "confirmDeleteMsg": "{name} ユーザーを削除してもよろしいですか？",
+    "block": "ブロック",
+    "confirmBlockHead": "ユーザーをブロック",
+    "confirmBlockMsg": "{email} は検証済みドメイン経由で参加しました。ブロックすると、この組織のドメイン制限に追加され、この組織から削除されます。他のマッピングされた組織からは次回のログイン時に削除されます。",
     "cancel": "キャンセル",
     "save": "保存",
     "ok": "OK",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "招待を取り消す",
     "revokeInvitationMsg": "{email} への招待を取り消してもよろしいですか？",
     "deleteUsersTitle": "ユーザーを削除する",
-    "deleteUsersMsg": "{count}人のユーザーを削除してもよろしいですか？ | {count}人のユーザーを削除してもよろしいですか？"
+    "deleteUsersMsg": "{count}人のユーザーを削除してもよろしいですか？ | {count}人のユーザーを削除してもよろしいですか？",
+    "deleteUsersBlockNote": "そのうち {count} 人は検証済みドメイン経由で参加したため、削除ではなくブロックされます。"
   },
   "invitation": {
     "pendingInvitations": "保留中の招待状",
@@ -3403,8 +3597,6 @@
       },
       "show": "表示",
       "searchPermissions": "権限を検索",
-      "filterModules": "モジュールをフィルター",
-      "noModuleMatch": "フィルターに一致するモジュールがありません",
       "moduleScopeAll": "すべて",
       "moduleScopeGranted": "選択済み",
       "noGrantedModule": "モジュールがまだ選択されていません",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "付与 | 付与",
       "summaryReachSome": "{total} 中 {count}",
       "summaryEmptyTitle": "このロールにはまだ何も付与されていません",
-      "summaryEmptyDescription": "左側のモジュールを選択するか、プリセットから開始してください。",
+      "summaryEmptyDescription": "プリセットから開始するか、リストからモジュールを選択してください。",
       "presetReadonlyTitle": "読み取り専用",
       "presetReadonlyDescription": "すべてのモジュールで一覧表示と取得",
       "presetDbmTitle": "データベースモニタリング閲覧者",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "この組織には {total} 個の Kubernetes メトリクスストリームがまだ存在しないため、何も事前選択されませんでした。",
       "rumPresetSeeded": "{total} 個の RUM ストリームのうち {matched} 個で読み取りアクセスを事前選択し、さらにソースマップと、RUM プロダクトアナリティクスの付与があればそれも選択しました。保存する前に確認してください。",
       "rumPresetNoMatch": "{total} 個の RUM ストリームはいずれもこの組織にまだ存在しないため、それらに対して何も事前選択されませんでした。ソースマップと、RUM プロダクトアナリティクスの付与がある場合は引き続き設定されています。",
-      "moduleGroupFleet": "Fleet"
+      "moduleGroupFleet": "Fleet",
+      "filterModulesTasks": "モジュールをフィルター",
+      "noModuleMatchQuery": "「{query}」に一致するモジュールはありません",
+      "noModuleMatchHint": "モジュール、グループ、タスクで検索できます（例: slack、panel、token）。",
+      "presetAlertManagerTitle": "アラートマネージャー",
+      "presetAlertManagerDescription": "アラート、その送信先、メッセージを作成・管理します",
+      "presetAlertViewerTitle": "アラートビューア",
+      "presetAlertViewerDescription": "アラート、宛先、テンプレートを変更せずに表示します",
+      "presetDashboardEditorTitle": "ダッシュボードエディター",
+      "presetDashboardEditorDescription": "ダッシュボードを作成・編集し、クエリ対象のデータへの読み取りアクセスを持ちます",
+      "presetDashboardViewerTitle": "ダッシュボードビューア",
+      "presetDashboardViewerDescription": "ダッシュボードを開き、パネルの元になるデータを読み取ります",
+      "presetPipelineEditorTitle": "パイプラインエディター",
+      "presetPipelineEditorDescription": "パイプラインと関数を作成し、ストリームとエンリッチメントテーブルへの読み取りアクセスを持ちます",
+      "presetApplied": "{title}: {permissions}を追加しました。保存する前に変更を確認してください。",
+      "presetPermissionCount": "{count} 件の権限 | {count} 件の権限",
+      "companionReasonAlertStreams": "アラートを保存するため。サーバーは保存時にストリームへのアクセスを確認します",
+      "companionReasonAlertDestinations": "アラートの送信先を選択するため",
+      "companionReasonDestinationTemplates": "すべての宛先に必要なメッセージテンプレートを選択するため",
+      "companionReasonDashboardStreams": "パネルデータを読み込むため",
+      "presetsTitle": "プリセット",
+      "presetsClose": "プリセットを閉じる",
+      "presetsShow": "プリセットを表示",
+      "presetsSubtitle": "プリセットの付与をこのロールに追加します。削除されるものはありません。",
+      "presetsSectionBuiltin": "組み込み",
+      "presetsSectionJob": "職務別",
+      "presetAddsTooltip": "{count} 件の権限を追加 | {count} 件の権限を追加",
+      "presetInRole": "ロール内",
+      "presetInRoleTooltip": "このロールにはこのプリセットの内容がすべて含まれています",
+      "presetBack": "すべてのプリセット",
+      "presetModuleCount": "{count} 個のモジュール | {count} 個のモジュール",
+      "presetSummaryAdds": "{modules}に{permissions}を追加します。",
+      "presetSummaryWrite": "{modules}への書き込みアクセス。",
+      "presetSummaryViewOnly": "表示のみ: 作成、編集、削除はできません。",
+      "presetSummaryHasAll": "このロールにはこのプリセットの内容がすべて含まれています。",
+      "presetSummarySkipped": "このロールにすでにある {count} 件の権限はスキップされます。 | このロールにすでにある {count} 件の権限はスキップされます。",
+      "presetStillMissing": "追加後も不足: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "追加後に不足するものはありません。",
+      "neededBy": "{modules} が必要としています",
+      "stillNeededBy": "{modules} がまだ必要としています",
+      "presetReadsEveryStream": "この組織のすべてのストリームを読み取れます。新しく作成されるものも含まれます。",
+      "presetAddButton": "{count} 件の権限を追加 | {count} 件の権限を追加",
+      "presetNothingToAdd": "追加するものはありません",
+      "presetApplyNote": "追加した付与は未保存の変更になります。保存する前に確認してください。",
+      "presetLoadingStreams": "ストリームを読み込み中",
+      "presetNoMatchingStreams": "この組織には一致するストリームがまだありません。",
+      "reviewMissingTooltip": "このロールが機能するには {count} 個のモジュールが不足しています | このロールが機能するには {count} 個のモジュールが不足しています",
+      "notAddedYetTitle": "未追加 · {modules}",
+      "companionAdd": "追加",
+      "companionAddItem": "{item} を追加",
+      "companionAddAll": "すべて追加",
+      "companionOpenStreams": "ストリームを開く",
+      "companionOpenStreamsTooltip": "このロールが読み取れるストリームを選択",
+      "companionNeeds": "{module} にはこれが必要です（{reason}）。",
+      "companionNeedsThis": "{module} にはこの権限が必要です（{reason}）。",
+      "companionStillNeedsThis": "{module} には引き続きこの権限が必要です（{reason}）。",
+      "yourChanges": "あなたの変更",
+      "yourChangesCount": "{modules}で{changes}",
+      "yourChangesNone": "まだありません",
+      "changeCount": "{count} 件の変更 | {count} 件の変更",
+      "changeOtherGroup": "その他",
+      "saveSuccessCounts": "{modules}で{changes}を保存しました。",
+      "effectCan": "{target}の{actions}ができます。",
+      "effectCannot": "{target}の{actions}ができなくなりました。",
+      "effectCanLoadDestinations": "宛先リストを読み込めます。",
+      "effectCannotLoadDestinations": "宛先リストを読み込めなくなりました。",
+      "effectCanLoadTemplates": "テンプレートリストを読み込めます。",
+      "effectCannotLoadTemplates": "テンプレートリストを読み込めなくなりました。",
+      "verbView": "表示",
+      "verbSeeListOf": "一覧での表示",
+      "verbList": "一覧表示",
+      "verbOpen": "閲覧",
+      "verbCreate": "作成",
+      "verbEdit": "編集",
+      "verbDelete": "削除",
+      "targetEveryStream": "すべてのストリーム（ログ、メトリクス、トレース、インデックス。新規を含む）",
+      "targetTypeStreams": "すべての {type} ストリーム",
+      "targetOneStream": "{type} ストリーム {name}",
+      "targetAlertsEveryFolder": "すべてのフォルダー内のアラート（新しいフォルダーを含む）",
+      "targetAlertsInFolder": "フォルダー {name} 内のアラート",
+      "targetOneAlert": "アラート {name}",
+      "targetDashboardsEveryFolder": "すべてのフォルダー内のダッシュボード（新しいフォルダーを含む）",
+      "targetDashboardsInFolder": "フォルダー {name} 内のダッシュボード",
+      "targetOneDashboard": "ダッシュボード {name}",
+      "targetReportsEveryFolder": "すべてのフォルダー内のレポート（新しいフォルダーを含む）",
+      "targetReportsInFolder": "フォルダー {name} 内のレポート",
+      "targetOneReport": "レポート {name}",
+      "targetEveryDestination": "すべてのアラート宛先（Slack、メール、Webhook。新規を含む）",
+      "targetOneDestination": "宛先 {name}",
+      "targetEveryTemplate": "すべての通知テンプレート（新規を含む）",
+      "targetOneTemplate": "テンプレート {name}",
+      "targetAllOf": "すべての{module}（新規を含む）",
+      "targetItemIn": "{module} 内の {name}",
+      "noteDestinationsFiltered": "表示されるのは、開くこともできる宛先だけです。どれを表示するか選ぶには、ここまたは個々の宛先に「取得」を追加してください。",
+      "noteTemplatesFiltered": "表示されるのは、開くこともできるテンプレートだけです。どれを表示するか選ぶには、ここまたは個々のテンプレートに「取得」を追加してください。",
+      "presetStreamsFailed": "ストリームリストを読み込めませんでした。",
+      "presetRetry": "再試行",
+      "presetRestored": "{title}: {permissions}を復元しました。保存する前に変更を確認してください。",
+      "presetSummaryRestores": "削除対象としてマークした {count} 件の権限を保持します。 | 削除対象としてマークした {count} 件の権限を保持します。",
+      "presetRestoreButton": "{count} 件の権限を保持 | {count} 件の権限を保持",
+      "effectStillAllowed": "アクセスの変更はありません: より広い付与により引き続き許可されています。"
     },
     "rolesPage": {
       "subtitle": "ロールには権限がバンドルされています。ユーザー、サービスアカウント、またはグループに割り当ててアクセスを許可します。",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "ユーザーが正常に更新されました。",
       "userDeletedSuccess": "ユーザーが正常に削除されました。",
       "errorDeletingUser": "ユーザー削除中にエラーが発生しました。",
+      "userBlockedSuccess": "ユーザーをブロックしました。",
+      "errorBlockingUser": "ユーザーのブロック中にエラーが発生しました。",
+      "blockedButNotRemoved": "ユーザーはブロックされましたが、この組織から削除できませんでした。",
+      "blockedUsersSuccess": "{count} 人のユーザーをブロックしました | {count} 人のユーザーをブロックしました",
+      "blockedUsersPartial": "{count} 人のユーザーをブロックして削除しましたが、{failed} 人はこの組織から削除できませんでした | {count} 人のユーザーをブロックして削除しましたが、{failed} 人はこの組織から削除できませんでした",
+      "blockedUsersNotRemoved": "{count} 人のユーザーをブロックしましたが、この組織から削除できませんでした | {count} 人のユーザーをブロックしましたが、この組織から削除できませんでした",
       "pleaseWait": "お待ちください...",
       "invitationRevokedSuccess": "招待が正常に取り消されました。",
       "errorRevokingInvitation": "招待の取り消し中にエラーが発生しました。",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "トレースは eBPF で取得されます。コード変更や SDK は不要です。トレースコンテキストがサービス間で引き継がれるのは平文 HTTP のみです（Go アプリは HTTPS でも可。ただしカーネルロックダウンが有効なノードを除く）。ポート、実行ファイルパス、コマンドラインのいずれかに一致するプロセスがトレースされます。glob には `,`、`{'{'}`、`{'}'}` を含めることはできません。また、ポートはそのポートでソケットを持つすべてのプロセスに一致します。Helm 3.14+ と OpenTelemetry Operator v0.142.0+ が必要です。古いバージョンの場合は、まず `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml` で Operator をアップグレードしてください。古い Operator で既に eBPF を有効にしていた場合は、`--force`（Helm 4 では `--force-replace`）を付けてコマンドを再実行してください。上のインストールコマンドを再実行するとリリースがリセットされ eBPF が無効になるため、その後このコマンドを再度実行してください。`openobserve-collector` 名前空間は特権 Pod を許可している必要があり、ノードは amd64 または arm64 上の Linux で、カーネル 5.8+（または eBPF バックポートを含む RHEL 系 4.18）と BTF が必要です。既に独自にトレースを送信しているアプリや、Go の `inject-go` サイドカーを使用している Pod は選択しないでください。",
       "k8sEbpfVariant": "eBPF（全言語対応、コード変更不要）",
       "k8sLibrariesVariant": "言語ライブラリ（自動インストルメンテーション）",
+      "k8sNetworkFlowsDesc": "コレクターの eBPF DaemonSet は、各 Linux ノード上で**任意の TCP または UDP プロトコルを介してワークロード間で送信されるバイト数**を記録します。これには、トレースされていないデータベース、キャッシュ、その他のサービスも含まれます。これらは `obi_network_flow_bytes` メトリクスとして到着し、送信元と宛先のオーナー（Deployment、StatefulSet、Node、…）および名前空間でラベル付けされます。eBPF トレースの有無にかかわらず動作します。",
+      "k8sNetworkFlowsNote": "Helm 3.14+ と OpenTelemetry operator v0.142.0+ が必要です。`openobserve-collector` 名前空間は特権 Pod を許可する必要があり、ノードは amd64 または arm64 上で、カーネル 5.8+（または eBPF バックポートを適用した RHEL 系 4.18）と BTF を備えた Linux を実行している必要があります。eBPF Pod はホストネットワーク上で動作し、コレクター自身のメトリクスは各ノードの `127.0.0.1:8888` で待ち受けるため、そのポートは各ノードで空いている必要があります。既に設定した eBPF トレースセレクターは保持されます。上記のインストールコマンドを再実行するとリリースがリセットされ、これがオフになるため、その後でこのコマンドを再度実行してください。同じバイトが複数回報告されることがあります。ノード間のトラフィックは両方のノードによって報告され、Service への接続は Service とその背後のワークロードの両方に対して報告されます。eBPF ネットワークフローガイドでは、二重カウントせずにそれらをクエリする方法を説明しています。",
+      "k8sNetworkFlowsTitle": "どのワークロードが相互に通信しているかを確認: eBPF ネットワークフロー",
       "k8sInstallerNote": "これにより、cert-manager、OpenTelemetryオペレーター、OpenObserveコレクターが自動的にインストールされます。",
       "k8sInternalEndpointNote": "OpenObserveがこの同じクラスター内で実行される場合にこれを使用してください — トラフィックはクラスター外に出ることはありません。",
       "k8sTroubleAnnotationA": "インジェクションはポッド作成時に行われるため、既存のポッドは再起動するまで影響を受けません — `kubectl rollout restart deployment -n my-namespace`を実行してください。アノテーションが適用されたことを`kubectl get ns my-namespace -o yaml`で確認し、値が`openobserve-collector/openobserve-<language>`と一致することを確認してください。",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "アドミッションウェブフックに関するエラーでインストールが失敗します",
       "linuxAgentFixBody": "インストーラーはエージェントをsystemdサービスとして起動します。何も届かない場合は、実行されていることを確認し、認証または接続エラーがないかログを確認してください：",
       "linuxTracesNote": "トレースは eBPF で取得されます。コード変更や SDK は不要です。ポート、実行ファイルパス、コマンドラインのいずれかに一致するプロセスがトレースされます。glob には `,`、`{'{'}`、`{'}'}` を含めることはできません。トレースには BTF を備えた Linux 5.8+（または eBPF バックポートを含む RHEL 系 4.18）が必要で、その場合エージェントは root として実行されます。ホストがトレースできない場合、インストールは停止し、実行中のエージェントは変更されません。トレースを有効にした状態でエージェントの起動に失敗した場合、トレースは無効化され、ログとメトリクスも無効になります。**ログとメトリクス**コマンドを再実行するか、原因を修正してトレース付きで再実行するまで、この状態が続きます。トレース対象のアプリは、送信するプレーンテキスト HTTP リクエストに W3C `traceparent` ヘッダーを追加します。以下の eBPF トレースガイドでは、HTTPS とフラグの繰り返し指定について説明しています。",
+      "linuxNetworkFlowsDesc": "インストーラーを `--network-flows` 付きで実行すると、**このホストが任意の TCP または UDP プロトコルを介して送受信するバイト数**を `obi_network_flow_bytes` メトリクスとして報告します。各フローは、一覧に指定したネットワークで `src_cidr` および `dst_cidr` のラベルが付けられるため、すべてのホストに同じリストを指定してください。ホストごとに 1 つの `/32` エントリを指定すると、ホスト間マップが得られます。",
+      "linuxNetworkFlowsNote": "Linux 5.8+（または eBPF バックポートを適用した RHEL 系 4.18）と BTF が必要です。その後、エージェントは root として実行されます。トレーシングの有無にかかわらず動作しますが、インストーラーを実行するたびにエージェントの設定が置き換えられます。トレーシングを有効に保つには、**ログ、メトリクス、eBPF トレース** コマンドの `--trace-*` および `--service-name` フラグを追加してください。ホストが eBPF を実行できない場合、インストールは停止し、実行中のエージェントには手を加えません。その後ネットワークキャプチャの開始に失敗すると、**ログ & メトリクス** コマンドを再実行するか、原因を修正して `--network-flows` を付けて再実行するまで、エージェントは無効になります（ログとメトリクスも同様）。エージェントを実行している 2 台のホスト間のトラフィックはそれぞれのホストによって報告され、ループバックトラフィックは両端のアドレスが同じでない限りカウントされます。以下の eBPF ネットワークフローガイドでは、ラベルと、二重カウントせずにそれらをクエリする方法を説明しています。",
+      "linuxNetworkFlowsTitle": "どのホストが相互に通信しているかを確認: eBPF ネットワークフロー",
       "linuxTracesVerifyNote": "トレースを有効にした場合、トレース対象のアプリがリクエストを処理するとトレースが表示されます。",
+      "ebpfNetworkFlowsGuideLink": "eBPF ネットワークフローガイド",
       "ebpfTracingGuideLink": "eBPF トレースガイド",
       "logsMetricsTracesVariant": "ログ、メトリクス、eBPF トレース",
       "logsMetricsVariant": "ログとメトリクス",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "任意の OpenTelemetry エクスポーターを OpenObserve に向けます — コレクターまたは SDK、HTTP または gRPC。エンドポイントとトークンは下に入力されています。",
       "taglineWindows": "任意の Windows ホストに OpenObserve エージェントをインストールします — イベントログ、パフォーマンスカウンター、ホストメトリクスを収集します。",
       "testAgain": "再テスト",
+      "networkFlowsHelp": "CIDR または CIDR=NAME のエントリを、スペースなしのカンマ区切りで指定します。各 CIDR にはプレフィックス長が必要です（例: 10.0.1.5/32）。名前には英字、数字、.、_、- のみ使用できます。どのエントリにも一致しないアドレスはラベルなしのままになります。0.0.0.0/0=other は残りの IPv4 に名前を付け、::/0=other6 は残りの IPv6 に名前を付けます。",
+      "networkFlowsLabel": "ラベルを付けるネットワーク",
+      "networkFlowsRequired": "少なくとも 1 つのネットワークを指定してください。フローには、指定したネットワークでラベルが付けられます。",
       "traceCmdHelp": "Python、Node.js、Java のアプリ向けです。",
       "traceCmdLabel": "コマンドライン",
       "traceExeLabel": "実行ファイルのパス",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "次の値未満のセルを非表示",
     "heatmapHideBelowTooltip": "これより小さい値のセルは空白になります。",
     "heatmapHideBelowNote": "{value} 未満のセルは非表示です",
+    "boxplotWhisker": "ひげ",
+    "boxplotWhiskerMinMax": "最小から最大",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "メッセージフィールド",
+    "logsLevelField": "レベルフィールド",
+    "logsTimeField": "時刻フィールド",
+    "htmlPanelFieldTooltip": "空のままにすると、クエリ結果から列を検出します",
+    "logsOrder": "並び順",
+    "logsOrderNewest": "新しい順",
+    "logsOrderOldest": "古い順",
+    "logsOrderTooltip": "クエリが返す行の並び順です。変更していない初期クエリもこの順で取得するため、古い順では最も古いログが表示されます。",
+    "logsShowTime": "時刻を表示",
+    "logsWrap": "行を折り返す",
+    "logsPrettifyJson": "JSON を整形",
     "distributionBucketCount": "バケット数",
     "distributionBucketSize": "バケットサイズ",
     "distributionBucketSizeTooltip": "フィールドの単位での各バケットの幅。設定するとバケット数の代わりに使われます。",
@@ -7822,6 +8145,8 @@
       "gauge": "ゲージ",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "箱ひげ図",
+      "logs": "ログ",
       "barGauge": "バーゲージ",
       "distribution": "分布",
       "treemap": "ツリーマップ",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: 位置 {index} に必須引数がありません",
       "fieldNotAllowedForMetric": "Metricチャートでは {label} フィールドは許可されていません",
       "rawValueSampled": "最初の {count} 行に基づく",
+      "addAtMostOneFieldFor": "{label} には最大 1 つのフィールドを追加してください",
+      "boxplotMin": "最小",
+      "boxplotMax": "最大",
+      "boxplotLowerWhisker": "下側のひげ",
+      "boxplotUpperWhisker": "上側のひげ",
+      "boxplotMedian": "中央値",
+      "boxplotSamples": "サンプル数",
+      "boxplotOutlier": "外れ値",
       "fieldNotAllowedForDistribution": "{label} フィールドは分布チャートでは使用できません",
       "distributionCount": "件数",
       "addAtLeastOneFieldFor": "{label} のフィールドを少なくとも1つ追加してください",
@@ -8525,6 +8858,8 @@
       "urlHidden": "アクセス権なし",
       "urlHiddenHint": "このリンクのダッシュボードを閲覧できないため、公開 URL は表示されません。",
       "orgDisabledHint": "この組織では公開リンクが無効になっています",
+      "orgDisabledBanner": "この組織ではパブリックリンクが無効になっているため、リンクは提供されません。管理者は再度有効にできます。",
+      "disabledPaused": "無効 · 一時停止",
       "takeOver": "引き継ぐ",
       "takeOverTitle": "このリンクを引き継ぎますか？",
       "takeOverBody": "あなたが公開者になります。公開ページには、あなたが閲覧を許可されている内容が表示されます。これまでより多くなることも少なくなることもあります。URL を知っている人は引き続きアクセスでき、リンクはすぐに公開状態になります。",
@@ -8784,6 +9119,7 @@
     "wellGroup": "グループ",
     "wellSubgroup": "サブグループ",
     "wellSize": "サイズ",
+    "wellCategory": "カテゴリ",
     "value": "値"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "トリガー値を観測された定常状態から遠ざけます。",
       "lengthenEvaluationWindow": "評価ウィンドウを延長する",
       "lengthenEvaluationWindowDesc": "短時間のスパイクでアラートが作動しないよう、期間を広げます。",
-      "enableDeduplication": "重複排除を有効にする",
-      "enableDeduplicationDesc": "重複排除ウィンドウ内の繰り返し発火をまとめます。",
+      "enableDeduplication": "繰り返し通知の抑制をオンにする",
+      "enableDeduplicationDesc": "評価ごとではなく、状態変化ごとに1回通知します。",
       "reviewForDeletion": "削除を検討",
       "reviewForDeletionDesc": "アラートを廃止する前に、クエリが現状と一致しているか確認します。",
       "fixAlertQuery": "アラートクエリを修正",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "組織ID",
     "alertCreationTitle": "アラートの作成",
     "noAlertsFound": "アラートが見つかりません",
-    "suppressedByDeduplication": "重複排除により抑制されました",
-    "occurrence": "{count} 件 | {count} 件",
     "groupedNotification": "グループ化された通知",
     "alertsBatchedTogether": "アラートが一括でバッチ処理されました",
-    "notificationSent": "通知が送信されました",
-    "occurrencesDeduplicated": "重複排除された発生",
     "alertExecutionDetails": "アラート実行の詳細",
     "evaluationTime": "評価時間",
     "queryTime": "クエリ時間",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "終了: {time}",
     "serviceGraphTooltipTemporalCorrelation": "時間的相関",
     "serviceGraphTooltipServiceDependency": "サービス依存関係",
-    "totalAlerts": "合計アラート",
-    "usingDeduplication": "重複排除を使用中",
-    "deduplicationConfiguredTooltip": "重複排除が設定されたアラート",
-    "suppressionRate24h": "抑制率（24h）",
     "suppressed": "抑制済み /",
-    "total": "合計",
-    "passedLabel": "成功:",
-    "pendingBatches": "保留中のバッチ",
-    "pendingBatchesTooltip": "グループ化待ちのアラート",
     "historyTimeline": {
       "firing": "発火中",
       "ok": "OK",
@@ -10089,7 +10413,8 @@
     "endTime": "終了時刻",
     "duration": "期間",
     "retries": "再試行",
-    "dedup": "重複排除",
+    "suppression": "抑制",
+    "suppressedAsRepeat": "繰り返し通知として抑制",
     "validation": {
       "streamTypeRequired": "ストリームタイプは必須です。",
       "streamNameRequired": "ストリーム名は必須です。",
@@ -10281,15 +10606,6 @@
     "all": "すべて",
     "history": "アラート履歴",
     "searcHistory": "アラート名を入力",
-    "deduplication": {
-      "fingerprintFields": "類似アラートのグループ化基準",
-      "fingerprintFieldsHint": "アラートを類似とみなすためのフィールドを選択します（例: hostname、service）。空のままにすると、クエリに基づいて自動検出されます。",
-      "fingerprintFieldsTooltip": "アラートが重複とみなされるために一致する必要があるフィールドを選択します。たとえば 'hostname' を選択すると、同じホストからのアラートがまとめてグループ化されます。異なるアラートタイプ（例: High CPU と High Memory）は、同じホストからのものであってもグループ化されません。空のままにすると、クエリタイプに基づいて自動検出されます。",
-      "timeWindow": "同一とみなす期間",
-      "timeWindowHint": "類似アラートをグループ化する期間。空のままにすると、チェック間隔に合わせます。",
-      "timeWindowTooltip": "グループ化のために最近のアラートを記憶しておく期間。この期間内に類似のアラートが発生した場合、再送信されません。空のままにすると、アラートのチェック間隔が使用されます。",
-      "fingerprintFieldsHelp": "空のままにすると、クエリに基づいて自動検出されます（SQL: GROUP BY列、PromQL: ラベル、カスタム: 条件フィールド）"
-    },
     "summary": {
       "scrollToBottom": "最下部までスクロール",
       "title": "サマリー",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "設定した条件が満たされたら通知を受け取る"
       }
     },
-    "correlation": {
-      "title": "アラート相関",
-      "description": "組織全体でアラートを相互に関連付けて重複排除する方法を設定します。フィンガープリント値が一致するアラートは 1 つのグループにまとめられます。",
-      "semanticFieldNote": "注:セマンティックフィールドマッピングは、サービス ID タブで設定されます。",
-      "enableOrgLevel": "組織レベルの重複排除を有効にする",
-      "enableOrgLevelTooltip": "この組織のすべてのアラートで重複排除機能と相関機能を有効にする",
-      "enableCrossAlert": "クロスアラート重複排除を有効にする",
-      "enableCrossAlertTooltip": "異なるアラートが同じフィンガープリントを共有している場合に相互に重複排除を許可する",
-      "fingerprintGroups": "クロスアラートフィンガープリントグループ",
-      "fingerprintGroupsTooltip": "クロスアラートフィンガープリンティングに使用するセマンティックグループを選択します。これらのディメンションで同じ値を共有するアラートは重複排除されます。",
-      "fingerprintGroupsHint": "クロスアラート重複排除の対象となるセマンティックグループを少なくとも 1 つ選択してください",
-      "fingerprintGroupsRequired": "少なくとも 1 つのセマンティックグループを選択する必要があります",
-      "defaultWindow": "デフォルト相関ウィンドウ (分)",
-      "defaultWindowTooltip": "セマンティックフィールドが一致しない場合、特定の期間のアラートとデータは関連していると見なされます",
-      "defaultWindowDescription": "セマンティックフィールドが一致しない場合、特定の期間のアラートとデータは関連していると見なされます",
-      "defaultWindowPlaceholder": "アラート期間をデフォルトで使用",
-      "cancelButton": "キャンセル",
-      "saveButton": "保存",
-      "settingsSaved": "組織の重複排除設定が正常に保存されました",
-      "settingsSaveError": "設定の保存に失敗しました"
-    },
     "placeholders": {
       "typeSomething": "何かを入力してください",
       "value": "値",
       "selectColumn": "列を選択",
       "savedFunctions": "保存済み関数",
-      "autoUsesCheckInterval": "自動 (チェック間隔を使用)",
       "addTag": "タグを追加してEnterを押してください"
     },
     "steps": {
       "compareWithPast": "過去と比較",
-      "deduplication": "重複排除",
       "advanced": "上級者向け"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "アラートをトリガーするもの",
       "compareWithPast": "現在の結果を別の期間のデータと比較する",
       "alertSettings": "アラートルールを設定し、通知方法を選択します。",
-      "deduplication": "類似のアラートをグループ化して、同じアラートを複数回送信しないようにします。",
       "advanced": "コンテキスト変数、説明、行テンプレート"
     },
     "failedToFetchHistory": "アラート履歴を取得できませんでした",
@@ -10399,8 +10691,6 @@
         "closeActions": "アクションを閉じる",
         "viewAlertHistory": "アラート履歴を表示",
         "actionsFor": "アクション対象:",
-        "configureDedup": "重複排除の設定",
-        "configureDedupTooltip": "このアラートの重複排除を設定",
         "editAlert": "アラートを編集",
         "editAlertTooltip": "アラート設定の編集",
         "viewHistory": "履歴を表示",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "新しい「解決済み」メッセージ",
       "keepFiringFor": "発火継続時間",
       "keepFiringForTooltip": "条件が解消してから復旧するまで、この時間だけ待機します。0 にすると即座に復旧します。",
+      "suppressRepeats": "繰り返し通知を抑制",
+      "suppressRepeatsTooltip": "アラートが発火し始めたときやレベルが変わったときに1回だけ通知し、評価ごとには通知しません。オフのままにすると、サイレンス期間の経過ごとにリマインダーを受け取り続けます。",
       "keepFiringForInvalid": "0 以上の秒数を入力してください",
       "keepFiringForTooLong": "最大 86400 秒（24 時間）を入力してください"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "このメールアドレスはすでに追加されています",
     "confirmRemoveEmail": "{email} メールアドレスを削除してもよろしいですか？",
     "domainNeedsEmails": "すべてのユーザーを許可しない場合は、ドメイン '{domain}' には少なくとも 1 つのメールアドレスが必要です",
+    "noAllowedEmailsDenyAll": "許可されたメールアドレスがまだないため、{domain} のすべてのユーザーが拒否されます。",
     "domainSettingsSaved": "ドメイン設定は正常に保存されました",
     "errorSavingDomainSettings": "ドメイン設定を保存中にエラーが発生しました",
     "noDomainMessage": "ドメインが設定されていません。上記にドメインを追加してアクセスを制限してください。",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "保存する前に、少なくとも1つのアイデンティティセットを構成してください。",
       "discoveredServicesTab": "検出されたサービス",
       "serviceDiscoveryTab": "検出ルール",
-      "alertCorrelationTab": "アラート相関",
       "fieldAliasesTab": "フィールドマッピング",
       "fieldAliasesSaved": "フィールドエイリアスが正常に保存されました",
       "fieldAliasesSaveError": "フィールドエイリアスの保存に失敗しました",
@@ -14079,27 +14371,144 @@
     "runsIn": "実行環境",
     "recommendedByFieldCoverage": "ストリームのフィールドカバレッジに基づく推奨です。",
     "listConjunctionAndTwo": "{first} と {last}",
-    "domainOrgMappings": {
-      "title": "ドメインと組織のマッピング",
-      "subtitle": "一致するメールドメインでサインインした新規ユーザーは、自動的に組織に追加されます。",
+    "orgDomainMapping": {
+      "tabLabel": "ドメイン管理",
+      "tabDesc": "メールドメインをリンクし、そのユーザーを組織にマッピングし、参加できるユーザーを制御します。",
+      "loadFailed": "組織の設定を読み込めませんでした",
       "addMapping": "マッピングを追加",
       "editMapping": "マッピングを編集",
-      "empty": "マッピングはまだありません。「{addLabel}」を使用して追加してください。",
       "domain": "メールドメイン",
-      "domainHelp": "ユーザーのメールアドレスで {at_sign} より後の部分。",
+      "domainHelp": "ユーザーのメールアドレスの {at_sign} より後の部分です。ドメインはこの組織にリンクされ、DNS で検証する必要があります。",
+      "domainHelpRequest": "ユーザーのメールアドレスの {at_sign} より後の部分です。OpenObserve がリクエストを承認すると、このドメインがこの組織にリンクされます。",
       "organization": "組織",
-      "organizationPlaceholder": "組織識別子",
-      "organizationHelp": "一致するユーザーが追加される組織の識別子。",
+      "organizationHelp": "この組織またはその請求グループのメンバーのいずれか。",
       "organizationRequired": "組織は必須です",
-      "baseRole": "基本ロール",
-      "baseRoleHelp": "一致するユーザーがその組織で付与されるロール。",
+      "baseRole": "ベースロール",
+      "baseRoleHelp": "ユーザーがその組織に追加されるときに付与されるロールです。既存のメンバーは現在のロールを保持します。",
       "roleClaimName": "ロールクレーム",
       "roleClaimNamePlaceholder": "クレーム名（例: groups）",
-      "roleClaimNameHelp": "任意。ユーザーのカスタムロールを列挙するトークンクレーム。ログインのたびに、その組織でのカスタムロールがこれに同期されます。",
-      "createMissingRoles": "組織に存在しないクレーム内のロールを作成する",
-      "duplicateDomain": "このドメインのマッピングはすでに存在します",
-      "confirmRemove": "{name} のマッピングを削除してもよろしいですか？",
-      "deleteTitle": "マッピングを削除"
+      "roleClaimNameHelp": "任意。ユーザーのカスタムロールを列挙する SSO トークンのクレームです。SSO サインインのたびに、その組織でのカスタムロールはクレームされたロールに置き換えられます。存在しないクレームされたロールは、作成されない限りスキップされます。",
+      "createMissingRoles": "組織に存在しないクレームされたロールを作成する",
+      "verifyNow": "今すぐ検証",
+      "details": "詳細",
+      "detailsDialogTitle": "{domain} のリンク詳細",
+      "approvedLinkInfo": "リンクリクエスト後、OpenObserve によりリンクされました。DNS レコードは不要です。",
+      "pendingRequestInfo": "OpenObserve がこのリクエストを確認中です。承認されるまで必要な操作はありません。",
+      "rejectedRequestInfo": "OpenObserve はこのリクエストを却下しました。",
+      "verifyDialogTitle": "{domain} を確認",
+      "recordDialogTitle": "{domain} の DNS レコード",
+      "lastCheckFailed": "前回の確認に失敗しました: {reason}",
+      "state": {
+        "pending": "保留中",
+        "verified": "確認済み",
+        "failed": "失敗",
+        "requested": "承認待ち",
+        "approved": "承認済み",
+        "rejected": "却下済み"
+      },
+      "saved": "ドメインマッピングを保存しました",
+      "saveFailed": "設定の保存に失敗しました",
+      "linkFailed": "ドメインのリンクに失敗しました",
+      "unlinkFailed": "ドメインのリンク解除に失敗しました",
+      "verifyFailed": "確認に失敗しました",
+      "deleted": "マッピングを削除しました",
+      "deleteTitle": "マッピングを削除しますか？",
+      "deleteMappingBody": "サインイン時に {domain} のユーザーが {org} に追加されなくなります。",
+      "recordInstructions": "DNS プロバイダーで次の DNS TXT レコードを追加してください:",
+      "txtNameLabel": "レコード名",
+      "txtValueLabel": "レコード値",
+      "copyTxtName": "レコード名をコピー",
+      "copyTxtValue": "レコード値をコピー",
+      "txtNameCopied": "レコード名をコピーしました",
+      "txtValueCopied": "レコード値をコピーしました",
+      "verifyHint": "確認は {minutes} 分ごとに自動実行されます。今すぐ確認することもできます。",
+      "alreadyLinked": "このドメインはすでにこの組織にリンクされています",
+      "failureReason": {
+        "recordMissing": "TXT レコードが見つかりません",
+        "valueMismatch": "TXT レコードは見つかりましたが、値が一致しません",
+        "dnsFailed": "DNS 解決に失敗しました"
+      },
+      "pageSubtitle": "メールドメインをリンクし、そのユーザーを組織にマッピングして、参加できるユーザーを制御します。",
+      "linkedTab": "リンク済みドメイン",
+      "mappingsTab": "マッピング",
+      "accessTab": "ブロック済みユーザー",
+      "requestsTab": "リンクリクエスト",
+      "linkDomain": "ドメインをリンク",
+      "sendRequest": "リクエストを送信",
+      "linkMethod": "所有権の証明方法",
+      "method": {
+        "dns": "DNS レコード",
+        "approved": "承認済みリクエスト",
+        "request": "リンクリクエスト",
+        "dnsTitle": "DNS TXT レコードを追加",
+        "dnsDesc": "レコードが公開されると自動的に確認されます。ドメインの DNS を管理している場合に最適です。",
+        "requestTitle": "OpenObserve にリンクをリクエスト",
+        "requestDesc": "チームがリクエストを確認し、承認後にドメインをリンクします。"
+      },
+      "searchDomains": "ドメインを検索",
+      "searchMappings": "ドメインまたは組織で検索",
+      "searchRequests": "ドメイン、組織、またはリクエスト元で検索",
+      "status": "ステータス",
+      "linkedVia": "連携方法",
+      "lastChecked": "最終確認",
+      "linked": "ドメインをリンクしました。DNS レコードを追加して検証してください。",
+      "verified": "ドメインを検証しました",
+      "notVerifiedYet": "DNS レコードはまだ見つかりません。反映には時間がかかることがあります。",
+      "requestSent": "リンクリクエストを送信しました",
+      "requestFailed": "リンクリクエストの送信に失敗しました",
+      "keepRecordHint": "このレコードはそのまま保持してください。所有権は {minutes} 分ごとに再確認されます。レコードが {grace} 分を超えて見つからない場合、ドメインは失敗としてマークされ、そのマッピングは適用されなくなります。",
+      "removeDomain": "ドメインを削除",
+      "removeTitle": "ドメインを削除しますか？",
+      "removeBody": "{domain} はこの組織からリンク解除されます。",
+      "removeWithMappingsBody": "{domain} はこの組織からリンク解除され、{count} 件のマッピングが削除されます。 | {domain} はこの組織からリンク解除され、{count} 件のマッピングが削除されます。",
+      "removed": "ドメインを削除しました",
+      "domainRequired": "ドメインは必須です",
+      "mappingDomainHelp": "マッピングできるのは検証済みのドメインのみです。",
+      "createsRoles": "ロールを作成",
+      "duplicateMapping": "このドメインはすでにその組織にマッピングされています",
+      "domainNotVerified": "未検証",
+      "noVerifiedDomains": "マッピングは検証済みのドメインに適用されます。先にドメインをリンクして検証してください。",
+      "goToLinked": "ドメインをリンク",
+      "goToLinkedDesc": "所有するドメインを検証してから、そのユーザーをマッピングしてください",
+      "enforceTitle": "他の組織からユーザーを削除",
+      "enforceDesc": "マッピングされたドメインのユーザーが SSO でサインインすると、この組織とその請求グループ以外のすべての組織から削除されます。",
+      "enforceConfirmTitle": "他の組織からユーザーを削除しますか？",
+      "enforceConfirmBody": "メールドメインがここでマッピングされているユーザーが SSO でサインインするたびに、この組織およびその請求グループに属さないすべての組織（個人の組織を含む）から削除されます。",
+      "enforceConfirmAction": "オンにする",
+      "enforceSaved": "設定を保存しました",
+      "blockUsers": "ユーザーをブロック",
+      "editBlockedUsers": "ブロックしたユーザーを編集",
+      "block": "ブロック",
+      "blockedCount": "{count} 件ブロック中 | {count} 件ブロック中",
+      "blockedEmails": "ブロックしたメール",
+      "blocklistDomainHelp": "この組織の検証済みドメインのいずれかです。",
+      "blocklistEmailsHelp": "これらのユーザーは SSO 経由でこの組織やその請求グループのメンバーになることはできず、次回のサインイン時にそこから削除されます。",
+      "ruleBlockedRequired": "ブロックするメールを1つ以上追加してください",
+      "noDomainForBlocklist": "すべての検証済みドメインにブロック済みユーザーが設定されています。変更するには該当する行を編集してください。",
+      "unblockAll": "すべてブロック解除",
+      "unblockAllTitle": "すべてのユーザーをブロック解除しますか？",
+      "unblockAllBody": "{domain} のブロック済みユーザーは、次回の SSO サインイン時に再び参加できるようになります。",
+      "blocklistSaved": "ブロックしたユーザーを保存しました",
+      "blocklistDeleted": "ユーザーのブロックを解除しました",
+      "blocklistSection": "ドメイン別のブロック済みユーザー",
+      "filterPending": "保留中",
+      "filterAll": "すべて",
+      "requestedBy": "リクエスト元",
+      "requestedAt": "リクエスト日時",
+      "verifiedAt": "検証済み",
+      "answeredBy": "回答者",
+      "reason": "理由",
+      "reasonHelp": "リクエストを送信した組織に表示されます。",
+      "reasonRequired": "リクエストを拒否するには理由が必要です",
+      "approve": "承認",
+      "reject": "拒否",
+      "approveTitle": "リンクリクエストを承認しますか？",
+      "rejectTitle": "リンクリクエストを拒否しますか？",
+      "approveBody": "{domain} は DNS チェックなしで {org} にリンクされます。",
+      "rejectBody": "{org} は {domain} を取得しません。",
+      "requestApproved": "{domain} をリンクしました",
+      "requestRejected": "{domain} のリクエストを拒否しました",
+      "decisionFailed": "リクエストの更新に失敗しました"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "検出タイミングのオプションを選択してください"
   },
   "search_history": {
-    "title": "検索履歴",
+    "title": "使用量とコストの履歴",
     "get_history": "履歴を取得",
     "executed_at": "実行日",
     "sql_query": "SQL クエリ",
-    "delayMessage": "検索履歴は次の理由で遅延する可能性があります"
+    "delayMessage": "使用量とコストの履歴は遅延する可能性があります"
   },
   "correlation": {
     "unstableDimensionNote": "不安定なディメンション - ポッド再起動時に変更されます。デフォルト: すべての値。",
@@ -18784,7 +19193,9 @@
     "dataFresh": "データは新鮮",
     "dataGettingStale": "データが古くなっている",
     "dataStale": "データが古い",
-    "lastRefreshed": "最終更新: {time}"
+    "lastRefreshed": "最終更新: {time}",
+    "refresh": "更新",
+    "refreshWithAge": "更新、最終更新 {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "プローブエラー"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "クリック",
       "actionType": "タイプ",
       "all": "すべて",
@@ -19868,6 +20280,13 @@
       "attemptN": "試行 {n}",
       "detailAction": "アクション",
       "detailSelector": "セレクタ",
+      "detailStepId": "ステップ ID",
+      "detailTargetUrl": "ターゲット URL",
+      "detailStatus": "ステータス",
+      "detailSkipReason": "スキップ理由",
+      "stepStatusSkipped": "スキップ",
+      "stepStatusUnknown": "不明",
+      "skippedCount": "{n} 件スキップ",
       "downloadTrace": "{filename}をダウンロード",
       "errorFullscreenTitle": "ステップ {id}: {action} - エラー",
       "failedAtStartLoad": "開始 URL を開けませんでした",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "最大 {max}。再試行は同じジョブ内で実行されるため、シーケンス全体がチェック予算内に収まる必要があります。",
       "retriesMaxBrowserHint": "ブラウザチェックの最大値は {max} です。各試行はすべてのデバイスでジャーニーを再実行するため、これ以上増やすとプローブのタイムアウトを超え、サイトには実際にはなかった障害が報告されます。",
       "retryDelay": "お待ちください",
-      "retryDelaySuffix": "再試行の間隔はミリ秒です。",
+      "retryDelaySuffix": "再試行の間隔（秒）。",
       "schedule": "スケジュール",
       "scheduleLater": "後でスケジュールする",
       "scheduleLaterTooltip": "チェックを有効にする将来の日付と時刻を選択してください。",
@@ -20241,6 +20660,8 @@
         "restartConfig": "再起動設定 — このエージェントのセットアップコマンドをコピーして、インストール / Docker 再起動を再実行します (例: トークンローテーション後)",
         "noAgents": "このロケーションにまだエージェントが登録されていません。",
         "agentsUnavailable": "このロケーションのエージェントは別のクラスターに登録されているため、ここでは表示されません。",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "このロケーションから実行されるチェック",
         "checkName": "名前",
         "noChecks": "このロケーションにまだチェックが割り当てられていません。",
@@ -20546,7 +20967,7 @@
       "nodes": "ノード",
       "modelPricing": "モデル価格",
       "searchSchedulers": "検索スケジューラー",
-      "searchHistory": "検索履歴",
+      "searchHistory": "使用量とコストの履歴",
       "sessions": "セッション",
       "evalTemplates": "オンライン評価 — テンプレート",
       "scorers": "オンライン評価 — スコアラー",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "リストを更新",
       "alertTemplatesAdd": "新しいテンプレートを追加",
       "alertTemplatesRefresh": "リストを更新",
-      "logsSearchHistory": "検索履歴を開く",
+      "logsSearchHistory": "使用量とコストの履歴を開く",
       "alertsImport": "アラートをインポート",
       "panelEditorRun": "クエリの実行/適用",
       "panelEditorSave": "保存して編集を続ける",
@@ -21131,6 +21552,7 @@
         "system": "システム"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "稼働中",
         "passed": "成功",
         "healthy": "正常",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "アラートへの移動に失敗しました",
       "alertNotFound": "アラートが見つかりません",
-      "alertNotFoundInAlerts": "アラート \"{name}\" は {count} 件のアラート内に見つかりません",
       "failedToLoadAlerts": "アラートの読み込みに失敗しました",
       "alertsDeletedSuccessfully": "{count} 件のアラートが正常に削除されました | {count} 件のアラートが正常に削除されました",
       "failedToDeleteAlerts": "{count} 件のアラートの削除に失敗しました | {count} 件のアラートの削除に失敗しました",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "テンプレートを読み込んでいます。お待ちください...",
       "alertSavedSuccessfully": "アラートが正常に保存されました。",
       "alertUpdatedSuccessfully": "アラートが正常に更新されました。",
-      "openingDedupConfig": "重複排除設定を開いています: {name}",
       "editingAlert": "アラートを編集中: {name}",
       "ack": {
         "acked": "{name} を確認応答しました",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "モデル価格エディター",
     "storageSettings": "ストレージ設定",
     "domainManagement": "ドメイン管理",
+    "orgDomainMapping": "ドメイン管理",
     "slackApp": "Slack",
     "regexPatterns": "正規表現パターン",
     "syntheticsLocations": "合成モニタリングのロケーション",
@@ -26099,7 +26520,7 @@
       "logged": "記録済み"
     },
     "policy": {
-      "gateHint": "既存のアラートへの変更のうち、単独で適用されるのは重複排除のみで、以前の状態のスナップショットとレビュー期間が付きます。チェックに合格すれば保持され、失敗すればロールバックされます。それ以外はすべてワンクリック承認を待ちます。",
+      "gateHint": "既存アラートへの変更のうち、繰り返し通知の抑制をオンにする変更だけは、変更前の状態スナップショットとレビュー期間を伴って自動的に適用されます。チェックに合格すれば維持され、失敗すればロールバックされます。それ以外はすべてワンクリック承認を待ちます。",
       "off": "オフ",
       "suggest": "提案",
       "auto": "自動",
@@ -26118,7 +26539,7 @@
         "gateDesc": "調査が完了するまで最大2分間、呼び出しを保留します。フェイルオープン: トリアージがタイムアウトまたは失敗した場合は、そのまま呼び出し、調査がまだ実行中または失敗したことを伝え、原因はスレッドで続きます。"
       },
       "classes": {
-        "EnableDeduplication": "数分以内に繰り返すアラートの重複排除を有効にします。",
+        "EnableDeduplication": "評価ごとに通知するアラートの繰り返し通知の抑制をオンにします。",
         "CreateDetector": "サービスのリクエスト、エラー、レイテンシに対して異常検知を作成します。",
         "RaiseThreshold": "正常な日にも発火するしきい値を引き上げます。",
         "LengthenEvaluationWindow": "フラップするアラートの評価ウィンドウを延長します。",
@@ -26667,10 +27088,10 @@
           "on": "接続アラート"
         },
         "L-302": {
-          "done": "checkout レイテンシの 3 つのアラートを 1 つにグループ化しました",
-          "why": "94% の確率で同時に発火していたため、1 回の遅延で 3 回呼び出されていました。",
-          "from": "3 アラート",
-          "to": "1",
+          "done": "チェックアウトのレイテンシに関する3件のアラートで繰り返し通知の抑制をオンにしました",
+          "why": "発火し続けている間、評価のたびに通知していたため、1回の遅延で120回呼び出しが発生しました。",
+          "from": "評価ごと",
+          "to": "変化ごとに1回",
           "on": "checkout レイテンシ"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "チェックアウトの支払い失敗についてオンコールを呼び出しました。",
         "recsHeld": "レコメンデーションの軽微な問題は、金曜のサマリーまで保留しました。",
         "diskApproved": "ingest-1 のディスクアラートを {to}% に引き上げることを承認しました。",
-        "latencyGrouped": "チェックアウトの遅延アラート3件を1つにまとめたので、1回の遅延で呼び出しは一度だけです。",
+        "latencyGrouped": "チェックアウトの遅延に関する3件のアラートで繰り返し通知の抑制をオンにしたため、1回の遅延で呼び出しは1回になりました。",
         "queueFixed": "orders のキューワーカーを追加しましたが、キューは増え続けたため元に戻し、オンコールを呼び出しました。",
         "loginPaged": "サインインの遅延についてオンコールを呼び出しました。",
         "queuePermission": "キュー ワーカーを最大8個まで自力で追加することを許可しました。",
@@ -28083,5 +28504,71 @@
       "legend": "パイプラインのステータス",
       "legendToggle": "このステータスをマップ上で表示または非表示にする"
     }
+  },
+  "recentSearches": {
+    "title": "最近の検索",
+    "aboutKeptDays": "{org} 内のあなたの検索のみが表示され、他のユーザーには見えません。{days} 日間保持されます。スターを付けた検索は削除するまで保持されます。 | {org} 内のあなたの検索のみが表示され、他のユーザーには見えません。{days} 日間保持されます。スターを付けた検索は削除するまで保持されます。",
+    "aboutKeptForever": "{org} 内のあなたの検索のみが表示され、他のユーザーには見えません。削除するまで保持されます。",
+    "pageTitle": {
+      "logs": "最近のログ検索",
+      "traces": "最近のトレース検索",
+      "metrics": "最近のメトリクス検索",
+      "dbm": "最近の検索",
+      "profiles": "最近の検索"
+    },
+    "page": {
+      "logs": "ログ",
+      "traces": "トレース",
+      "metrics": "メトリクス",
+      "dbm": "データベース",
+      "profiles": "プロファイル"
+    },
+    "allPages": "すべてのページ",
+    "viewAll": "すべて表示",
+    "failedCount": "{count} 件失敗",
+    "keyHints": "↑↓ 移動 · PgUp/PgDn クエリをスクロール · Enter 実行 · Shift+Enter 読み込みのみ · Esc 閉じる",
+    "loadToFix": "読み込んで修正",
+    "emptyTitle": "最近の検索はまだありません",
+    "loadError": "最近の検索を読み込めませんでした",
+    "retry": "再試行",
+    "warning": "警告付きで完了: タイムアウトまたは部分的な結果",
+    "failed": "失敗",
+    "ranCount": "{count} 回実行",
+    "lineCount": "{count} 行 | {count} 行",
+    "relativeWindow": "直近 {period}",
+    "rerunNow": "今すぐ再実行",
+    "rerunOriginal": "元の時刻で",
+    "loadOnly": "実行せずに読み込む",
+    "copyLink": "リンクをコピー",
+    "copyQuery": "クエリをコピー",
+    "star": "スターを付ける",
+    "unstar": "スターを外す",
+    "linkCopied": "リンクをコピーしました",
+    "queryCopied": "クエリをコピーしました",
+    "copyFunction": "関数をコピー",
+    "functionCopied": "関数をコピーしました",
+    "functionLabel": "関数 (VRL)",
+    "searchPlaceholder": "クエリとストリームを検索",
+    "allStreams": "すべてのストリーム",
+    "statusAll": "すべてのステータス",
+    "statusOk": "成功",
+    "statusError": "失敗",
+    "starredOnly": "スター付きのみ",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "実行日でフィルター",
+    "today": "今日",
+    "yesterday": "昨日",
+    "noMatch": "これらのフィルターに一致する検索はありません",
+    "reset": "すべてリセット",
+    "resetFilters": "フィルターをリセット",
+    "loadMore": "さらに読み込む",
+    "clear": "履歴をクリア",
+    "confirmClear": "履歴をクリア",
+    "clearBodyPage": "最近の {count} 件の {page} 検索を {org} から削除します。保存済みビューには影響しません。 | 最近の {count} 件の {page} 検索を {org} から削除します。保存済みビューには影響しません。",
+    "clearBodyAll": "ログ、トレース、メトリクス全体にわたり、最近の {count} 件の検索を {org} から削除します。保存済みビューには影響しません。 | ログ、トレース、メトリクス全体にわたり、最近の {count} 件の検索を {org} から削除します。保存済みビューには影響しません。",
+    "includeStarred": "スター付き検索 {count} 件も削除する | スター付き検索 {count} 件も削除する",
+    "recentRow": "最近の検索",
+    "deletedQuery": "{query} を削除しました",
+    "undo": "元に戻す"
   }
 }
diff --git a/web/src/locales/languages/ko-KR.json b/web/src/locales/languages/ko-KR.json
index 61322b7ef3..262395b1b1 100644
--- a/web/src/locales/languages/ko-KR.json
+++ b/web/src/locales/languages/ko-KR.json
@@ -486,7 +486,11 @@
       "monitors": "모니터",
       "modelPricing": "모델 가격 정의",
       "variables": "변수",
-      "experiments": "실험"
+      "experiments": "실험",
+      "linkedDomains": "연결된 도메인",
+      "domainMappings": "도메인 매핑",
+      "domainRequests": "연결 요청",
+      "blockedUsers": "차단된 사용자"
     },
     "demo": {
       "pageTitle": "빈 상태 — 검토용 전체 세트",
@@ -572,6 +576,30 @@
       "action": "새 태스크",
       "actionDesc": "OpenObserve를 엔드포인트에 연결하고 연결을 테스트하세요."
     },
+    "noLinkedDomains": {
+      "title": "아직 연결된 도메인이 없습니다",
+      "description": "소유한 이메일 도메인을 연결하여 해당 사용자를 조직에 매핑하고 로그인할 수 있는 사용자를 제어하세요.",
+      "dns": "DNS 레코드 추가",
+      "dnsDesc": "TXT 레코드로 소유권을 확인하세요",
+      "request": "연결 요청하기",
+      "requestDesc": "OpenObserve에 도메인 연결을 요청하세요"
+    },
+    "noDomainMappings": {
+      "title": "아직 도메인 매핑이 없습니다",
+      "description": "확인된 도메인으로 로그인하는 사용자를 이 조직 또는 해당 요금 청구 그룹 구성원에 자동으로 추가합니다.",
+      "action": "매핑 추가",
+      "actionDesc": "도메인, 조직, 역할을 선택하세요"
+    },
+    "noBlockedUsers": {
+      "title": "차단된 사용자가 없습니다",
+      "description": "확인된 도메인의 모든 사용자가 참여할 수 있습니다. 특정 사용자를 차단하여 참여하지 못하게 하세요.",
+      "action": "사용자 차단",
+      "actionDesc": "도메인과 차단할 이메일을 선택하세요"
+    },
+    "noDomainRequests": {
+      "title": "연결 요청이 없습니다",
+      "description": "조직에서 도메인 연결을 요청한 내역이 여기에 표시됩니다."
+    },
     "noDowntimes": {
       "title": "아직 다운타임이 없습니다",
       "description": "다운타임은 알림, 이상 탐지, Synthetics 검사가 계속 실행되도록 유지하면서 예약한 시간 동안 해당 알림 전송을 중지합니다.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "자동 실행 끄기",
     "autoRefreshWithValue": "자동 새로고침: {value}",
     "searchHistory": "검색 기록",
+    "usageCostHistory": "사용량 및 비용 기록",
     "createScheduledSearch": "예약 검색 생성",
     "listScheduledSearch": "예약 검색 목록",
     "scheduleSearchJob": "검색 작업 예약",
@@ -1355,6 +1384,8 @@
     "scanSize": "스캔 크기",
     "deltaScanSize": "델타 스캔 크기",
     "scannedSoFar": "스캔한 크기: {size}",
+    "quickModeHiddenFields": "빠른 모드가 켜져 있습니다. 이 행에는 {total}개 중 {shown}개 필드가 표시됩니다.",
+    "turnOffQuickMode": "빠른 모드 끄기",
     "resultsProgressLabel": "검색 진행률",
     "histogramTitleError": "히스토그램 제목을 생성하는 중 오류가 발생했습니다.",
     "selectLogStream": "로그 스트림 선택",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "이 보기에 대한 네트워크 데이터 없음",
     "apiEmptyDescription": "선택한 스트림에는 이 시간 범위에 리소스 또는 네트워크 요청이 없습니다. 네트워크 메트릭은 앱이 HTTP 호출을 계측하면 표시됩니다.",
     "skipInactivity": "비활성 건너뛰기",
+    "fullScreen": "전체 화면",
+    "exitFullScreen": "전체 화면 종료",
     "error": "오류",
     "errorCount": "오류 개수",
     "all": "모두",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "이 퍼널을 대시보드에 추가하려면 두 번째 단계를 추가하세요",
         "snapshot": "패널은 현재의 단계, 필터 및 명명된 이벤트 규칙을 그대로 유지합니다."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "성능 개요",
+      "filterService": "서비스",
+      "filterEnv": "환경",
+      "filterVersion": "버전",
+      "filterAll": "전체",
+      "verdictPass": "Core Web Vitals 통과",
+      "verdictFail": "Core Web Vitals 주의 필요",
+      "verdictAllPass": "모두 통과",
+      "verdictNeedWork": "{count}/{total} 개선 필요 | {count}/{total} 개선 필요",
+      "percentileLabel": "백분위",
+      "bandGood": "좋음",
+      "bandNeeds": "개선 필요",
+      "bandPoor": "나쁨",
+      "bandGoodPct": "{n}% 좋음",
+      "bandNeedsPct": "{n}% 개선 필요",
+      "bandPoorPct": "{n}% 나쁨",
+      "bandAria": "{good}% 좋음, {needs}% 개선 필요, {poor}% 나쁨",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} 빠름",
+      "deltaSlower": "{v} 느림",
+      "deltaNone": "변화 없음",
+      "deltaNoPrev": "이전 데이터 부족",
+      "kpiSessions": "세션",
+      "kpiErrorFree": "오류 없는 세션",
+      "kpiErrors": "총 오류 수",
+      "kpiUnhandled": "처리되지 않은 오류",
+      "kpiRegion": "주요 지표",
+      "sparkAria": "선택한 범위의 {label} 추세",
+      "chartTitle": "세션 및 오류",
+      "chartInterval": "버킷당",
+      "legendSessions": "세션",
+      "legendErrors": "오류",
+      "releaseMarker": "{version} 최초 확인 {time}",
+      "chartTableToggle": "데이터 테이블 표시",
+      "chartTableHide": "데이터 테이블 숨기기",
+      "chartTime": "시간",
+      "pagesTitle": "먼저 수정할 페이지",
+      "pagesHint": "영향도 순으로 정렬: 임계값을 초과한 바이탈 또는 오류가 있는 조회 비중으로 가중치를 둔 트래픽입니다. 페이지를 클릭하면 해당 세션을, 오류 수를 클릭하면 Error Tracking을 확인할 수 있습니다.",
+      "pagesColPage": "페이지",
+      "pagesColViews": "조회수",
+      "pagesColErrors": "오류",
+      "pagesColImpact": "영향도",
+      "pagesLegend": "▲ 개선 필요 · ■ 나쁨 · 표시 없음은 좋음. 조회수 {n} 미만인 페이지는 숨겨집니다.",
+      "pagesOpenSessions": "{path}의 세션 열기",
+      "pagesOpenErrors": "오류 {count}개, Error Tracking 열기 | 오류 {count}개, Error Tracking 열기",
+      "pagesImpactAria": "영향도 100점 만점에 {n}점",
+      "markNeeds": "개선 필요",
+      "markPoor": "나쁨",
+      "diffTitle": "가장 큰 차이",
+      "diffBody": "INP p75는 {inp}이며, 다른 세그먼트의 {ratio}배입니다. 조사가 필요한 상관관계일 뿐, 입증된 원인은 아닙니다.",
+      "diffNone": "이 범위에서는 다른 세그먼트보다 눈에 띄는 세그먼트가 없습니다.",
+      "diffLink": "영향받은 세션 보기",
+      "segmentLabel": "세그먼트",
+      "segBrowser": "브라우저",
+      "segDevice": "디바이스",
+      "segCountry": "국가",
+      "segInp": "INP {v}",
+      "segShare": "전체 뷰의 {n}%",
+      "segNone": "이 세그먼트에 대한 데이터가 없습니다.",
+      "releaseTitle": "릴리스 비교",
+      "releaseHint": "{cur} 대비 {prev}. 릴리스 시작은 해당 버전이 처음 확인된 시점입니다.",
+      "releaseMetric": "메트릭",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "오류 없음",
+      "releaseSessions": "세션",
+      "releaseLink": "{version}의 오류",
+      "frustrationTitle": "사용자 불만",
+      "frustrationHint": "바이탈로는 잡히지 않는 불편",
+      "rageClicks": "분노 클릭",
+      "deadClicks": "데드 클릭",
+      "stateLoading": "{panel} 로드 중…",
+      "stateEmptyTitle": "이 범위에 페이지 뷰가 없습니다",
+      "stateEmptyBody": "시간 범위를 넓히거나 필터를 지우거나, 브라우저 SDK가 뷰 이벤트를 보내고 있는지 확인하세요.",
+      "stateEmptyAction": "SDK 설정하기",
+      "stateLowTitle": "페이지 뷰가 {count}개뿐입니다 | 페이지 뷰가 {count}개뿐입니다",
+      "stateLowBody": "뷰가 {min}개 미만이면 백분위수를 신뢰할 수 없어 판정이 숨겨집니다. 값은 참고용으로 표시됩니다.",
+      "stateErrorTitle": "{panel}을(를) 불러오지 못했습니다",
+      "stateErrorBody": "쿼리가 실패했거나 시간 초과되었습니다. 다른 패널에는 영향을 주지 않습니다.",
+      "retry": "다시 시도",
+      "panelVitals": "코어 웹 바이탈",
+      "panelKpis": "핵심 지표",
+      "panelPages": "페이지",
+      "panelSegments": "세그먼트",
+      "panelRelease": "릴리스 비교",
+      "panelFrustration": "사용자 불만",
+      "schemaErrorTitle": "RUM 스키마를 불러오지 못했습니다",
+      "schemaErrorBody": "스트림 필드를 읽을 수 없어 개요에서 표시할 패널을 결정할 수 없습니다.",
+      "pagesShowAll": "{n}개 페이지 모두 보기",
+      "pagesShowFewer": "페이지 적게 보기",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "코어 웹 바이탈",
+      "pagesEmptyTitle": "조회수가 충분한 페이지가 없습니다",
+      "pagesEmptyBody": "이 범위에서 순위를 매기려면 페이지당 최소 {n}개의 뷰가 필요합니다.",
+      "segEmptyTitle": "세그먼트 데이터 없음",
+      "segEmptyBody": "이 뷰에 대해 브라우저, 디바이스, OS, 국가 또는 연결 값이 기록되지 않았습니다.",
+      "releaseEmptyTitle": "두 버전 필요",
+      "releaseEmptyBody": "릴리스 비교에는 이 범위에서 확인된 버전이 두 개 이상 필요합니다.",
+      "releaseBefore": "{version}은(는) 이 범위 전에 이미 실시간으로 제공 중이었으므로, 처음 확인된 시간은 표시되지 않습니다.",
+      "pageErrorTitle": "성능 개요를 불러오지 못했습니다",
+      "pageErrorBody": "쿼리가 실패했거나 시간 초과되었습니다. 모든 패널을 다시 로드하려면 재시도하세요.",
+      "verdictOver": "{vital}이(가) 페이지 뷰의 {pct}%에서 양호 임계값 {threshold}을(를) 초과합니다.",
+      "verdictAllThree": "세 가지 Core Web Vitals 모두 p75에서 통과합니다.",
+      "verdictAllSome": "평가된 Core Web Vitals {n}개 모두 p75에서 통과합니다.",
+      "releaseNewErrors": "이 릴리스의 신규 오류 {count}개 | 이 릴리스의 신규 오류 {count}개",
+      "verdictNoData": "Core Web Vitals 데이터 없음",
+      "verdictNoDataLead": "이 범위의 페이지 뷰 {count}개 중 LCP, INP 또는 CLS를 보고한 항목이 없습니다. | 이 범위의 페이지 뷰 {count}개 중 LCP, INP 또는 CLS를 보고한 항목이 없습니다.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. 세션 열기.",
+      "pagesTableLabel": "영향도순으로 정렬된 페이지",
+      "verdictSessions": "범위 내 세션 {count}개. | 범위 내 세션 {count}개.",
+      "verdictCompare": "이전 기간과 비교했습니다.",
+      "deltaLower": "{v} 낮음",
+      "deltaHigher": "{v} 높음",
+      "forbiddenTitle": "{panel}을(를) 볼 권한이 없습니다",
+      "forbiddenBody": "RUM 데이터 스트림에 대한 접근 권한을 관리자에게 요청하세요.",
+      "pageForbiddenTitle": "성능 개요를 볼 권한이 없습니다",
+      "asideLabel": "어디서 무엇이 변경되었는지",
+      "pagesAbout": "이 순위 정보",
+      "chartPerFiveMinutes": "5분당",
+      "chartPerThirtyMinutes": "30분당",
+      "chartPerHour": "시간당",
+      "chartPerSixHours": "6시간당",
+      "chartPerDay": "1일당",
+      "chartIntervalOther": "버킷당",
+      "chartTableCaption": "버킷당 세션 및 오류",
+      "deltaChange": "이전 기간 대비 {delta}",
+      "deltaChangePts": "이전 기간 대비 {delta}포인트",
+      "deltaFlat": "이전 기간 대비 변화 없음",
+      "deltaNewMsg": "이전 기간 대비 신규",
+      "verdictP75Note": "판정은 항상 p75를 사용하며, p50과 p95는 값만 변경합니다.",
+      "releaseNote": "버전 필터 설정과 관계없이 최신 두 버전을 비교합니다.",
+      "kpiEmptyTitle": "이 범위에 세션이 없습니다",
+      "kpiEmptyBody": "시간 범위를 넓히거나 필터를 지우세요.",
+      "releaseImproved": "개선됨",
+      "releaseWorse": "악화됨",
+      "segOs": "OS",
+      "segConnection": "연결",
+      "pagesAllLink": "모든 페이지",
+      "pagesAllLinkAria": "제품 분석의 모든 페이지",
+      "frustrationReplayLink": "리플레이 보기",
+      "frustrationReplayHint": "이 범위의 불만족 세션을 엽니다. 녹화된 세션은 리플레이를 제공합니다.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "이 범위에는 기록된 항목이 없습니다. 시간 범위를 넓히거나, 이 앱이 아직 데이터를 보내지 않았다면 브라우저 SDK를 설정하세요.",
+      "stateEmptyFiltered": "이 범위에서 이 필터와 일치하는 항목이 없습니다. 모든 서비스, 환경 및 버전을 보려면 필터를 지우세요.",
+      "clearFilters": "필터 지우기",
+      "stateRefreshing": "{panel} 새로 고침 중",
+      "tileOpenSessions": "{label}: {value}. 열린 세션",
+      "tileOpenErrors": "{label}: {value}. 오류 추적 열기",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "이 개요는 브라우저 세션만 집계합니다. 모바일 앱 메트릭은 아래에 있습니다.",
+      "mixedMobileNote": "아래 필터는 모바일 앱 메트릭에만 적용됩니다."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "삭제",
     "confirmDeleteHead": "사용자 삭제",
     "confirmDeleteMsg": "{name} 사용자를 삭제하시겠습니까?",
+    "block": "차단",
+    "confirmBlockHead": "사용자 차단",
+    "confirmBlockMsg": "{email} 사용자는 확인된 도메인을 통해 참여했습니다. 차단하면 이 조직의 도메인 제한에 추가되고 이 조직에서 제거됩니다. 다음 로그인 시 매핑된 다른 조직에서도 제거됩니다.",
     "cancel": "취소",
     "save": "저장",
     "ok": "확인",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "초대 취소",
     "revokeInvitationMsg": "{email} 에 대한 초대를 정말로 취소하시겠습니까?",
     "deleteUsersTitle": "사용자 삭제",
-    "deleteUsersMsg": "{count} 사용자를 삭제하시겠습니까? | {count} 사용자를 삭제하시겠습니까?"
+    "deleteUsersMsg": "{count} 사용자를 삭제하시겠습니까? | {count} 사용자를 삭제하시겠습니까?",
+    "deleteUsersBlockNote": "이 중 {count}명은 확인된 도메인을 통해 참여했으며 삭제 대신 차단됩니다."
   },
   "invitation": {
     "pendingInvitations": "보류 중인 초대",
@@ -3403,8 +3597,6 @@
       },
       "show": "표시",
       "searchPermissions": "권한 검색",
-      "filterModules": "모듈 필터",
-      "noModuleMatch": "필터와 일치하는 모듈이 없습니다",
       "moduleScopeAll": "전체",
       "moduleScopeGranted": "선택됨",
       "noGrantedModule": "아직 선택된 모듈이 없습니다",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "권한 부여 | 권한 부여",
       "summaryReachSome": "{total} 중 {count}",
       "summaryEmptyTitle": "이 역할에는 아직 부여된 권한이 없습니다",
-      "summaryEmptyDescription": "왼쪽에서 모듈을 선택하거나 프리셋으로 시작하세요.",
+      "summaryEmptyDescription": "프리셋으로 시작하거나 목록에서 모듈을 선택하세요.",
       "presetReadonlyTitle": "읽기 전용",
       "presetReadonlyDescription": "모든 모듈에 대한 목록 및 조회",
       "presetDbmTitle": "데이터베이스 모니터링 뷰어",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "{total}개의 Kubernetes 메트릭 스트림이 이 조직에 아직 없으므로 아무것도 미리 선택되지 않았습니다.",
       "rumPresetSeeded": "{total}개 RUM 스트림 중 {matched}개에 대한 읽기 권한이 미리 선택되었고, 소스 맵과 RUM 제품 분석 권한이 있는 경우 해당 권한도 함께 준비되었습니다. 저장하기 전에 검토하세요.",
       "rumPresetNoMatch": "이 조직에는 아직 {total}개 RUM 스트림이 하나도 없으므로, 해당 스트림에는 아무것도 미리 선택되지 않았습니다. 소스 맵과 RUM 제품 분석 권한은 그대로 사전 설정되었습니다.",
-      "moduleGroupFleet": "플릿"
+      "moduleGroupFleet": "플릿",
+      "filterModulesTasks": "모듈 필터",
+      "noModuleMatchQuery": "“{query}”와(과) 일치하는 모듈이 없습니다",
+      "noModuleMatchHint": "모듈, 그룹 또는 작업으로 검색하세요. 예: slack, panel, token.",
+      "presetAlertManagerTitle": "알림 관리자",
+      "presetAlertManagerDescription": "알림, 알림 전송 대상 및 메시지를 생성하고 관리합니다",
+      "presetAlertViewerTitle": "알림 뷰어",
+      "presetAlertViewerDescription": "알림, 대상 및 템플릿을 변경하지 않고 봅니다",
+      "presetDashboardEditorTitle": "대시보드 편집자",
+      "presetDashboardEditorDescription": "대시보드를 만들고 편집하며, 쿼리하는 데이터에 대한 읽기 권한을 가집니다",
+      "presetDashboardViewerTitle": "대시보드 뷰어",
+      "presetDashboardViewerDescription": "대시보드를 열고 패널의 기반이 되는 데이터를 읽습니다",
+      "presetPipelineEditorTitle": "파이프라인 편집자",
+      "presetPipelineEditorDescription": "파이프라인과 함수를 만들며, 스트림 및 보강 테이블에 대한 읽기 권한을 가집니다",
+      "presetApplied": "{title}: {permissions}이(가) 추가되었습니다. 저장하기 전에 변경 사항을 검토하세요.",
+      "presetPermissionCount": "권한 {count}개 | 권한 {count}개",
+      "companionReasonAlertStreams": "알림을 저장하기 위해. 서버는 저장 시 스트림 액세스를 확인합니다",
+      "companionReasonAlertDestinations": "알림을 보낼 위치를 선택하기 위해",
+      "companionReasonDestinationTemplates": "모든 대상에 필요한 메시지 템플릿을 선택하기 위해",
+      "companionReasonDashboardStreams": "패널 데이터를 로드하기 위해",
+      "presetsTitle": "프리셋",
+      "presetsClose": "프리셋 닫기",
+      "presetsShow": "프리셋 표시",
+      "presetsSubtitle": "프리셋의 권한 부여를 이 역할에 추가합니다. 제거되는 항목은 없습니다.",
+      "presetsSectionBuiltin": "기본 제공",
+      "presetsSectionJob": "직무별",
+      "presetAddsTooltip": "권한 {count}개 추가 | 권한 {count}개 추가",
+      "presetInRole": "역할에 포함됨",
+      "presetInRoleTooltip": "이 역할에 이미 이 프리셋의 모든 항목이 있습니다",
+      "presetBack": "모든 프리셋",
+      "presetModuleCount": "모듈 {count}개 | 모듈 {count}개",
+      "presetSummaryAdds": "{modules}에 {permissions}을(를) 추가합니다.",
+      "presetSummaryWrite": "{modules}에 대한 쓰기 액세스.",
+      "presetSummaryViewOnly": "보기 전용: 아무것도 생성, 편집 또는 삭제할 수 없습니다.",
+      "presetSummaryHasAll": "이 역할에 이미 이 프리셋의 모든 항목이 있습니다.",
+      "presetSummarySkipped": "이 역할에 이미 있는 권한 {count}개는 건너뜁니다. | 이 역할에 이미 있는 권한 {count}개는 건너뜁니다.",
+      "presetStillMissing": "추가 후에도 누락: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "추가하면 누락되는 항목이 없습니다.",
+      "neededBy": "{modules}에서 필요",
+      "stillNeededBy": "{modules}에서 계속 필요",
+      "presetReadsEveryStream": "이 조직의 모든 스트림을 읽을 수 있으며, 새로 생기는 스트림도 포함됩니다.",
+      "presetAddButton": "권한 {count}개 추가 | 권한 {count}개 추가",
+      "presetNothingToAdd": "추가할 항목 없음",
+      "presetApplyNote": "추가된 권한 부여는 저장되지 않은 변경 사항이 됩니다. 저장하기 전에 검토하세요.",
+      "presetLoadingStreams": "스트림 로드 중",
+      "presetNoMatchingStreams": "이 조직에 아직 일치하는 스트림이 없습니다.",
+      "reviewMissingTooltip": "이 역할이 작동하는 데 필요한 모듈 {count}개 누락 | 이 역할이 작동하는 데 필요한 모듈 {count}개 누락",
+      "notAddedYetTitle": "아직 추가되지 않음 · {modules}",
+      "companionAdd": "추가",
+      "companionAddItem": "{item} 추가",
+      "companionAddAll": "모두 추가",
+      "companionOpenStreams": "스트림 열기",
+      "companionOpenStreamsTooltip": "이 역할이 읽을 수 있는 스트림 선택",
+      "companionNeeds": "{module}에 필요합니다({reason}).",
+      "companionNeedsThis": "{module}에 이 권한이 필요합니다({reason}).",
+      "companionStillNeedsThis": "{module}에 여전히 이 권한이 필요합니다({reason}).",
+      "yourChanges": "내 변경 사항",
+      "yourChangesCount": "{modules}에서 {changes}",
+      "yourChangesNone": "아직 없음",
+      "changeCount": "변경 {count}개 | 변경 {count}개",
+      "changeOtherGroup": "기타",
+      "saveSuccessCounts": "{modules}에서 {changes}을(를) 저장했습니다.",
+      "effectCan": "{target}에 대한 {actions} 권한이 있습니다.",
+      "effectCannot": "{target}에 대한 {actions} 권한이 더 이상 없습니다.",
+      "effectCanLoadDestinations": "대상 목록을 로드할 수 있습니다.",
+      "effectCannotLoadDestinations": "더 이상 대상 목록을 로드할 수 없습니다.",
+      "effectCanLoadTemplates": "템플릿 목록을 로드할 수 있습니다.",
+      "effectCannotLoadTemplates": "더 이상 템플릿 목록을 로드할 수 없습니다.",
+      "verbView": "보기",
+      "verbSeeListOf": "목록에서 보기",
+      "verbList": "목록 조회",
+      "verbOpen": "열기",
+      "verbCreate": "생성",
+      "verbEdit": "편집",
+      "verbDelete": "삭제",
+      "targetEveryStream": "모든 스트림(로그, 메트릭, 트레이스, 인덱스, 새 스트림 포함)",
+      "targetTypeStreams": "모든 {type} 스트림",
+      "targetOneStream": "{type} 스트림 {name}",
+      "targetAlertsEveryFolder": "모든 폴더의 알림(새 폴더 포함)",
+      "targetAlertsInFolder": "{name} 폴더의 알림",
+      "targetOneAlert": "{name} 알림",
+      "targetDashboardsEveryFolder": "모든 폴더의 대시보드(새 폴더 포함)",
+      "targetDashboardsInFolder": "{name} 폴더의 대시보드",
+      "targetOneDashboard": "{name} 대시보드",
+      "targetReportsEveryFolder": "모든 폴더의 보고서(새 폴더 포함)",
+      "targetReportsInFolder": "{name} 폴더의 보고서",
+      "targetOneReport": "{name} 보고서",
+      "targetEveryDestination": "모든 알림 대상(Slack, 이메일, 웹훅, 새 대상 포함)",
+      "targetOneDestination": "{name} 대상",
+      "targetEveryTemplate": "모든 알림 템플릿(새 템플릿 포함)",
+      "targetOneTemplate": "{name} 템플릿",
+      "targetAllOf": "모든 {module}(새 항목 포함)",
+      "targetItemIn": "{module}의 {name}",
+      "noteDestinationsFiltered": "직접 열 수도 있는 대상만 표시됩니다. 어떤 대상을 표시할지 선택하려면 여기 또는 개별 대상에 ‘가져오기’를 추가하세요.",
+      "noteTemplatesFiltered": "직접 열 수도 있는 템플릿만 표시됩니다. 어떤 템플릿을 표시할지 선택하려면 여기 또는 개별 템플릿에 ‘가져오기’를 추가하세요.",
+      "presetStreamsFailed": "스트림 목록을 로드할 수 없습니다.",
+      "presetRetry": "다시 시도",
+      "presetRestored": "{title}: {permissions}이(가) 복원되었습니다. 저장하기 전에 변경 사항을 검토하세요.",
+      "presetSummaryRestores": "제거하도록 표시한 권한 {count}개를 유지합니다. | 제거하도록 표시한 권한 {count}개를 유지합니다.",
+      "presetRestoreButton": "권한 {count}개 유지 | 권한 {count}개 유지",
+      "effectStillAllowed": "액세스 변경 없음: 더 넓은 권한 부여가 여전히 이를 허용합니다."
     },
     "rolesPage": {
       "subtitle": "역할 번들 권한 — 사용자, 서비스 계정 또는 그룹에 할당하여 액세스 권한을 부여합니다.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "사용자가 성공적으로 업데이트되었습니다.",
       "userDeletedSuccess": "사용자가 성공적으로 삭제되었습니다.",
       "errorDeletingUser": "사용자 삭제 중 오류 발생.",
+      "userBlockedSuccess": "사용자가 차단되었습니다.",
+      "errorBlockingUser": "사용자를 차단하는 중 오류가 발생했습니다.",
+      "blockedButNotRemoved": "사용자가 차단되었지만 이 조직에서 제거할 수 없었습니다.",
+      "blockedUsersSuccess": "성공적으로 {count}명의 사용자를 차단했습니다 | 성공적으로 {count}명의 사용자를 차단했습니다",
+      "blockedUsersPartial": "{count}명의 사용자를 차단하고 제거했지만 {failed}명은 이 조직에서 제거할 수 없었습니다 | {count}명의 사용자를 차단하고 제거했지만 {failed}명은 이 조직에서 제거할 수 없었습니다",
+      "blockedUsersNotRemoved": "{count}명의 사용자를 차단했지만 이 조직에서 제거할 수 없었습니다 | {count}명의 사용자를 차단했지만 이 조직에서 제거할 수 없었습니다",
       "pleaseWait": "기다려 주세요...",
       "invitationRevokedSuccess": "초대가 성공적으로 취소되었습니다.",
       "errorRevokingInvitation": "초대 취소 중 오류 발생.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "트레이스는 eBPF로 캡처됩니다. 코드 변경이나 SDK가 필요하지 않습니다. 트레이스 컨텍스트는 평문 HTTP로만 서비스 간에 전달됩니다(Go 앱은 커널 lockdown이 켜진 노드를 제외하면 HTTPS로도 전달). 포트, 실행 파일 경로 또는 명령줄 중 하나라도 일치하는 프로세스가 트레이스됩니다. 글롭에는 `,`, `{'{'}` 또는 `{'}'}`를 포함할 수 없으며, 포트는 해당 포트에 소켓을 가진 모든 프로세스와 일치합니다. Helm 3.14+ 및 OpenTelemetry 오퍼레이터 v0.142.0+가 필요합니다. 더 오래된 버전이라면 먼저 `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`로 오퍼레이터를 업그레이드하세요. 이전 오퍼레이터에서 이미 eBPF를 활성화했다면 `--force`(Helm 4에서는 `--force-replace`)를 붙여 명령을 다시 실행하세요. 위의 설치 명령을 다시 실행하면 릴리스가 초기화되고 eBPF가 꺼지므로, 그 후 이 명령을 다시 실행하세요. `openobserve-collector` 네임스페이스는 권한 있는 파드를 허용해야 하며, 노드는 amd64 또는 arm64의 Linux에서 커널 5.8+ (또는 eBPF 백포트가 적용된 RHEL 계열 4.18)와 BTF를 갖춰야 합니다. 이미 자체 트레이스를 보내는 앱이나 Go `inject-go` 사이드카를 사용하는 파드는 선택하지 마세요.",
       "k8sEbpfVariant": "eBPF (모든 언어, 코드 변경 없음)",
       "k8sLibrariesVariant": "언어 라이브러리 (자동 계측)",
+      "k8sNetworkFlowsDesc": "수집기의 eBPF DaemonSet은 각 Linux 노드에서 **모든 TCP 또는 UDP 프로토콜을 통해 워크로드 간에 전송된 바이트**를 기록합니다. 여기에는 트레이스되지 않는 데이터베이스, 캐시 및 기타 서비스도 포함됩니다. 이 데이터는 `obi_network_flow_bytes` 메트릭으로 들어오며, 소스 및 대상 소유자(Deployment, StatefulSet, Node, …)와 네임스페이스로 레이블이 지정됩니다. eBPF 트레이스 사용 여부와 관계없이 작동합니다.",
+      "k8sNetworkFlowsNote": "Helm 3.14+ 및 OpenTelemetry operator v0.142.0+가 필요합니다. `openobserve-collector` 네임스페이스는 privileged 파드를 허용해야 하며, 노드는 커널 5.8+ (또는 eBPF 백포트가 포함된 RHEL 계열 4.18)와 BTF를 갖춘 Linux를 amd64 또는 arm64에서 실행해야 합니다. eBPF 파드는 호스트 네트워크에서 실행되며, 수집기 자체의 메트릭은 각 노드의 `127.0.0.1:8888`에서 수신 대기하므로 해당 노드에서 이 포트를 비워 두어야 합니다. 이미 설정한 eBPF 트레이스 선택자는 유지됩니다. 위의 설치 명령을 다시 실행하면 릴리스가 재설정되고 이 기능이 꺼지므로, 이후 이 명령을 다시 실행하세요. 동일한 바이트가 두 번 이상 보고될 수 있습니다: 노드 간 트래픽은 양쪽 노드에서 모두 보고되고, 서비스에 대한 연결은 서비스와 그 뒤의 워크로드 양쪽에서 보고됩니다. eBPF 네트워크 플로 가이드에서는 중복 집계 없이 이를 쿼리하는 방법을 설명합니다.",
+      "k8sNetworkFlowsTitle": "워크로드 간 통신 확인: eBPF 네트워크 흐름",
       "k8sInstallerNote": "이것은 cert-manager, OpenTelemetry 운영자 및 OpenObserve 수집기를 자동으로 설치합니다.",
       "k8sInternalEndpointNote": "OpenObserve가 동일한 클러스터에서 실행될 때 이 옵션을 사용하세요 — 트래픽이 클러스터를 벗어나지 않습니다.",
       "k8sTroubleAnnotationA": "주입은 파드 생성 시 발생하므로 기존 파드는 재시작할 때까지 영향을 받지 않습니다 — `kubectl rollout restart deployment -n my-namespace`를 실행하세요. `kubectl get ns my-namespace -o yaml`로 주석이 적용되었는지 확인하고, 값이 `openobserve-collector/openobserve-<language>`와 일치하는지 확인하세요.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "설치가 어드미션 웹훅 관련 오류로 실패합니다",
       "linuxAgentFixBody": "설치 프로그램은 에이전트를 systemd 서비스로 시작합니다. 아무것도 도착하지 않으면 실행 중인지 확인하고 인증 또는 연결 오류가 있는지 로그를 읽으세요:",
       "linuxTracesNote": "트레이스는 eBPF로 캡처됩니다. 코드 변경이나 SDK가 필요하지 않습니다. 포트, 실행 파일 경로 또는 명령줄 중 하나라도 일치하는 프로세스가 트레이스됩니다. 글롭에는 `,`, `{'{'}` 또는 `{'}'}`를 포함할 수 없습니다. 트레이스에는 BTF가 있는 Linux 5.8+ (또는 eBPF 백포트가 적용된 RHEL 계열 4.18)가 필요하며, 이 경우 에이전트는 root로 실행됩니다. 호스트가 트레이스할 수 없으면 설치가 중단되고 실행 중인 에이전트는 그대로 유지됩니다. 이후 트레이싱이 켜진 상태에서 에이전트가 시작되지 않으면, **로그 & 메트릭** 명령을 다시 실행하거나 원인을 해결한 뒤 트레이싱과 함께 다시 실행할 때까지 트레이싱이 비활성화됩니다. 로그와 메트릭도 마찬가지입니다. 트레이스되는 앱은 발신 일반 텍스트 HTTP 요청에 W3C `traceparent` 헤더를 추가합니다. 아래 eBPF 트레이싱 가이드에서는 HTTPS와 반복 플래그를 다룹니다.",
+      "linuxNetworkFlowsDesc": "설치 프로그램을 `--network-flows` 옵션으로 실행하여 **이 호스트가 모든 TCP 또는 UDP 프로토콜을 통해 보내고 받는 바이트**를 `obi_network_flow_bytes` 메트릭으로 보고합니다. 각 흐름에는 나열한 네트워크를 사용해 `src_cidr` 및 `dst_cidr` 레이블이 지정되므로 모든 호스트에 동일한 목록을 제공하세요. 호스트당 하나의 `/32` 항목을 지정하면 호스트 간 맵이 만들어집니다.",
+      "linuxNetworkFlowsNote": "Linux 5.8+ (또는 eBPF 백포트가 포함된 RHEL 계열 4.18) 및 BTF가 필요하며, 이때 에이전트는 root로 실행됩니다. 트레이싱을 사용하든 하지 않든 작동하지만, 설치 프로그램을 실행할 때마다 에이전트 구성이 교체됩니다. 트레이싱을 계속 켜 두려면 **로그, 메트릭 & eBPF 트레이스** 명령의 `--trace-*` 및 `--service-name` 플래그를 추가하세요. 호스트에서 eBPF를 실행할 수 없으면 설치가 중단되고 실행 중인 에이전트는 그대로 유지됩니다. 그 후 네트워크 캡처가 시작되지 않으면, **로그 & 메트릭** 명령을 다시 실행하거나 원인을 해결하고 `--network-flows`로 다시 실행할 때까지 에이전트(로그와 메트릭 포함)가 비활성화됩니다. 에이전트를 실행하는 두 호스트 간 트래픽은 각 호스트에서 보고되며, 양쪽 끝의 주소가 같지 않으면 루프백 트래픽도 집계됩니다. 아래의 eBPF 네트워크 플로 가이드에서는 레이블과 중복 집계 없이 쿼리하는 방법을 설명합니다.",
+      "linuxNetworkFlowsTitle": "호스트 간 통신 확인: eBPF 네트워크 흐름",
       "linuxTracesVerifyNote": "트레이싱을 켜면 트레이스 대상 앱이 요청을 처리하는 즉시 트레이스가 표시됩니다.",
+      "ebpfNetworkFlowsGuideLink": "eBPF 네트워크 흐름 가이드",
       "ebpfTracingGuideLink": "eBPF 트레이싱 가이드",
       "logsMetricsTracesVariant": "로그, 메트릭 & eBPF 트레이스",
       "logsMetricsVariant": "로그 및 메트릭",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "OpenTelemetry 익스포터를 OpenObserve로 지정하세요. 수집기 또는 SDK, HTTP 또는 gRPC. 엔드포인트와 토큰은 아래에 이미 입력되어 있습니다.",
       "taglineWindows": "모든 Windows 호스트에 OpenObserve 에이전트를 설치하세요. 이벤트 로그, 성능 카운터, 호스트 메트릭이 포함됩니다.",
       "testAgain": "다시 테스트",
+      "networkFlowsHelp": "CIDR 또는 CIDR=NAME 항목을 공백 없이 쉼표로 구분하세요. 각 CIDR에는 프리픽스 길이가 필요합니다(예: 10.0.1.5/32). 이름에는 문자, 숫자, ., _, -만 포함할 수 있습니다. 어떤 항목과도 일치하지 않는 주소는 레이블 없이 남습니다. 0.0.0.0/0=other는 나머지 IPv4의 이름을 지정하고, ::/0=other6은 나머지 IPv6의 이름을 지정합니다.",
+      "networkFlowsLabel": "레이블을 지정할 네트워크",
+      "networkFlowsRequired": "네트워크를 하나 이상 나열하세요. 흐름에는 나열한 네트워크로 레이블이 지정됩니다.",
       "traceCmdHelp": "Python, Node.js, Java 앱용입니다.",
       "traceCmdLabel": "명령줄",
       "traceExeLabel": "실행 파일 경로",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "다음 값 미만 셀 숨기기",
     "heatmapHideBelowTooltip": "이보다 작은 값의 셀은 비워 둡니다.",
     "heatmapHideBelowNote": "{value} 미만의 셀은 숨겨져 있습니다",
+    "boxplotWhisker": "수염",
+    "boxplotWhiskerMinMax": "최솟값부터 최댓값까지",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "메시지 필드",
+    "logsLevelField": "레벨 필드",
+    "logsTimeField": "시간 필드",
+    "htmlPanelFieldTooltip": "비워 두면 쿼리 결과에서 열을 감지합니다",
+    "logsOrder": "순서",
+    "logsOrderNewest": "최신순",
+    "logsOrderOldest": "오래된순",
+    "logsOrderTooltip": "쿼리가 반환한 행의 순서를 정합니다. 수정하지 않은 시작 쿼리도 이 순서로 가져오므로 오래된순을 고르면 가장 오래된 로그가 표시됩니다.",
+    "logsShowTime": "시간 표시",
+    "logsWrap": "줄 바꿈",
+    "logsPrettifyJson": "JSON 정리",
     "distributionBucketCount": "버킷 수",
     "distributionBucketSize": "버킷 크기",
     "distributionBucketSizeTooltip": "필드 단위로 나타낸 각 버킷의 너비입니다. 설정하면 버킷 수 대신 사용됩니다.",
@@ -7822,6 +8145,8 @@
       "gauge": "게이지",
       "html": "HTML",
       "markdown": "마크다운",
+      "boxplot": "상자 그림",
+      "logs": "로그",
       "barGauge": "막대 게이지",
       "distribution": "분포",
       "treemap": "트리맵",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: 위치 {index}에 필수 인수가 없습니다",
       "fieldNotAllowedForMetric": "메트릭 차트에는 {label} 필드를 사용할 수 없습니다",
       "rawValueSampled": "처음 {count}개 행 기준",
+      "addAtMostOneFieldFor": "{label}에는 필드를 최대 하나만 추가하세요",
+      "boxplotMin": "최소",
+      "boxplotMax": "최대",
+      "boxplotLowerWhisker": "아래쪽 수염",
+      "boxplotUpperWhisker": "위쪽 수염",
+      "boxplotMedian": "중앙값",
+      "boxplotSamples": "샘플 수",
+      "boxplotOutlier": "이상치",
       "fieldNotAllowedForDistribution": "{label} 필드는 분포 차트에서 사용할 수 없습니다",
       "distributionCount": "개수",
       "addAtLeastOneFieldFor": "{label}에 필드를 하나 이상 추가하세요",
@@ -8525,6 +8858,8 @@
       "urlHidden": "액세스 권한 없음",
       "urlHiddenHint": "이 링크의 대시보드를 볼 수 없으므로 공개 URL이 숨겨집니다.",
       "orgDisabledHint": "이 조직에서는 공개 링크가 꺼져 있습니다",
+      "orgDisabledBanner": "이 조직에서는 공개 링크가 꺼져 있어 링크가 제공되지 않습니다. 관리자가 다시 켤 수 있습니다.",
+      "disabledPaused": "비활성화됨 · 일시 중지됨",
       "takeOver": "인계받기",
       "takeOverTitle": "이 링크를 인계받을까요?",
       "takeOverBody": "본인이 게시자가 됩니다. 공개 페이지에는 본인이 볼 수 있는 내용이 표시되며, 이전보다 많거나 적을 수 있습니다. URL이 있는 사람은 계속 액세스할 수 있으며, 링크는 지금 바로 활성화됩니다.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "그룹",
     "wellSubgroup": "하위 그룹",
     "wellSize": "크기",
+    "wellCategory": "범주",
     "value": "값"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "트리거 값을 관측된 정상 상태에서 멀어지게 조정합니다.",
       "lengthenEvaluationWindow": "평가 기간 늘리기",
       "lengthenEvaluationWindowDesc": "기간을 넓혀 짧은 급증이 더 이상 알림을 트리거하지 않도록 합니다.",
-      "enableDeduplication": "중복 제거 사용",
-      "enableDeduplicationDesc": "중복 제거 기간 내의 반복 발생을 하나로 합칩니다.",
+      "enableDeduplication": "반복 억제 켜기",
+      "enableDeduplicationDesc": "매 평가가 아니라 상태 변경 시 한 번만 알림을 보냅니다.",
       "reviewForDeletion": "삭제 검토",
       "reviewForDeletionDesc": "알림을 폐기하기 전에 쿼리가 여전히 실제 상황과 일치하는지 확인합니다.",
       "fixAlertQuery": "알림 쿼리 수정",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "조직 ID",
     "alertCreationTitle": "알림 생성",
     "noAlertsFound": "알림이 없습니다.",
-    "suppressedByDeduplication": "중복 제거로 억제됨",
-    "occurrence": "{count}회 발생 | {count}회 발생",
     "groupedNotification": "그룹화된 알림",
     "alertsBatchedTogether": "함께 일괄 처리된 알림",
-    "notificationSent": "알림 전송됨",
-    "occurrencesDeduplicated": "중복 제거된 발생",
     "alertExecutionDetails": "알림 실행 세부 정보",
     "evaluationTime": "평가 시간",
     "queryTime": "쿼리 시간",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "종료: {time}",
     "serviceGraphTooltipTemporalCorrelation": "시간적 상관관계",
     "serviceGraphTooltipServiceDependency": "서비스 종속성",
-    "totalAlerts": "전체 알림",
-    "usingDeduplication": "중복 제거 사용 중",
-    "deduplicationConfiguredTooltip": "중복 제거가 구성된 알림",
-    "suppressionRate24h": "억제율 (24시간)",
     "suppressed": "억제됨 /",
-    "total": "전체",
-    "passedLabel": "통과됨:",
-    "pendingBatches": "대기 중인 배치",
-    "pendingBatchesTooltip": "함께 그룹화되기를 기다리는 알림",
     "historyTimeline": {
       "firing": "발생 중",
       "ok": "정상",
@@ -10089,7 +10413,8 @@
     "endTime": "종료 시간",
     "duration": "지속 시간",
     "retries": "재시도",
-    "dedup": "중복 제거",
+    "suppression": "억제",
+    "suppressedAsRepeat": "반복으로 억제됨",
     "validation": {
       "streamTypeRequired": "Stream 유형은 필수입니다.",
       "streamNameRequired": "Stream 이름은 필수입니다.",
@@ -10281,15 +10606,6 @@
     "all": "모두",
     "history": "알림 기록",
     "searcHistory": "알림 이름 입력",
-    "deduplication": {
-      "fingerprintFields": "유사한 알림 그룹화 기준",
-      "fingerprintFieldsHint": "알림을 유사하다고 판단할 필드를 선택하세요(예: hostname, service). 쿼리에 따라 자동 감지하려면 비워 두세요.",
-      "fingerprintFieldsTooltip": "알림을 중복으로 간주하려면 어떤 필드가 일치해야 하는지 선택하세요. 예를 들어 'hostname'을 선택하면 같은 호스트에서 발생한 알림이 함께 그룹화됩니다. 서로 다른 알림 유형(예: High CPU와 High Memory)은 같은 호스트에서 발생하더라도 그룹화되지 않습니다. 쿼리 유형에 따른 자동 감지를 사용하려면 비워 두세요.",
-      "timeWindow": "동일한 알림으로 간주할 기간",
-      "timeWindowHint": "유사한 알림을 그룹화하는 기간입니다. 확인 주기와 맞추려면 비워 두세요.",
-      "timeWindowTooltip": "그룹화를 위해 최근 알림을 기억하는 기간입니다. 이 기간 안에 비슷한 알림이 발생하면 다시 전송되지 않습니다. 알림의 확인 주기를 사용하려면 비워 두세요.",
-      "fingerprintFieldsHelp": "비워 두면 쿼리에 따라 자동 감지합니다 (SQL: GROUP BY 열, PromQL: 레이블, 사용자 지정: 조건 필드)"
-    },
     "summary": {
       "scrollToBottom": "맨 아래로 스크롤",
       "title": "요약",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "구성된 조건이 충족되면 알림 받기"
       }
     },
-    "correlation": {
-      "title": "알림 상관관계",
-      "description": "조직 전체에서 알림의 상관 관계 및 중복 제거 방법을 구성합니다.핑거프린트 값이 일치하는 알림은 함께 그룹화됩니다.",
-      "semanticFieldNote": "참고: 시맨틱 필드 매핑은 서비스 ID 탭에서 구성됩니다.",
-      "enableOrgLevel": "조직 수준 중복 제거 활성화",
-      "enableOrgLevelTooltip": "이 조직의 모든 알림에 대해 중복 제거 및 상관 관계 분석 기능을 활성화합니다.",
-      "enableCrossAlert": "교차 알림 중복 제거 활성화",
-      "enableCrossAlertTooltip": "서로 다른 알림이 동일한 핑거프린트를 공유할 때 서로 중복된 데이터를 제거하도록 허용",
-      "fingerprintGroups": "교차 알림 핑거프린트 그룹",
-      "fingerprintGroupsTooltip": "교차 알림 핑거프린팅에 사용할 시맨틱 그룹을 선택합니다.이러한 측정기준에 대해 동일한 값을 공유하는 경우 알림은 중복 제거됩니다.",
-      "fingerprintGroupsHint": "교차 알림 중복 제거를 위한 시맨틱 그룹을 하나 이상 선택하십시오.",
-      "fingerprintGroupsRequired": "시맨틱 그룹을 하나 이상 선택해야 합니다.",
-      "defaultWindow": "기본 상관 관계 창 (분)",
-      "defaultWindowTooltip": "시맨틱 필드 일치가 없는 경우 지정된 기간의 알림과 데이터는 관련된 것으로 간주됩니다.",
-      "defaultWindowDescription": "시맨틱 필드 일치가 없는 경우 지정된 기간의 알림과 데이터는 관련된 것으로 간주됩니다.",
-      "defaultWindowPlaceholder": "기본적으로 알림 기간 사용",
-      "cancelButton": "취소",
-      "saveButton": "설정 저장",
-      "settingsSaved": "조직 중복 제거 설정이 성공적으로 저장되었습니다.",
-      "settingsSaveError": "설정 저장 실패"
-    },
     "placeholders": {
       "typeSomething": "무언가를 입력하세요",
       "value": "값",
       "selectColumn": "컬럼 선택",
       "savedFunctions": "저장된 함수",
-      "autoUsesCheckInterval": "자동 (검사 간격 사용)",
       "addTag": "태그를 추가하고 Enter를 누르세요"
     },
     "steps": {
       "compareWithPast": "과거와 비교하기",
-      "deduplication": "중복 제거",
       "advanced": "고급"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "알림을 트리거해야 하는 항목",
       "compareWithPast": "현재 결과를 다른 기간의 데이터와 비교",
       "alertSettings": "알림 규칙을 설정하고 알림 수신 방법을 선택하세요.",
-      "deduplication": "비슷한 알림을 그룹화하여 동일한 알림을 여러 번 전송하지 마십시오.",
       "advanced": "컨텍스트 변수, 설명 및 행 템플릿"
     },
     "failedToFetchHistory": "알림 기록을 가져오지 못했습니다.",
@@ -10399,8 +10691,6 @@
         "closeActions": "작업 닫기",
         "viewAlertHistory": "알림 기록 보기",
         "actionsFor": "조치 대상:",
-        "configureDedup": "데이터 중복 제거 설정",
-        "configureDedupTooltip": "이 알림에 대해 중복 제거를 구성합니다.",
         "editAlert": "알림 편집",
         "editAlertTooltip": "알림 구성 편집",
         "viewHistory": "기록 보기",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "새 \"해결됨\" 메시지",
       "keepFiringFor": "발생 유지 시간",
       "keepFiringForTooltip": "조건이 해제된 후 이 시간만큼 기다린 뒤 복구합니다. 0이면 즉시 복구합니다.",
+      "suppressRepeats": "반복 억제",
+      "suppressRepeatsTooltip": "알림이 발생하기 시작하거나 레벨이 변경될 때 한 번만 알림을 보내고, 매 평가마다 보내지 않습니다. 각 무음 기간 이후에도 계속 알림을 받으려면 꺼 두세요.",
       "keepFiringForInvalid": "0초 이상 입력하세요",
       "keepFiringForTooLong": "최대 86400초(24시간)까지 입력하세요"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "이 이메일 주소는 이미 추가되었습니다.",
     "confirmRemoveEmail": "{email} 이메일을 제거하시겠습니까?",
     "domainNeedsEmails": "모든 사용자를 허용하지 않는 경우 '{domain}' 도메인에 이메일 주소가 하나 이상 있어야 합니다.",
+    "noAllowedEmailsDenyAll": "아직 허용된 이메일이 없으므로 {domain}의 모든 사용자가 거부됩니다.",
     "domainSettingsSaved": "도메인 설정이 성공적으로 저장됨",
     "errorSavingDomainSettings": "도메인 설정을 저장하는 중 오류 발생",
     "noDomainMessage": "도메인이 구성되지 않았습니다.위에 도메인을 추가하여 액세스를 제한하세요.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "저장하기 전에 하나 이상의 ID 집합을 구성하세요.",
       "discoveredServicesTab": "검색된 서비스",
       "serviceDiscoveryTab": "탐지 규칙",
-      "alertCorrelationTab": "알림 그룹화",
       "fieldAliasesTab": "필드 매핑",
       "fieldAliasesSaved": "필드 별칭이 성공적으로 저장되었습니다",
       "fieldAliasesSaveError": "필드 별칭 저장 실패",
@@ -14079,27 +14371,144 @@
     "runsIn": "실행 위치",
     "recommendedByFieldCoverage": "스트림의 필드 커버리지를 기반으로 추천됩니다.",
     "listConjunctionAndTwo": "{first} 및 {last}",
-    "domainOrgMappings": {
-      "title": "도메인-조직 매핑",
-      "subtitle": "일치하는 이메일 도메인으로 로그인하는 신규 사용자는 조직에 자동으로 추가됩니다.",
+    "orgDomainMapping": {
+      "tabLabel": "도메인 관리",
+      "tabDesc": "이메일 도메인을 연결하고, 해당 사용자를 조직에 매핑하며, 참여할 수 있는 사용자를 제어합니다.",
+      "loadFailed": "조직 설정을 불러오지 못했습니다",
       "addMapping": "매핑 추가",
       "editMapping": "매핑 편집",
-      "empty": "아직 매핑이 없습니다. “{addLabel}”을 사용하여 매핑을 추가하세요.",
       "domain": "이메일 도메인",
-      "domainHelp": "사용자 이메일 주소에서 {at_sign} 뒤에 오는 부분입니다.",
+      "domainHelp": "사용자 이메일 주소에서 {at_sign} 뒤의 부분입니다. 도메인은 이 조직에 연결되며 DNS를 통해 확인해야 합니다.",
+      "domainHelpRequest": "사용자 이메일 주소에서 {at_sign} 뒤에 오는 부분입니다. OpenObserve가 요청을 승인하면 해당 도메인이 이 조직에 연결됩니다.",
       "organization": "조직",
-      "organizationPlaceholder": "조직 식별자",
-      "organizationHelp": "일치하는 사용자가 추가되는 조직의 식별자입니다.",
+      "organizationHelp": "이 조직 또는 해당 요금 청구 그룹 구성원 중 하나입니다.",
       "organizationRequired": "조직은 필수입니다",
       "baseRole": "기본 역할",
-      "baseRoleHelp": "해당 조직에서 일치하는 사용자에게 부여되는 역할입니다.",
+      "baseRoleHelp": "사용자가 해당 조직에 추가될 때 부여되는 역할입니다. 기존 구성원은 현재 역할을 유지합니다.",
       "roleClaimName": "역할 클레임",
-      "roleClaimNamePlaceholder": "클레임 이름(예: groups)",
-      "roleClaimNameHelp": "선택 사항입니다. 사용자의 사용자 지정 역할을 나열하는 토큰 클레임으로, 로그인할 때마다 해당 조직의 사용자 지정 역할이 이에 맞춰 동기화됩니다.",
-      "createMissingRoles": "조직에 없는 클레임의 역할 생성",
-      "duplicateDomain": "이 도메인에 대한 매핑이 이미 존재합니다",
-      "confirmRemove": "{name}의 매핑을 삭제하시겠습니까?",
-      "deleteTitle": "매핑 삭제"
+      "roleClaimNamePlaceholder": "클레임 이름, 예: groups",
+      "roleClaimNameHelp": "선택 사항입니다. 사용자의 사용자 지정 역할을 나열하는 SSO 토큰 클레임입니다. SSO 로그인 시마다 해당 조직의 사용자 지정 역할이 클레임에 포함된 역할로 대체됩니다. 클레임에 포함된 역할 중 존재하지 않는 역할은 생성되지 않는 한 건너뜁니다.",
+      "createMissingRoles": "조직에 없는 클레임 역할 생성",
+      "verifyNow": "지금 확인",
+      "details": "세부 정보",
+      "detailsDialogTitle": "{domain}의 연결 세부 정보",
+      "approvedLinkInfo": "연결 요청 후 OpenObserve에서 연결했습니다. DNS 레코드가 필요하지 않습니다.",
+      "pendingRequestInfo": "OpenObserve에서 이 요청을 검토 중입니다. 승인될 때까지 별도로 할 일이 없습니다.",
+      "rejectedRequestInfo": "OpenObserve에서 이 요청을 거부했습니다.",
+      "verifyDialogTitle": "{domain} 확인",
+      "recordDialogTitle": "{domain}의 DNS 레코드",
+      "lastCheckFailed": "마지막 확인 실패: {reason}",
+      "state": {
+        "pending": "대기 중",
+        "verified": "확인됨",
+        "failed": "실패",
+        "requested": "승인 대기 중",
+        "approved": "승인됨",
+        "rejected": "거부됨"
+      },
+      "saved": "도메인 매핑이 저장되었습니다",
+      "saveFailed": "설정을 저장하지 못했습니다",
+      "linkFailed": "도메인을 연결하지 못했습니다",
+      "unlinkFailed": "도메인 연결을 해제하지 못했습니다",
+      "verifyFailed": "확인에 실패했습니다",
+      "deleted": "매핑이 제거되었습니다",
+      "deleteTitle": "매핑을 제거할까요?",
+      "deleteMappingBody": "{domain}의 사용자는 로그인해도 더 이상 {org}에 추가되지 않습니다.",
+      "recordInstructions": "DNS 제공업체에서 다음 DNS TXT 레코드를 추가하세요:",
+      "txtNameLabel": "레코드 이름",
+      "txtValueLabel": "레코드 값",
+      "copyTxtName": "레코드 이름 복사",
+      "copyTxtValue": "레코드 값 복사",
+      "txtNameCopied": "레코드 이름이 복사되었습니다",
+      "txtValueCopied": "레코드 값이 복사되었습니다",
+      "verifyHint": "확인은 {minutes}분마다 자동으로 실행됩니다. 지금 확인할 수도 있습니다.",
+      "alreadyLinked": "이 도메인은 이미 이 조직에 연결되어 있습니다",
+      "failureReason": {
+        "recordMissing": "TXT 레코드를 찾을 수 없습니다",
+        "valueMismatch": "TXT 레코드를 찾았지만 값이 일치하지 않습니다",
+        "dnsFailed": "DNS 조회에 실패했습니다"
+      },
+      "pageSubtitle": "이메일 도메인을 연결하고, 해당 사용자를 조직에 매핑하고, 참여할 수 있는 사용자를 제어하세요.",
+      "linkedTab": "연결된 도메인",
+      "mappingsTab": "매핑",
+      "accessTab": "차단된 사용자",
+      "requestsTab": "연결 요청",
+      "linkDomain": "도메인 연결",
+      "sendRequest": "요청 보내기",
+      "linkMethod": "소유권 증명 방법",
+      "method": {
+        "dns": "DNS 레코드",
+        "approved": "승인된 요청",
+        "request": "연결 요청",
+        "dnsTitle": "DNS TXT 레코드 추가",
+        "dnsDesc": "레코드가 게시되면 자동으로 확인됩니다. 도메인의 DNS를 직접 관리하는 경우 가장 적합합니다.",
+        "requestTitle": "OpenObserve에 연결 요청",
+        "requestDesc": "당사 팀이 요청을 검토하고 승인되면 도메인을 연결합니다."
+      },
+      "searchDomains": "도메인 검색",
+      "searchMappings": "도메인 또는 조직으로 검색",
+      "searchRequests": "도메인, 조직 또는 요청자로 검색",
+      "status": "상태",
+      "linkedVia": "연결 방식",
+      "lastChecked": "마지막 확인",
+      "linked": "도메인이 연결되었습니다. 확인하려면 DNS 레코드를 추가하세요.",
+      "verified": "도메인 확인됨",
+      "notVerifiedYet": "아직 DNS 레코드를 찾을 수 없습니다. 전파되는 데 시간이 걸릴 수 있습니다.",
+      "requestSent": "연결 요청이 전송되었습니다",
+      "requestFailed": "연결 요청을 보내지 못했습니다",
+      "keepRecordHint": "이 레코드를 그대로 유지하세요. 소유권은 {minutes}분마다 다시 확인되며, 레코드가 {grace}분 넘게 없으면 도메인은 실패로 표시되고 해당 매핑이 더 이상 적용되지 않습니다.",
+      "removeDomain": "도메인 제거",
+      "removeTitle": "도메인을 제거할까요?",
+      "removeBody": "{domain}이(가) 이 조직에서 연결 해제됩니다.",
+      "removeWithMappingsBody": "{domain}이(가) 이 조직에서 연결 해제되고 해당 매핑 {count}개가 제거됩니다. | {domain}이(가) 이 조직에서 연결 해제되고 해당 매핑 {count}개가 제거됩니다.",
+      "removed": "도메인이 제거되었습니다",
+      "domainRequired": "도메인은 필수입니다",
+      "mappingDomainHelp": "확인된 도메인만 매핑할 수 있습니다.",
+      "createsRoles": "역할 생성",
+      "duplicateMapping": "이 도메인은 이미 해당 조직에 매핑되어 있습니다",
+      "domainNotVerified": "확인되지 않음",
+      "noVerifiedDomains": "매핑은 확인된 도메인에만 적용됩니다. 먼저 도메인을 연결하고 확인하세요.",
+      "goToLinked": "도메인 연결",
+      "goToLinkedDesc": "사용자를 매핑하기 전에 소유한 도메인을 확인하세요",
+      "enforceTitle": "다른 조직에서 사용자 제거",
+      "enforceDesc": "매핑된 도메인의 사용자가 SSO로 로그인하면, 해당 사용자는 이 조직과 그 요금 청구 그룹을 제외한 모든 조직에서 제거됩니다.",
+      "enforceConfirmTitle": "다른 조직에서 사용자를 제거할까요?",
+      "enforceConfirmBody": "이메일 도메인이 여기에 매핑된 사용자가 SSO로 로그인할 때마다, 해당 사용자는 개인 조직을 포함하여 이 조직이나 그 요금 청구 그룹에 속하지 않은 모든 조직에서 제거됩니다.",
+      "enforceConfirmAction": "켜기",
+      "enforceSaved": "설정이 저장되었습니다",
+      "blockUsers": "사용자 차단",
+      "editBlockedUsers": "차단된 사용자 편집",
+      "block": "차단",
+      "blockedCount": "{count}명 차단됨 | {count}명 차단됨",
+      "blockedEmails": "차단된 이메일",
+      "blocklistDomainHelp": "이 조직의 확인된 도메인 중 하나입니다.",
+      "blocklistEmailsHelp": "이 사용자들은 SSO로 이 조직이나 그 요금 청구 그룹 구성원에 참여할 수 없으며, 다음 로그인 시 해당 조직에서 제거됩니다.",
+      "ruleBlockedRequired": "차단할 이메일을 하나 이상 추가하세요",
+      "noDomainForBlocklist": "모든 확인된 도메인에 이미 차단된 사용자가 있습니다. 해당 도메인의 행을 편집하여 변경하세요.",
+      "unblockAll": "모두 차단 해제",
+      "unblockAllTitle": "모든 사용자의 차단을 해제할까요?",
+      "unblockAllBody": "{domain}의 모든 차단된 사용자는 다음 SSO 로그인 시 다시 참여할 수 있습니다.",
+      "blocklistSaved": "차단된 사용자가 저장되었습니다",
+      "blocklistDeleted": "사용자 차단이 해제되었습니다",
+      "blocklistSection": "도메인별 차단된 사용자",
+      "filterPending": "대기 중",
+      "filterAll": "전체",
+      "requestedBy": "요청자",
+      "requestedAt": "요청일",
+      "verifiedAt": "검증됨",
+      "answeredBy": "응답자",
+      "reason": "사유",
+      "reasonHelp": "요청을 제기한 조직에 표시됩니다.",
+      "reasonRequired": "요청을 거부하려면 사유가 필요합니다",
+      "approve": "승인",
+      "reject": "거부",
+      "approveTitle": "연결 요청을 승인하시겠습니까?",
+      "rejectTitle": "연결 요청을 거부하시겠습니까?",
+      "approveBody": "{domain}이(가) DNS 확인 없이 {org}에 연결됩니다.",
+      "rejectBody": "{org}에는 {domain}이(가) 연결되지 않습니다.",
+      "requestApproved": "{domain} 연결됨",
+      "requestRejected": "{domain}에 대한 요청이 거부되었습니다",
+      "decisionFailed": "요청을 업데이트하지 못했습니다"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "탐지 시점 옵션을 선택하세요"
   },
   "search_history": {
-    "title": "검색 기록",
+    "title": "사용량 및 비용 기록",
     "get_history": "기록 가져오기",
     "executed_at": "실행 날짜",
     "sql_query": "SQL 쿼리",
-    "delayMessage": "검색 기록이 다음과 같이 지연될 수 있습니다."
+    "delayMessage": "사용량 및 비용 기록은 다음만큼 지연될 수 있습니다"
   },
   "correlation": {
     "unstableDimensionNote": "불안정한 차원 - 파드 재시작 시 변경됨. 기본값: 모든 값.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "최신 데이터",
     "dataGettingStale": "데이터가 점점 부실해지고 있습니다",
     "dataStale": "데이터가 오래됨",
-    "lastRefreshed": "마지막 새로 고침: {time}"
+    "lastRefreshed": "마지막 새로 고침: {time}",
+    "refresh": "새로고침",
+    "refreshWithAge": "새로고침, 마지막 새로고침 {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "프로브 오류"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "클릭",
       "actionType": "입력",
       "all": "모두",
@@ -19868,6 +20280,13 @@
       "attemptN": "시도 {n}",
       "detailAction": "작업",
       "detailSelector": "선택기",
+      "detailStepId": "단계 ID",
+      "detailTargetUrl": "대상 URL",
+      "detailStatus": "상태",
+      "detailSkipReason": "건너뛴 이유",
+      "stepStatusSkipped": "건너뜀",
+      "stepStatusUnknown": "알 수 없음",
+      "skippedCount": "{n}개 건너뜀",
       "downloadTrace": "{filename} 다운로드",
       "errorFullscreenTitle": "단계 {id}: {action} - 오류",
       "failedAtStartLoad": "시작 URL을 여는 데 실패했습니다",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "최대 {max}. 재시도는 동일한 작업 내에서 실행되므로 전체 시퀀스가 검사 예산에 맞아야 합니다.",
       "retriesMaxBrowserHint": "브라우저 검사의 최대값은 {max}입니다. 각 시도는 모든 기기에서 여정을 다시 실행하므로, 더 많으면 프로브 시간 초과를 초과하여 사이트에 실제로 없던 실패를 보고하게 됩니다.",
       "retryDelay": "대기 시간",
-      "retryDelaySuffix": "재시도 간격 (ms)",
+      "retryDelaySuffix": "재시도 간격(초).",
       "schedule": "일정",
       "scheduleLater": "나중에 예약",
       "scheduleLaterTooltip": "확인을 활성화할 미래 날짜 및 시간을 선택합니다.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "구성 재시작 — 이 에이전트의 설정 명령을 복사하여 설치 / docker 재시작을 다시 실행합니다 (예: 토큰 회전 후)",
         "noAgents": "이 위치에 등록된 에이전트가 아직 없습니다.",
         "agentsUnavailable": "이 위치의 에이전트는 다른 클러스터에 등록되어 있으므로 여기서 볼 수 없습니다.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "이 위치에서 실행 중인 검사",
         "checkName": "이름",
         "noChecks": "이 위치에 할당된 검사가 아직 없습니다.",
@@ -20546,7 +20967,7 @@
       "nodes": "노드",
       "modelPricing": "모델 가격",
       "searchSchedulers": "검색 스케줄러",
-      "searchHistory": "검색 기록",
+      "searchHistory": "사용량 및 비용 기록",
       "sessions": "세션",
       "evalTemplates": "온라인 평가 — 템플릿",
       "scorers": "온라인 평가 — 스코어러",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "목록 새로고침",
       "alertTemplatesAdd": "새 템플릿 추가",
       "alertTemplatesRefresh": "목록 새로 고침",
-      "logsSearchHistory": "검색 기록 열기",
+      "logsSearchHistory": "사용량 및 비용 기록 열기",
       "alertsImport": "알림 가져오기",
       "panelEditorRun": "쿼리 실행/ 적용",
       "panelEditorSave": "저장 후 계속 편집",
@@ -21131,6 +21552,7 @@
         "system": "시스템"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "정상",
         "passed": "통과",
         "healthy": "정상",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "알림으로 이동하지 못했습니다",
       "alertNotFound": "알림을 찾을 수 없습니다",
-      "alertNotFoundInAlerts": "알림 \"{name}\"을(를) {count}개의 알림에서 찾을 수 없습니다",
       "failedToLoadAlerts": "알림을 로드하지 못했습니다",
       "alertsDeletedSuccessfully": "{count} 알림이 성공적으로 삭제되었습니다 | {count} 알림이 성공적으로 삭제되었습니다",
       "failedToDeleteAlerts": "{count} 알림을 삭제하지 못했습니다 | {count} 알림을 삭제하지 못했습니다",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "템플릿을 불러오는 동안 잠시 기다려 주세요...",
       "alertSavedSuccessfully": "알림이 성공적으로 저장되었습니다.",
       "alertUpdatedSuccessfully": "알림이 성공적으로 업데이트되었습니다.",
-      "openingDedupConfig": "{name}에 대한 중복 제거 구성 열기",
       "editingAlert": "알림 편집 중: {name}",
       "ack": {
         "acked": "{name} 확인함",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "모델 가격 편집기",
     "storageSettings": "스토리지 설정",
     "domainManagement": "도메인 관리",
+    "orgDomainMapping": "도메인 관리",
     "slackApp": "Slack",
     "regexPatterns": "정규식 패턴",
     "syntheticsLocations": "Synthetics 위치",
@@ -26099,7 +26520,7 @@
       "logged": "기록됨"
     },
     "policy": {
-      "gateHint": "기존 알림에 대한 변경 중에서는 중복 제거만 이전 상태 스냅샷과 검토 기간을 동반하여 자체적으로 적용됩니다: 검사를 통과하면 유지되고, 실패하면 롤백됩니다. 그 외의 모든 변경은 원클릭 승인을 기다립니다.",
+      "gateHint": "기존 알림에 대한 변경 중 반복 억제 켜기만 자체적으로 적용되며, 이전 상태 스냅샷과 검토 기간이 함께 제공됩니다. 검사를 통과하면 유지되고, 실패하면 롤백됩니다. 그 외의 모든 변경은 원클릭 승인을 기다립니다.",
       "off": "꺼짐",
       "suggest": "제안",
       "auto": "자동",
@@ -26118,7 +26539,7 @@
         "gateDesc": "조사 결과가 나올 때까지 최대 2분간 호출을 보류합니다. 실패 시 열림(fail open): 트리아지가 시간 초과되거나 실패하면 그대로 호출하고, 조사가 아직 진행 중이거나 실패했다고 알리며, 원인은 스레드에 이어서 표시됩니다."
       },
       "classes": {
-        "EnableDeduplication": "몇 분 내에 반복되는 알림에 대해 중복 제거를 켭니다.",
+        "EnableDeduplication": "매 평가마다 알림을 보내는 알림에 대해 반복 억제를 켭니다.",
         "CreateDetector": "서비스의 요청, 오류 또는 지연 시간에 대한 이상 탐지기를 만듭니다.",
         "RaiseThreshold": "정상적인 날에 발생하는 임계값을 높입니다.",
         "LengthenEvaluationWindow": "요동치는 알림의 평가 기간을 늘립니다.",
@@ -26667,10 +27088,10 @@
           "on": "연결 알림"
         },
         "L-302": {
-          "done": "checkout 지연 알림 3개를 하나로 그룹화했습니다",
-          "why": "94%의 경우 함께 울려서, 지연 한 번에 3번 호출되었습니다.",
-          "from": "알림 3개",
-          "to": "1",
+          "done": "체크아웃 지연 알림 3개에 대해 반복 억제를 켰습니다",
+          "why": "발생 상태가 유지되는 동안 매 평가마다 알림을 보내, 한 번의 지연으로 120번 호출되었습니다.",
+          "from": "매 평가",
+          "to": "변경당 한 번",
           "on": "checkout 지연"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "checkout의 결제 실패 건으로 온콜을 호출했습니다.",
         "recsHeld": "recommendations의 사소한 문제는 금요일 요약을 위해 보류했습니다.",
         "diskApproved": "ingest-1의 디스크 알림을 {to}%로 올리는 것을 승인하셨습니다.",
-        "latencyGrouped": "checkout 지연 알림 세 개를 하나로 묶었습니다. 그래서 한 번의 지연에 대해 한 번만 호출됩니다.",
+        "latencyGrouped": "체크아웃 지연 알림 세 개에 대해 반복 억제를 켰으므로, 한 번의 지연은 한 번만 호출됩니다.",
         "queueFixed": "orders 큐 워커를 추가했지만 큐가 계속 커져서, 다시 되돌리고 온콜을 호출했습니다.",
         "loginPaged": "느린 로그인 건으로 온콜을 호출했습니다.",
         "queuePermission": "제가 직접 큐 워커를 최대 8개까지 추가할 수 있도록 허용하셨습니다.",
@@ -28083,5 +28504,71 @@
       "legend": "파이프라인 상태",
       "legendToggle": "맵에서 이 상태 표시 또는 숨기기"
     }
+  },
+  "recentSearches": {
+    "title": "최근 검색",
+    "aboutKeptDays": "{org}에서 수행한 본인의 검색만 표시되며 본인만 볼 수 있습니다. {days}일 동안 보관되며, 별표 표시한 검색은 직접 삭제할 때까지 유지됩니다. | {org}에서 수행한 본인의 검색만 표시되며 본인만 볼 수 있습니다. {days}일 동안 보관되며, 별표 표시한 검색은 직접 삭제할 때까지 유지됩니다.",
+    "aboutKeptForever": "{org}에서 수행한 본인의 검색만 표시되며 본인만 볼 수 있습니다. 삭제할 때까지 보관됩니다.",
+    "pageTitle": {
+      "logs": "최근 로그 검색",
+      "traces": "최근 트레이스 검색",
+      "metrics": "최근 메트릭 검색",
+      "dbm": "최근 검색",
+      "profiles": "최근 검색"
+    },
+    "page": {
+      "logs": "로그",
+      "traces": "트레이스",
+      "metrics": "메트릭",
+      "dbm": "데이터베이스",
+      "profiles": "프로파일"
+    },
+    "allPages": "모든 페이지",
+    "viewAll": "모두 보기",
+    "failedCount": "{count}개 실패",
+    "keyHints": "↑↓ 이동 · PgUp/PgDn 쿼리 스크롤 · Enter 실행 · Shift+Enter 불러오기만 · Esc 닫기",
+    "loadToFix": "불러와서 수정",
+    "emptyTitle": "최근 검색이 없습니다",
+    "loadError": "최근 검색을 불러오지 못했습니다",
+    "retry": "다시 시도",
+    "warning": "경고와 함께 완료됨: 시간 초과 또는 일부 결과",
+    "failed": "실패",
+    "ranCount": "{count}회 실행",
+    "lineCount": "{count}줄 | {count}줄",
+    "relativeWindow": "최근 {period}",
+    "rerunNow": "지금 다시 실행",
+    "rerunOriginal": "원래 시각 기준",
+    "loadOnly": "실행하지 않고 불러오기",
+    "copyLink": "링크 복사",
+    "copyQuery": "쿼리 복사",
+    "star": "별표",
+    "unstar": "별표 해제",
+    "linkCopied": "링크가 복사되었습니다",
+    "queryCopied": "쿼리가 복사되었습니다",
+    "copyFunction": "함수 복사",
+    "functionCopied": "함수가 복사되었습니다",
+    "functionLabel": "함수 (VRL)",
+    "searchPlaceholder": "쿼리 및 스트림 검색",
+    "allStreams": "모든 스트림",
+    "statusAll": "모든 상태",
+    "statusOk": "성공",
+    "statusError": "실패",
+    "starredOnly": "별표만",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "실행 날짜로 필터",
+    "today": "오늘",
+    "yesterday": "어제",
+    "noMatch": "이 필터와 일치하는 검색이 없습니다",
+    "reset": "모두 초기화",
+    "resetFilters": "필터 초기화",
+    "loadMore": "더 보기",
+    "clear": "내 기록 지우기",
+    "confirmClear": "기록 지우기",
+    "clearBodyPage": "이 작업은 {org}의 최근 {page} 검색 {count}개를 삭제합니다. 저장된 뷰는 영향을 받지 않습니다. | 이 작업은 {org}의 최근 {page} 검색 {count}개를 삭제합니다. 저장된 뷰는 영향을 받지 않습니다.",
+    "clearBodyAll": "이 작업은 로그, 트레이스, 메트릭 전반에 걸쳐 {org}의 최근 검색 {count}개를 삭제합니다. 저장된 뷰는 영향을 받지 않습니다. | 이 작업은 로그, 트레이스, 메트릭 전반에 걸쳐 {org}의 최근 검색 {count}개를 삭제합니다. 저장된 뷰는 영향을 받지 않습니다.",
+    "includeStarred": "별표 표시한 검색 {count}개도 함께 삭제 | 별표 표시한 검색 {count}개도 함께 삭제",
+    "recentRow": "최근 검색",
+    "deletedQuery": "{query} 삭제됨",
+    "undo": "실행 취소"
   }
 }
diff --git a/web/src/locales/languages/nl-NL.json b/web/src/locales/languages/nl-NL.json
index f79b80eaf6..ff3cf8b46e 100644
--- a/web/src/locales/languages/nl-NL.json
+++ b/web/src/locales/languages/nl-NL.json
@@ -486,7 +486,11 @@
       "monitors": "monitors",
       "modelPricing": "prijsdefinities voor modellen",
       "variables": "variabelen",
-      "experiments": "experimenten"
+      "experiments": "experimenten",
+      "linkedDomains": "gekoppelde domeinen",
+      "domainMappings": "domeinmappings",
+      "domainRequests": "koppelverzoeken",
+      "blockedUsers": "geblokkeerde gebruikers"
     },
     "demo": {
       "pageTitle": "Lege statussen — volledige set ter beoordeling",
@@ -572,6 +576,30 @@
       "action": "Nieuwe taak",
       "actionDesc": "Wijs OpenObserve naar uw endpoint en test de verbinding."
     },
+    "noLinkedDomains": {
+      "title": "Nog geen gekoppelde domeinen",
+      "description": "Koppel een e-maildomein dat je bezit om de gebruikers ervan aan je organisaties toe te wijzen en te bepalen wie kan inloggen.",
+      "dns": "Een DNS-record toevoegen",
+      "dnsDesc": "Verifieer eigenaarschap met een TXT-record",
+      "request": "Een koppeling aanvragen",
+      "requestDesc": "Vraag OpenObserve om het domein voor je te koppelen"
+    },
+    "noDomainMappings": {
+      "title": "Nog geen domeinmappings",
+      "description": "Voeg automatisch gebruikers die met een geverifieerd domein inloggen toe aan deze organisatie of aan leden van de facturatiegroep.",
+      "action": "Mapping toevoegen",
+      "actionDesc": "Kies een domein, een organisatie en een rol"
+    },
+    "noBlockedUsers": {
+      "title": "Geen geblokkeerde gebruikers",
+      "description": "Elke gebruiker van je geverifieerde domeinen kan lid worden. Blokkeer specifieke gebruikers om ze buiten te houden.",
+      "action": "Gebruikers blokkeren",
+      "actionDesc": "Kies een domein en de e-mailadressen die je wilt blokkeren"
+    },
+    "noDomainRequests": {
+      "title": "Geen koppelverzoeken",
+      "description": "Verzoeken van organisaties om een domein te koppelen verschijnen hier."
+    },
     "noDowntimes": {
       "title": "Nog geen onderhoudsperiodes",
       "description": "Een onderhoudsperiode laat alarmen, anomaliedetecties en synthetische checks doorlopen en stopt hun meldingen gedurende een venster dat je plant.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Live-modus uitschakelen",
     "autoRefreshWithValue": "Automatisch verversen: {value}",
     "searchHistory": "Zoekgeschiedenis",
+    "usageCostHistory": "Gebruik & kostenhistorie",
     "createScheduledSearch": "Geplande zoekopdracht aanmaken",
     "listScheduledSearch": "Geplande zoekopdracht weergeven",
     "scheduleSearchJob": "Zoektaak plannen",
@@ -1355,6 +1384,8 @@
     "scanSize": "Scangrootte",
     "deltaScanSize": "Delta-scangrootte",
     "scannedSoFar": "Gescand: {size}",
+    "quickModeHiddenFields": "Snelle modus staat aan. Deze rij toont {shown} van {total} velden.",
+    "turnOffQuickMode": "Snelle modus uitzetten",
     "resultsProgressLabel": "Zoekvoortgang",
     "histogramTitleError": "Fout bij het genereren van de histogramtitel.",
     "selectLogStream": "Logstream selecteren",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Geen netwerkgegevens voor deze weergave",
     "apiEmptyDescription": "De geselecteerde stream heeft geen resource- of netwerkverzoeken in dit tijdsbereik. Netwerkmetrieken verschijnen zodra de app zijn HTTP-aanroepen instrumenteert.",
     "skipInactivity": "Inactiviteit overslaan",
+    "fullScreen": "Volledig scherm",
+    "exitFullScreen": "Volledig scherm sluiten",
     "error": "Fout",
     "errorCount": "Aantal fouten",
     "all": "Alles",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Voeg een tweede stap toe om deze funnel aan een dashboard toe te voegen",
         "snapshot": "Het paneel behoudt deze stappen, filters en regels voor benoemde gebeurtenissen zoals ze nu zijn."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Prestatieoverzicht",
+      "filterService": "Service",
+      "filterEnv": "Omgeving",
+      "filterVersion": "Versie",
+      "filterAll": "Alle",
+      "verdictPass": "Core Web Vitals voldoen",
+      "verdictFail": "Core Web Vitals vragen aandacht",
+      "verdictAllPass": "Alles voldoet",
+      "verdictNeedWork": "{count} van {total} vraagt aandacht | {count} van {total} vragen aandacht",
+      "percentileLabel": "Percentiel",
+      "bandGood": "Goed",
+      "bandNeeds": "Aandacht nodig",
+      "bandPoor": "Slecht",
+      "bandGoodPct": "{n}% goed",
+      "bandNeedsPct": "{n}% aandacht nodig",
+      "bandPoorPct": "{n}% slecht",
+      "bandAria": "{good}% goed, {needs}% aandacht nodig, {poor}% slecht",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} sneller",
+      "deltaSlower": "{v} langzamer",
+      "deltaNone": "geen wijziging",
+      "deltaNoPrev": "onvoldoende eerdere gegevens",
+      "kpiSessions": "Sessies",
+      "kpiErrorFree": "Sessies zonder fouten",
+      "kpiErrors": "Totaal aantal fouten",
+      "kpiUnhandled": "Niet-afgehandelde fouten",
+      "kpiRegion": "Kernindicatoren",
+      "sparkAria": "Trend van {label} over de geselecteerde periode",
+      "chartTitle": "Sessies en fouten",
+      "chartInterval": "per bucket",
+      "legendSessions": "Sessies",
+      "legendErrors": "Fouten",
+      "releaseMarker": "{version} voor het eerst gezien op {time}",
+      "chartTableToggle": "Gegevenstabel tonen",
+      "chartTableHide": "Gegevenstabel verbergen",
+      "chartTime": "Tijd",
+      "pagesTitle": "Pagina's die eerst aangepakt moeten worden",
+      "pagesHint": "Gerangschikt op impact: verkeer gewogen naar het aandeel weergaven waarbij een vital de drempel overschrijdt of een fout optreedt. Klik op een pagina voor de sessies, op een foutenaantal voor Error Tracking.",
+      "pagesColPage": "Pagina",
+      "pagesColViews": "Weergaven",
+      "pagesColErrors": "Fouten",
+      "pagesColImpact": "Impact",
+      "pagesLegend": "▲ aandacht nodig · ■ slecht · niet gemarkeerd is goed. Pagina's met minder dan {n} weergaven worden verborgen.",
+      "pagesOpenSessions": "Sessies openen voor {path}",
+      "pagesOpenErrors": "{count} fout, Error Tracking openen | {count} fouten, Error Tracking openen",
+      "pagesImpactAria": "Impact {n} van 100",
+      "markNeeds": "aandacht nodig",
+      "markPoor": "slecht",
+      "diffTitle": "Grootste verschil",
+      "diffBody": "INP p75 is {inp}, {ratio}x de andere segmenten. Een correlatie om te onderzoeken, geen bewezen oorzaak.",
+      "diffNone": "Geen enkel segment springt er in dit bereik uit.",
+      "diffLink": "Bekijk getroffen sessies",
+      "segmentLabel": "Segment",
+      "segBrowser": "Browser",
+      "segDevice": "Apparaat",
+      "segCountry": "Land",
+      "segInp": "INP {v}",
+      "segShare": "{n}% van de weergaven",
+      "segNone": "Geen gegevens voor dit segment.",
+      "releaseTitle": "Releasevergelijking",
+      "releaseHint": "{cur} tegenover {prev}. De start van een release is het moment waarop een versie voor het eerst wordt gezien.",
+      "releaseMetric": "Metriek",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Foutloos",
+      "releaseSessions": "Sessies",
+      "releaseLink": "Fouten in {version}",
+      "frustrationTitle": "Gebruikersfrustratie",
+      "frustrationHint": "Pijn die de vitals niet opvangen",
+      "rageClicks": "Rage clicks",
+      "deadClicks": "Dode klikken",
+      "stateLoading": "Bezig met laden: {panel}…",
+      "stateEmptyTitle": "Geen paginaweergaven in dit bereik",
+      "stateEmptyBody": "Verbreed het tijdsbereik, wis een filter of controleer of de browser-SDK weergavegebeurtenissen verstuurt.",
+      "stateEmptyAction": "SDK instellen",
+      "stateLowTitle": "Slechts {count} paginaweergave | Slechts {count} paginaweergaven",
+      "stateLowBody": "Percentielen zijn onbetrouwbaar onder {min} weergaven, dus het oordeel is verborgen. Waarden worden ter referentie getoond.",
+      "stateErrorTitle": "Kan {panel} niet laden",
+      "stateErrorBody": "De query is mislukt of er is een time-out opgetreden. Andere panels zijn niet getroffen.",
+      "retry": "Opnieuw proberen",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "kernindicatoren",
+      "panelPages": "pagina's",
+      "panelSegments": "segmenten",
+      "panelRelease": "releasevergelijking",
+      "panelFrustration": "gebruikersfrustratie",
+      "schemaErrorTitle": "Kan het RUM-schema niet laden",
+      "schemaErrorBody": "De streamvelden konden niet worden gelezen, dus het overzicht kan niet bepalen welke panels moeten worden getoond.",
+      "pagesShowAll": "Alle {n} pagina's tonen",
+      "pagesShowFewer": "Minder pagina's tonen",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Geen pagina's met genoeg weergaven",
+      "pagesEmptyBody": "Pagina's hebben minstens {n} weergaven in dit bereik nodig om te worden gerangschikt.",
+      "segEmptyTitle": "Geen segmentgegevens",
+      "segEmptyBody": "Er zijn geen browser-, apparaat-, OS-, land- of verbindingswaarden vastgelegd voor deze weergaven.",
+      "releaseEmptyTitle": "Twee versies nodig",
+      "releaseEmptyBody": "Releasevergelijking vereist minstens twee versies die in dit bereik zijn waargenomen.",
+      "releaseBefore": "{version} was al live vóór dit bereik, dus de eerste waarnemingstijd wordt niet getoond.",
+      "pageErrorTitle": "Kan het prestatieoverzicht niet laden",
+      "pageErrorBody": "De query's zijn mislukt of hebben een time-out gehad. Probeer opnieuw om elk paneel weer te laden.",
+      "verdictOver": "{vital} ligt boven de goede drempel van {threshold} voor {pct}% van de paginaweergaven.",
+      "verdictAllThree": "Alle drie de Core Web Vitals voldoen op p75.",
+      "verdictAllSome": "Alle {n} beoordeelde Core Web Vitals voldoen op p75.",
+      "releaseNewErrors": "{count} nieuwe fout in deze release | {count} nieuwe fouten in deze release",
+      "verdictNoData": "Geen Core Web Vitals-gegevens",
+      "verdictNoDataLead": "Geen van de {count} paginaweergaven in dit bereik heeft LCP, INP of CLS gerapporteerd. | Geen van de {count} paginaweergaven in dit bereik heeft LCP, INP of CLS gerapporteerd.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Sessies openen.",
+      "pagesTableLabel": "Pagina's gerangschikt op impact",
+      "verdictSessions": "{count} sessie in het bereik. | {count} sessies in het bereik.",
+      "verdictCompare": "Vergeleken met de vorige periode.",
+      "deltaLower": "{v} lager",
+      "deltaHigher": "{v} hoger",
+      "forbiddenTitle": "Geen toestemming om {panel} te bekijken",
+      "forbiddenBody": "Vraag een beheerder om toegang tot de RUM-stream.",
+      "pageForbiddenTitle": "Geen toestemming om het prestatieoverzicht te bekijken",
+      "asideLabel": "Waar en wat is gewijzigd",
+      "pagesAbout": "Over deze rangschikking",
+      "chartPerFiveMinutes": "per 5 minuten",
+      "chartPerThirtyMinutes": "per 30 minuten",
+      "chartPerHour": "per uur",
+      "chartPerSixHours": "per 6 uur",
+      "chartPerDay": "per dag",
+      "chartIntervalOther": "per bucket",
+      "chartTableCaption": "Sessies en fouten per bucket",
+      "deltaChange": "{delta} t.o.v. vorige periode",
+      "deltaChangePts": "{delta} punten t.o.v. vorige periode",
+      "deltaFlat": "Geen wijziging t.o.v. vorige periode",
+      "deltaNewMsg": "Nieuw t.o.v. vorige periode",
+      "verdictP75Note": "Het oordeel gebruikt altijd p75; p50 en p95 wijzigen alleen de waarden.",
+      "releaseNote": "Vergelijkt de twee nieuwste versies, ongeacht wat het filter Versie aangeeft.",
+      "kpiEmptyTitle": "Geen sessies in dit bereik",
+      "kpiEmptyBody": "Verbreed het tijdsbereik of wis een filter.",
+      "releaseImproved": "verbeterd",
+      "releaseWorse": "slechter",
+      "segOs": "OS",
+      "segConnection": "Verbinding",
+      "pagesAllLink": "Alle pagina's",
+      "pagesAllLinkAria": "Alle pagina's in Productanalyse",
+      "frustrationReplayLink": "Bekijk een replay",
+      "frustrationReplayHint": "Opent de gefrustreerde sessies in dit bereik; de opgenomen sessies hebben een replay.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "In dit bereik is niets vastgelegd. Verbreed het tijdsbereik, of stel de browser-SDK in als deze app nog geen gegevens heeft verzonden.",
+      "stateEmptyFiltered": "Niets komt overeen met deze filters in dit bereik. Wis de filters om elke service, omgeving en versie te zien.",
+      "clearFilters": "Filters wissen",
+      "stateRefreshing": "Bezig met vernieuwen van {panel}",
+      "tileOpenSessions": "{label}: {value}. Sessies openen",
+      "tileOpenErrors": "{label}: {value}. Foutopsporing openen",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Dit overzicht telt alleen browsersessies. Metrieken van mobiele apps staan hieronder.",
+      "mixedMobileNote": "De onderstaande filters zijn alleen van toepassing op de metrieken van mobiele apps."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Verwijderen",
     "confirmDeleteHead": "Gebruiker verwijderen",
     "confirmDeleteMsg": "Weet je zeker dat je de gebruiker {name} wilt verwijderen?",
+    "block": "Blokkeren",
+    "confirmBlockHead": "Gebruiker blokkeren",
+    "confirmBlockMsg": "{email} is lid geworden via je geverifieerde domein. Door te blokkeren wordt deze gebruiker toegevoegd aan de domeinbeperkingen van deze organisatie en uit deze organisatie verwijderd. Bij de volgende aanmelding wordt de gebruiker uit andere gemapte organisaties verwijderd.",
     "cancel": "Annuleer",
     "save": "Opslaan",
     "ok": "Oké",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Uitnodiging intrekken",
     "revokeInvitationMsg": "Weet je zeker dat je de uitnodiging voor {email} wilt intrekken?",
     "deleteUsersTitle": "Gebruikers verwijderen",
-    "deleteUsersMsg": "Weet je zeker dat je {count} gebruiker wilt verwijderen? | Weet je zeker dat je {count} gebruikers wilt verwijderen?"
+    "deleteUsersMsg": "Weet je zeker dat je {count} gebruiker wilt verwijderen? | Weet je zeker dat je {count} gebruikers wilt verwijderen?",
+    "deleteUsersBlockNote": "{count} van hen is via je geverifieerde domein lid geworden en wordt geblokkeerd in plaats van verwijderd."
   },
   "invitation": {
     "pendingInvitations": "Uitnodigingen in behandeling",
@@ -3403,8 +3597,6 @@
       },
       "show": "Toon",
       "searchPermissions": "Machtigingen zoeken",
-      "filterModules": "Modules filteren",
-      "noModuleMatch": "Geen module komt overeen met je filter",
       "moduleScopeAll": "Alle",
       "moduleScopeGranted": "Geselecteerd",
       "noGrantedModule": "Nog geen module geselecteerd",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Toekenning | Toekenningen",
       "summaryReachSome": "{count} van {total}",
       "summaryEmptyTitle": "Deze rol verleent nog niets",
-      "summaryEmptyDescription": "Kies een module aan de linkerkant of begin met een voorinstelling.",
+      "summaryEmptyDescription": "Begin met een voorinstelling of kies modules uit de lijst.",
       "presetReadonlyTitle": "Alleen-lezen",
       "presetReadonlyDescription": "List en get op elke module",
       "presetDbmTitle": "Database Monitoring Viewer",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "Geen van de {total} Kubernetes-metriekstreams bestaat nog in deze organisatie, dus er is niets vooraf geselecteerd.",
       "rumPresetSeeded": "Leestoegang vooraf geselecteerd op {matched} van {total} RUM-streams, plus source maps en eventuele RUM Product Analytics-toekenningen. Controleer voor het opslaan.",
       "rumPresetNoMatch": "Geen van de {total} RUM-streams bestaat al in deze organisatie, dus er is niets vooraf op geselecteerd; source maps en eventuele RUM Product Analytics-toekenningen zijn wel klaargezet.",
-      "moduleGroupFleet": "Fleet"
+      "moduleGroupFleet": "Fleet",
+      "filterModulesTasks": "Modules filteren",
+      "noModuleMatchQuery": "Geen module komt overeen met “{query}”",
+      "noModuleMatchHint": "Zoek op module, groep of taak, bijvoorbeeld slack, panel of token.",
+      "presetAlertManagerTitle": "Alarmbeheerder",
+      "presetAlertManagerDescription": "Alarmen aanmaken en beheren, waar ze naartoe gaan en hun berichten",
+      "presetAlertViewerTitle": "Alarmviewer",
+      "presetAlertViewerDescription": "Alarmen, bestemmingen en sjablonen bekijken zonder ze te wijzigen",
+      "presetDashboardEditorTitle": "Dashboard-editor",
+      "presetDashboardEditorDescription": "Dashboards bouwen en bewerken, met leestoegang tot de gegevens die ze opvragen",
+      "presetDashboardViewerTitle": "Dashboard-viewer",
+      "presetDashboardViewerDescription": "Dashboards openen en de gegevens achter hun panelen lezen",
+      "presetPipelineEditorTitle": "Pipeline-editor",
+      "presetPipelineEditorDescription": "Pipelines en functies bouwen, met leestoegang tot streams en verrijkingstabellen",
+      "presetApplied": "{title}: {permissions} toegevoegd. Controleer de wijzigingen voordat je opslaat.",
+      "presetPermissionCount": "{count} machtiging | {count} machtigingen",
+      "companionReasonAlertStreams": "om alarmen op te slaan. De server controleert bij het opslaan de toegang tot streams",
+      "companionReasonAlertDestinations": "om te kiezen waar alarmen naartoe gaan",
+      "companionReasonDestinationTemplates": "om het berichtsjabloon te kiezen, dat elke bestemming vereist",
+      "companionReasonDashboardStreams": "om paneelgegevens te laden",
+      "presetsTitle": "Voorinstellingen",
+      "presetsClose": "Voorinstellingen sluiten",
+      "presetsShow": "Voorinstellingen tonen",
+      "presetsSubtitle": "Voeg de toekenningen van een voorinstelling toe aan deze rol. Er wordt niets verwijderd.",
+      "presetsSectionBuiltin": "Ingebouwd",
+      "presetsSectionJob": "Per functie",
+      "presetAddsTooltip": "Voegt {count} machtiging toe | Voegt {count} machtigingen toe",
+      "presetInRole": "In rol",
+      "presetInRoleTooltip": "Deze rol heeft al alles uit deze voorinstelling",
+      "presetBack": "Alle voorinstellingen",
+      "presetModuleCount": "{count} module | {count} modules",
+      "presetSummaryAdds": "Voegt {permissions} toe in {modules}.",
+      "presetSummaryWrite": "Schrijftoegang in {modules}.",
+      "presetSummaryViewOnly": "Alleen bekijken: er kan niets worden aangemaakt, bewerkt of verwijderd.",
+      "presetSummaryHasAll": "Deze rol heeft al alles uit deze voorinstelling.",
+      "presetSummarySkipped": "{count} machtiging die al in deze rol zit, wordt overgeslagen. | {count} machtigingen die al in deze rol zitten, worden overgeslagen.",
+      "presetStillMissing": "Ontbreekt nog na toevoegen: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "Na het toevoegen ontbreekt er niets.",
+      "neededBy": "Nodig voor {modules}",
+      "stillNeededBy": "Nog steeds nodig voor {modules}",
+      "presetReadsEveryStream": "Leest alle streams in deze organisatie, ook nieuwe.",
+      "presetAddButton": "{count} machtiging toevoegen | {count} machtigingen toevoegen",
+      "presetNothingToAdd": "Niets toe te voegen",
+      "presetApplyNote": "Toegevoegde toekenningen worden niet-opgeslagen wijzigingen. Controleer ze voordat je opslaat.",
+      "presetLoadingStreams": "Streams laden",
+      "presetNoMatchingStreams": "Nog geen overeenkomende streams in deze organisatie.",
+      "reviewMissingTooltip": "{count} module ontbreekt om deze rol te laten werken | {count} modules ontbreken om deze rol te laten werken",
+      "notAddedYetTitle": "Nog niet toegevoegd · {modules}",
+      "companionAdd": "Toevoegen",
+      "companionAddItem": "{item} toevoegen",
+      "companionAddAll": "Alles toevoegen",
+      "companionOpenStreams": "Streams openen",
+      "companionOpenStreamsTooltip": "Kies welke streams deze rol kan lezen",
+      "companionNeeds": "{module} heeft het nodig {reason}.",
+      "companionNeedsThis": "{module} heeft dit nodig {reason}.",
+      "companionStillNeedsThis": "{module} heeft dit nog steeds nodig {reason}.",
+      "yourChanges": "Je wijzigingen",
+      "yourChangesCount": "{changes} in {modules}",
+      "yourChangesNone": "Nog geen",
+      "changeCount": "{count} wijziging | {count} wijzigingen",
+      "changeOtherGroup": "Overig",
+      "saveSuccessCounts": "{changes} in {modules} opgeslagen.",
+      "effectCan": "Kan {target} {actions}.",
+      "effectCannot": "Kan {target} niet meer {actions}.",
+      "effectCanLoadDestinations": "Kan de lijst met bestemmingen laden.",
+      "effectCannotLoadDestinations": "Kan de lijst met bestemmingen niet meer laden.",
+      "effectCanLoadTemplates": "Kan de lijst met sjablonen laden.",
+      "effectCannotLoadTemplates": "Kan de lijst met sjablonen niet meer laden.",
+      "verbView": "bekijken",
+      "verbSeeListOf": "in de lijst zien",
+      "verbList": "in de lijst zien",
+      "verbOpen": "openen",
+      "verbCreate": "aanmaken",
+      "verbEdit": "bewerken",
+      "verbDelete": "verwijderen",
+      "targetEveryStream": "elke stream (logs, metrieken, traces en indexen), inclusief nieuwe",
+      "targetTypeStreams": "alle {type}-streams",
+      "targetOneStream": "de {type}-stream {name}",
+      "targetAlertsEveryFolder": "alarmen in elke map, inclusief nieuwe mappen",
+      "targetAlertsInFolder": "alarmen in de map {name}",
+      "targetOneAlert": "het alarm {name}",
+      "targetDashboardsEveryFolder": "dashboards in elke map, inclusief nieuwe mappen",
+      "targetDashboardsInFolder": "dashboards in de map {name}",
+      "targetOneDashboard": "het dashboard {name}",
+      "targetReportsEveryFolder": "rapporten in elke map, inclusief nieuwe mappen",
+      "targetReportsInFolder": "rapporten in de map {name}",
+      "targetOneReport": "het rapport {name}",
+      "targetEveryDestination": "elke alarmbestemming (Slack, e-mail, webhooks), inclusief nieuwe",
+      "targetOneDestination": "de bestemming {name}",
+      "targetEveryTemplate": "elk meldingssjabloon, inclusief nieuwe",
+      "targetOneTemplate": "het sjabloon {name}",
+      "targetAllOf": "alle {module}, inclusief nieuwe",
+      "targetItemIn": "{name} in {module}",
+      "noteDestinationsFiltered": "Ze zien alleen de bestemmingen die ze ook kunnen openen. Voeg hier, of bij afzonderlijke bestemmingen, “Krijg” toe om te kiezen welke.",
+      "noteTemplatesFiltered": "Ze zien alleen de sjablonen die ze ook kunnen openen. Voeg hier, of bij afzonderlijke sjablonen, “Krijg” toe om te kiezen welke.",
+      "presetStreamsFailed": "De lijst met streams kon niet worden geladen.",
+      "presetRetry": "Opnieuw proberen",
+      "presetRestored": "{title}: {permissions} hersteld. Controleer de wijzigingen voordat je opslaat.",
+      "presetSummaryRestores": "Behoudt {count} machtiging die je hebt gemarkeerd om te verwijderen. | Behoudt {count} machtigingen die je hebt gemarkeerd om te verwijderen.",
+      "presetRestoreButton": "{count} machtiging behouden | {count} machtigingen behouden",
+      "effectStillAllowed": "Geen wijziging in toegang: een ruimere toekenning staat dit nog steeds toe."
     },
     "rolesPage": {
       "subtitle": "Rollen bundelen machtigingen — wijs ze toe aan gebruikers, serviceaccounts of groepen om toegang te verlenen.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Gebruiker succesvol bijgewerkt.",
       "userDeletedSuccess": "Gebruiker succesvol verwijderd.",
       "errorDeletingUser": "Fout bij het verwijderen van gebruiker.",
+      "userBlockedSuccess": "Gebruiker succesvol geblokkeerd.",
+      "errorBlockingUser": "Fout bij het blokkeren van de gebruiker.",
+      "blockedButNotRemoved": "Gebruiker is geblokkeerd, maar kon niet uit deze organisatie worden verwijderd.",
+      "blockedUsersSuccess": "{count} gebruiker geblokkeerd | {count} gebruikers geblokkeerd",
+      "blockedUsersPartial": "{count} gebruiker geblokkeerd en verwijderd, maar {failed} kon niet uit deze organisatie worden verwijderd | {count} gebruikers geblokkeerd en verwijderd, maar {failed} konden niet uit deze organisatie worden verwijderd",
+      "blockedUsersNotRemoved": "{count} gebruiker geblokkeerd, maar kon niet uit deze organisatie worden verwijderd | {count} gebruikers geblokkeerd, maar konden niet uit deze organisatie worden verwijderd",
       "pleaseWait": "Even wachten...",
       "invitationRevokedSuccess": "Uitnodiging succesvol ingetrokken.",
       "errorRevokingInvitation": "Fout bij het intrekken van uitnodiging.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Traces worden vastgelegd met eBPF: er zijn geen codewijzigingen of SDK nodig. Tracecontext gaat alleen via plain-text HTTP tussen services mee (bij Go-apps ook via HTTPS, behalve op nodes met kernel lockdown). Een proces dat overeenkomt met een van de poorten, het pad naar het uitvoerbare bestand of de opdrachtregel wordt getraceerd; globs mogen geen `,`, `{'{'}` of `{'}'}` bevatten, en een poort komt overeen met elk proces dat er een socket op heeft. Vereist Helm 3.14+ en OpenTelemetry-operator v0.142.0+; is die van jou ouder, werk hem dan eerst bij met `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Was eBPF al ingeschakeld met een oudere operator, voer de opdracht dan opnieuw uit met `--force` (`--force-replace` bij Helm 4). Opnieuw uitvoeren van de installatieopdracht hierboven zet de release terug en schakelt eBPF uit, dus voer deze opdracht daarna opnieuw uit. De namespace `openobserve-collector` moet geprivilegieerde pods toestaan, en nodes moeten Linux draaien op amd64 of arm64 met kernel 5.8+ (of RHEL-familie 4.18 met eBPF-backports) en BTF. Selecteer geen apps die al hun eigen traces versturen, en geen pods die de Go-sidecar `inject-go` gebruiken.",
       "k8sEbpfVariant": "eBPF (elke taal, geen codewijzigingen)",
       "k8sLibrariesVariant": "Taalbibliotheken (automatische instrumentatie)",
+      "k8sNetworkFlowsDesc": "De eBPF-DaemonSet van de collector registreert de **bytes die tussen workloads worden verzonden via elk TCP- of UDP-protocol** op elke Linux-node, inclusief databases, caches en andere services die niet worden getraceerd. Ze komen binnen als de metriek `obi_network_flow_bytes`, gelabeld met de eigenaar van de bron en de bestemming (Deployment, StatefulSet, Node, …) en de namespace. Werkt met of zonder eBPF-tracing.",
+      "k8sNetworkFlowsNote": "Vereist Helm 3.14+ en OpenTelemetry-operator v0.142.0+. De namespace `openobserve-collector` moet geprivilegieerde pods toestaan, en nodes moeten Linux op amd64 of arm64 draaien met kernel 5.8+ (of RHEL-familie 4.18 met eBPF-backports) en BTF. De eBPF-pods draaien op het hostnetwerk, en de eigen metrieken van de collector luisteren op `127.0.0.1:8888` van elke node, dus die poort moet daar vrij zijn. eBPF-trace-selectors die je al hebt ingesteld, blijven behouden. Als je het installatiecommando hierboven opnieuw uitvoert, wordt de release gereset en wordt dit uitgeschakeld; voer dit commando daarna opnieuw uit. Dezelfde bytes kunnen meer dan eens worden gerapporteerd: verkeer tussen nodes door beide nodes, en een verbinding naar een Service wordt zowel aan de Service als aan de workload erachter toegerekend. De gids over eBPF-netwerkstromen legt uit hoe je ze bevraagt zonder dubbel te tellen.",
+      "k8sNetworkFlowsTitle": "Zie welke workloads met elkaar communiceren: eBPF-netwerkstromen",
       "k8sInstallerNote": "Dit installeert automatisch cert-manager, de OpenTelemetry-operator en de OpenObserve-collector.",
       "k8sInternalEndpointNote": "Gebruik dit wanneer OpenObserve in hetzelfde cluster draait — verkeer verlaat het dan nooit.",
       "k8sTroubleAnnotationA": "Injectie vindt plaats bij het aanmaken van de pod, dus bestaande pods worden niet beïnvloed tot ze opnieuw opstarten — voer `kubectl rollout restart deployment -n my-namespace` uit. Bevestig dat de annotatie is geplaatst met `kubectl get ns my-namespace -o yaml` en controleer dat de waarde overeenkomt met `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "De installatie mislukt met een fout over de admission webhook",
       "linuxAgentFixBody": "De installateur start de agent als een systemd-service. Als er niets aankomt, bevestig dan dat deze draait en lees de logs voor een authenticatie- of connectiviteitsfout:",
       "linuxTracesNote": "Traces worden vastgelegd met eBPF: er zijn geen codewijzigingen of SDK nodig. Een proces dat overeenkomt met een van de poorten, het pad naar het uitvoerbare bestand of de opdrachtregel wordt getraceerd; globs mogen geen `,`, `{'{'}` of `{'}'}` bevatten. Traceren vereist Linux 5.8+ (of RHEL-familie 4.18 met eBPF-backports) met BTF; de agent draait dan als root. Als de host niet kan traceren, stopt de installatie en blijft de draaiende agent onaangeroerd. Als de agent daarna niet start terwijl tracering aan staat, wordt tracering uitgeschakeld — en ook logs en metrieken — totdat je de opdracht **Logs en metrieken** opnieuw uitvoert, of de oorzaak oplost en opnieuw uitvoert met tracering. Getraceerde apps voegen een W3C-header `traceparent` toe aan uitgaande plain-text HTTP-verzoeken. De eBPF-traceringshandleiding hieronder behandelt HTTPS en het herhalen van flags.",
+      "linuxNetworkFlowsDesc": "Voer de installer uit met `--network-flows` om de **bytes die deze host verzendt en ontvangt via elk TCP- of UDP-protocol** te rapporteren, als de metriek `obi_network_flow_bytes`. Elke flow krijgt de labels `src_cidr` en `dst_cidr` met de netwerken die je opgeeft, dus geef elke host dezelfde lijst: één `/32`-vermelding per host geeft een host-naar-host-overzicht.",
+      "linuxNetworkFlowsNote": "Vereist Linux 5.8+ (of RHEL-familie 4.18 met eBPF-backports) met BTF; de agent draait dan als root. Het werkt met of zonder tracing, maar elke keer dat de installer draait, wordt de configuratie van de agent vervangen: om tracing aan te houden, voeg je de vlaggen `--trace-*` en `--service-name` toe uit het commando **Logs, metrieken & eBPF-traces**. Als de host geen eBPF kan draaien, stopt de installatie en blijft de draaiende agent ongewijzigd. Als het vastleggen van netwerkverkeer dan niet start, wordt de agent uitgeschakeld — logs en metrieken ook — totdat je het commando **Logs & metrieken** opnieuw uitvoert, of de oorzaak oplost en opnieuw uitvoert met `--network-flows`. Verkeer tussen twee hosts die beide de agent draaien, wordt door elk van hen gerapporteerd, en loopbackverkeer wordt geteld tenzij beide uiteinden hetzelfde adres hebben. De gids over eBPF-netwerkstromen hieronder legt de labels uit en hoe je ze bevraagt zonder dubbel te tellen.",
+      "linuxNetworkFlowsTitle": "Zie welke hosts met elkaar communiceren: eBPF-netwerkstromen",
       "linuxTracesVerifyNote": "Met tracing aan verschijnen traces zodra een getracete app een verzoek afhandelt.",
+      "ebpfNetworkFlowsGuideLink": "Gids voor eBPF-netwerkstromen",
       "ebpfTracingGuideLink": "eBPF-tracinghandleiding",
       "logsMetricsTracesVariant": "Logs, metrieken en eBPF-traces",
       "logsMetricsVariant": "Logs en metrieken",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Richt elke OpenTelemetry-exporter op OpenObserve — collector of SDK, HTTP of gRPC. Je endpoint en token zijn hieronder ingevuld.",
       "taglineWindows": "Installeer de OpenObserve-agent op elke Windows-host — Event Log, prestatiemeters en hostmetrieken.",
       "testAgain": "Opnieuw testen",
+      "networkFlowsHelp": "CIDR- of CIDR=NAME-vermeldingen, kommagescheiden zonder spaties; elke CIDR heeft een prefixlengte nodig, bijvoorbeeld 10.0.1.5/32, en namen mogen alleen letters, cijfers, ., _ en - bevatten. Adressen waarmee geen enkele vermelding overeenkomt, blijven ongelabeld; 0.0.0.0/0=other benoemt de rest van IPv4, ::/0=other6 de rest van IPv6.",
+      "networkFlowsLabel": "Netwerken om te labelen",
+      "networkFlowsRequired": "Geef ten minste één netwerk op: flows worden gelabeld met de netwerken die je opgeeft.",
       "traceCmdHelp": "Voor Python-, Node.js- en Java-apps.",
       "traceCmdLabel": "Opdrachtregel",
       "traceExeLabel": "Pad van uitvoerbaar bestand",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Cellen verbergen onder",
     "heatmapHideBelowTooltip": "Cellen met een lagere waarde blijven leeg.",
     "heatmapHideBelowNote": "Cellen onder {value} zijn verborgen",
+    "boxplotWhisker": "Snorharen",
+    "boxplotWhiskerMinMax": "Minimum tot maximum",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Berichtveld",
+    "logsLevelField": "Niveauveld",
+    "logsTimeField": "Tijdveld",
+    "htmlPanelFieldTooltip": "Laat leeg om de kolom uit de queryresultaten te bepalen",
+    "logsOrder": "Volgorde",
+    "logsOrderNewest": "Nieuwste eerst",
+    "logsOrderOldest": "Oudste eerst",
+    "logsOrderTooltip": "Sorteert de rijen die de query teruggeeft. Een ongewijzigde startquery wordt ook in deze volgorde opgehaald, dus Oudste eerst toont de vroegste logs.",
+    "logsShowTime": "Tijd tonen",
+    "logsWrap": "Regels afbreken",
+    "logsPrettifyJson": "JSON opmaken",
     "distributionBucketCount": "Aantal klassen",
     "distributionBucketSize": "Klassebreedte",
     "distributionBucketSizeTooltip": "Breedte van elke klasse in de eenheden van het veld. Indien ingesteld, vervangt deze het aantal klassen.",
@@ -7822,6 +8145,8 @@
       "gauge": "Meter",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Boxplot",
+      "logs": "Logs",
       "barGauge": "Staafmeter",
       "distribution": "Verdeling",
       "treemap": "Treemap",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: Vereist argument ontbreekt op positie {index}",
       "fieldNotAllowedForMetric": "{label} veld is niet toegestaan voor metriekgrafiek",
       "rawValueSampled": "Gebaseerd op de eerste {count} rijen",
+      "addAtMostOneFieldFor": "Voeg hoogstens één veld toe voor {label}",
+      "boxplotMin": "Min",
+      "boxplotMax": "Max",
+      "boxplotLowerWhisker": "Onderste snorhaar",
+      "boxplotUpperWhisker": "Bovenste snorhaar",
+      "boxplotMedian": "Mediaan",
+      "boxplotSamples": "Steekproeven",
+      "boxplotOutlier": "Uitschieter",
       "fieldNotAllowedForDistribution": "Het veld {label} is niet toegestaan voor de verdelingsgrafiek",
       "distributionCount": "Aantal",
       "addAtLeastOneFieldFor": "Voeg ten minste één veld toe voor de {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Geen toegang",
       "urlHiddenHint": "Je kunt het dashboard van deze link niet bekijken, dus de openbare URL is verborgen.",
       "orgDisabledHint": "Openbare links zijn uitgeschakeld voor deze organisatie",
+      "orgDisabledBanner": "Openbare links zijn uitgeschakeld voor deze organisatie, dus er wordt geen link geserveerd. Een beheerder kan ze weer inschakelen.",
+      "disabledPaused": "Uitgeschakeld · Gepauzeerd",
       "takeOver": "Overnemen",
       "takeOverTitle": "Deze link overnemen?",
       "takeOverBody": "Je wordt de uitgever. De openbare pagina toont wat jij mag zien, en dat kan meer of minder zijn dan voorheen. Iedereen met de URL houdt toegang, en de link is vanaf nu actief.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Groep",
     "wellSubgroup": "Subgroep",
     "wellSize": "Grootte",
+    "wellCategory": "Categorie",
     "value": "Waarde"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Verplaats de triggerwaarde weg van de waargenomen stabiele toestand.",
       "lengthenEvaluationWindow": "Evaluatievenster verlengen",
       "lengthenEvaluationWindowDesc": "Verbreed de periode zodat een korte piek het alarm niet meer activeert.",
-      "enableDeduplication": "Deduplicatie inschakelen",
-      "enableDeduplicationDesc": "Voeg herhaalde afvuringen binnen een deduplicatievenster samen.",
+      "enableDeduplication": "Herhalingen onderdrukken inschakelen",
+      "enableDeduplicationDesc": "Meld één keer per statuswijziging in plaats van bij elke evaluatie.",
       "reviewForDeletion": "Beoordelen voor verwijdering",
       "reviewForDeletionDesc": "Controleer of de query nog steeds overeenkomt met de werkelijkheid voordat je het alarm buiten gebruik stelt.",
       "fixAlertQuery": "Alarmquery herstellen",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "Organisatie-ID",
     "alertCreationTitle": "Alarm maken",
     "noAlertsFound": "Geen alarmen gevonden",
-    "suppressedByDeduplication": "Onderdrukt door deduplicatie",
-    "occurrence": "{count} voorkomen | {count} voorkomens",
     "groupedNotification": "Gegroepeerde melding",
     "alertsBatchedTogether": "alarmen gebundeld",
-    "notificationSent": "Melding verzonden",
-    "occurrencesDeduplicated": "voorkomens ontdubbeld",
     "alertExecutionDetails": "Details van de alarmuitvoering",
     "evaluationTime": "Evaluatietijd",
     "queryTime": "Querytijd",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "Tot: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Temporele correlatie",
     "serviceGraphTooltipServiceDependency": "Serviceafhankelijkheid",
-    "totalAlerts": "Totaal meldingen",
-    "usingDeduplication": "Deduplicatie in gebruik",
-    "deduplicationConfiguredTooltip": "Meldingen met geconfigureerde deduplicatie",
-    "suppressionRate24h": "Onderdrukkingspercentage (24u)",
     "suppressed": "onderdrukt /",
-    "total": "totaal",
-    "passedLabel": "Geslaagd:",
-    "pendingBatches": "Batches in afwachting",
-    "pendingBatchesTooltip": "Meldingen die wachten op groepering",
     "historyTimeline": {
       "firing": "Actief",
       "ok": "Ok",
@@ -10089,7 +10413,8 @@
     "endTime": "Eindtijd",
     "duration": "Duur",
     "retries": "Pogingen",
-    "dedup": "Dedup",
+    "suppression": "Onderdrukking",
+    "suppressedAsRepeat": "Onderdrukt als herhaling",
     "validation": {
       "streamTypeRequired": "Stream-type is vereist.",
       "streamNameRequired": "Stream-naam is vereist.",
@@ -10281,15 +10606,6 @@
     "all": "Alles",
     "history": "Alarmgeschiedenis",
     "searcHistory": "Voer de naam van het alarm in",
-    "deduplication": {
-      "fingerprintFields": "Vingerafdrukvelden",
-      "fingerprintFieldsHint": "Selecteer de velden die u wilt gebruiken voor deduplicatie. Laat dit veld leeg voor automatische detectie op basis van het zoektype.",
-      "fingerprintFieldsTooltip": "Kies welke velden moeten overeenkomen om alarmen als duplicaten te beschouwen. Als u bijvoorbeeld 'hostname' selecteert, worden alarmen van dezelfde host gegroepeerd. Verschillende alarmtypen (bijv. hoge CPU versus hoog geheugen) worden nooit gegroepeerd, ook niet als ze van dezelfde host komen. Laat leeg voor automatische detectie op basis van uw querytype.",
-      "timeWindow": "Alarmen als identiek beschouwen binnen",
-      "timeWindowHint": "Periode waarin vergelijkbare alarmen worden gegroepeerd. Laat leeg om uw controle-interval te gebruiken.",
-      "timeWindowTooltip": "Hoe lang recente alarmen worden onthouden om te groeperen. Als binnen deze tijd een vergelijkbaar alarm optreedt, wordt het niet opnieuw verzonden. Laat leeg om het controle-interval van uw alarm te gebruiken.",
-      "fingerprintFieldsHelp": "Laat leeg voor automatische detectie op basis van query (SQL: GROUP BY-kolommen, PromQL: labels, Aangepast: conditievelden)"
-    },
     "summary": {
       "scrollToBottom": "Scroll naar beneden",
       "title": "Samenvatting",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Waarschuw me wanneer aan de geconfigureerde voorwaarden is voldaan"
       }
     },
-    "correlation": {
-      "title": "Correlatie tussen alarmen",
-      "description": "Configureer hoe alarmen in de hele organisatie worden gecorreleerd en ontdubbeld. Alarmen met overeenkomende vingerafdrukwaarden worden gegroepeerd.",
-      "semanticFieldNote": "Opmerking: Semantische veldtoewijzingen worden geconfigureerd op het tabblad Service Identity.",
-      "enableOrgLevel": "Deduplicatie op organisatieniveau inschakelen",
-      "enableOrgLevelTooltip": "Schakel deduplicatie- en correlatiefuncties in voor alle meldingen in deze organisatie",
-      "enableCrossAlert": "Deduplicatie tussen alarmen inschakelen",
-      "enableCrossAlertTooltip": "Sta toe dat verschillende meldingen elkaar ontdubbelen wanneer ze dezelfde vingerafdruk delen",
-      "fingerprintGroups": "Vingerafdrukgroepen tussen alarmen",
-      "fingerprintGroupsTooltip": "Selecteer welke semantische groepen worden gebruikt voor vingerafdrukken tussen alarmen. Alarmen worden ontdubbeld als ze dezelfde waarden hebben voor deze dimensies.",
-      "fingerprintGroupsHint": "Selecteer ten minste één semantische groep voor deduplicatie tussen alarmen",
-      "fingerprintGroupsRequired": "Er moet minstens één semantische groep worden geselecteerd",
-      "defaultWindow": "Standaard correlatievenster (minuten)",
-      "defaultWindowTooltip": "Als er geen semantische veldovereenkomst is, worden alarmen en gegevens van een bepaalde duur als gerelateerd beschouwd",
-      "defaultWindowDescription": "Als er geen semantische veldovereenkomst is, worden alarmen en gegevens van een bepaalde duur als gerelateerd beschouwd",
-      "defaultWindowPlaceholder": "Gebruik standaard de alarmperiode",
-      "cancelButton": "Annuleer",
-      "saveButton": "Instellingen opslaan",
-      "settingsSaved": "Organisatie-deduplicatie-instellingen succesvol opgeslagen",
-      "settingsSaveError": "Instellingen opslaan mislukt"
-    },
     "placeholders": {
       "typeSomething": "Typ iets",
       "value": "Waarde",
       "selectColumn": "Kolom selecteren",
       "savedFunctions": "Opgeslagen functies",
-      "autoUsesCheckInterval": "Auto (maakt gebruik van controle-interval)",
       "addTag": "Voeg tag toe en druk op Enter"
     },
     "steps": {
       "compareWithPast": "Vergelijk met Past",
-      "deduplication": "Deduplicatie",
       "advanced": "Geavanceerd"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Wat zou het alarm moeten activeren",
       "compareWithPast": "Vergelijk de huidige resultaten met gegevens uit een andere periode",
       "alertSettings": "Stel je alarmregels in en kies hoe je op de hoogte wilt worden gehouden.",
-      "deduplication": "Voorkom dat hetzelfde alarm meerdere keren wordt verzonden door soortgelijke meldingen te groeperen.",
       "advanced": "Contextvariabelen, beschrijving en rijsjabloon"
     },
     "failedToFetchHistory": "Het ophalen van de alarmgeschiedenis is mislukt",
@@ -10399,8 +10691,6 @@
         "closeActions": "Acties sluiten",
         "viewAlertHistory": "Alarmgeschiedenis bekijken",
         "actionsFor": "Acties voor:",
-        "configureDedup": "Dedup configureren",
-        "configureDedupTooltip": "Configureer deduplicatie voor dit alarm",
         "editAlert": "Alarm bewerken",
         "editAlertTooltip": "Alarmconfiguratie bewerken",
         "viewHistory": "Geschiedenis bekijken",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "nieuw \"Opgelost\"-bericht",
       "keepFiringFor": "Blijf afgaan gedurende",
       "keepFiringForTooltip": "Wacht zo lang nadat de voorwaarde is verdwenen voordat wordt hersteld. 0 herstelt onmiddellijk.",
+      "suppressRepeats": "Herhalingen onderdrukken",
+      "suppressRepeatsTooltip": "Meld één keer wanneer het alarm begint af te gaan of van niveau verandert, niet bij elke evaluatie. Laat dit uit staan om na elke stilteperiode herinneringen te blijven ontvangen.",
       "keepFiringForInvalid": "Voer 0 of meer seconden in",
       "keepFiringForTooLong": "Voer maximaal 86400 seconden in (24 uur)"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Dit e-mailadres is al toegevoegd",
     "confirmRemoveEmail": "Weet je zeker dat je het e-mailadres {email} wilt verwijderen?",
     "domainNeedsEmails": "Domein '{domain}' moet minstens één e-mailadres hebben als niet alle gebruikers zijn toegestaan",
+    "noAllowedEmailsDenyAll": "Er zijn nog geen toegestane e-mailadressen, dus elke gebruiker van {domain} wordt geweigerd.",
     "domainSettingsSaved": "Domeininstellingen succesvol opgeslagen",
     "errorSavingDomainSettings": "Fout bij opslaan van domeininstellingen",
     "noDomainMessage": "Geen domeinen geconfigureerd. Voeg hierboven domeinen toe om de toegang te beperken.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Configureer ten minste één identiteitsset voordat u opslaat.",
       "discoveredServicesTab": "Ontdekte services",
       "serviceDiscoveryTab": "Detectieregels",
-      "alertCorrelationTab": "Correlatie tussen alarmen",
       "fieldAliasesTab": "Veldtoewijzingen",
       "fieldAliasesSaved": "Veldaliassen zijn opgeslagen",
       "fieldAliasesSaveError": "Opslaan van veldaliassen mislukt",
@@ -14079,27 +14371,144 @@
     "runsIn": "Draait in",
     "recommendedByFieldCoverage": "Aanbevolen op basis van velddekking in uw streams.",
     "listConjunctionAndTwo": "{first} en {last}",
-    "domainOrgMappings": {
-      "title": "Domein naar organisatie-toewijzingen",
-      "subtitle": "Nieuwe gebruikers die inloggen met een overeenkomend e-maildomein worden automatisch aan de organisatie toegevoegd.",
-      "addMapping": "Toewijzing toevoegen",
-      "editMapping": "Toewijzing bewerken",
-      "empty": "Nog geen toewijzingen. Gebruik “{addLabel}” om er een toe te voegen.",
+    "orgDomainMapping": {
+      "tabLabel": "Domeinbeheer",
+      "tabDesc": "Koppel je e-maildomeinen, wijs hun gebruikers toe aan organisaties en bepaal wie van hen kan deelnemen.",
+      "loadFailed": "Kan de organisatie-instellingen niet laden",
+      "addMapping": "Mapping toevoegen",
+      "editMapping": "Mapping bewerken",
       "domain": "E-maildomein",
-      "domainHelp": "Het deel na {at_sign} in het e-mailadres van de gebruiker.",
+      "domainHelp": "Het deel na {at_sign} in het e-mailadres van de gebruiker. Het domein wordt aan deze organisatie gekoppeld en moet via DNS worden geverifieerd.",
+      "domainHelpRequest": "Het deel na {at_sign} in het e-mailadres van de gebruiker. Het domein wordt aan deze organisatie gekoppeld zodra OpenObserve het verzoek goedkeurt.",
       "organization": "Organisatie",
-      "organizationPlaceholder": "Organisatie-identificatie",
-      "organizationHelp": "De identificatie van de organisatie waaraan overeenkomende gebruikers worden toegevoegd.",
-      "organizationRequired": "Organisatie is vereist",
+      "organizationHelp": "Deze organisatie of een van de leden van de facturatiegroep.",
+      "organizationRequired": "Organisatie is verplicht",
       "baseRole": "Basisrol",
-      "baseRoleHelp": "De rol die overeenkomende gebruikers in die organisatie krijgen.",
+      "baseRoleHelp": "De rol die wordt toegekend wanneer een gebruiker aan die organisatie wordt toegevoegd. Bestaande leden behouden hun huidige rol.",
       "roleClaimName": "Rolclaim",
       "roleClaimNamePlaceholder": "Claimnaam, bijv. groups",
-      "roleClaimNameHelp": "Optioneel. Tokenclaim met de aangepaste rollen van de gebruiker; bij elke aanmelding worden diens aangepaste rollen in die organisatie hiermee gesynchroniseerd.",
-      "createMissingRoles": "Rollen uit de claim aanmaken die nog niet in de organisatie bestaan",
-      "duplicateDomain": "Er bestaat al een toewijzing voor dit domein",
-      "confirmRemove": "Weet je zeker dat je de toewijzing voor {name} wilt verwijderen?",
-      "deleteTitle": "Toewijzing verwijderen"
+      "roleClaimNameHelp": "Optioneel. SSO-tokenclaim met de aangepaste rollen van de gebruiker. Bij elke SSO-aanmelding worden de aangepaste rollen in die organisatie vervangen door de geclaimde rollen; geclaimde rollen die niet bestaan worden overgeslagen, tenzij ze worden aangemaakt.",
+      "createMissingRoles": "Geclaimde rollen aanmaken die niet in de organisatie bestaan",
+      "verifyNow": "Nu verifiëren",
+      "details": "Details",
+      "detailsDialogTitle": "Koppelingsdetails voor {domain}",
+      "approvedLinkInfo": "Gekoppeld door OpenObserve na een koppelingsverzoek. Er is geen DNS-record nodig.",
+      "pendingRequestInfo": "OpenObserve beoordeelt dit verzoek. Je hoeft niets te doen totdat het is goedgekeurd.",
+      "rejectedRequestInfo": "OpenObserve heeft dit verzoek afgewezen.",
+      "verifyDialogTitle": "Verifieer {domain}",
+      "recordDialogTitle": "DNS-record voor {domain}",
+      "lastCheckFailed": "Laatste controle mislukt: {reason}",
+      "state": {
+        "pending": "Wachtend",
+        "verified": "Geverifieerd",
+        "failed": "Mislukt",
+        "requested": "Wacht op goedkeuring",
+        "approved": "Goedgekeurd",
+        "rejected": "Afgewezen"
+      },
+      "saved": "Domeinkoppeling opgeslagen",
+      "saveFailed": "Instellingen opslaan mislukt",
+      "linkFailed": "Koppelen van domein mislukt",
+      "unlinkFailed": "Ontkoppelen van domein mislukt",
+      "verifyFailed": "Verificatie mislukt",
+      "deleted": "Koppeling verwijderd",
+      "deleteTitle": "Koppeling verwijderen?",
+      "deleteMappingBody": "Gebruikers van {domain} worden niet meer aan {org} toegevoegd wanneer ze inloggen.",
+      "recordInstructions": "Voeg dit DNS TXT-record toe bij je DNS-provider:",
+      "txtNameLabel": "Recordnaam",
+      "txtValueLabel": "Recordwaarde",
+      "copyTxtName": "Recordnaam kopiëren",
+      "copyTxtValue": "Recordwaarde kopiëren",
+      "txtNameCopied": "Recordnaam gekopieerd",
+      "txtValueCopied": "Recordwaarde gekopieerd",
+      "verifyHint": "Verificatie wordt automatisch elke {minutes} minuten uitgevoerd. Je kunt ook nu verifiëren.",
+      "alreadyLinked": "Dit domein is al gekoppeld aan deze organisatie",
+      "failureReason": {
+        "recordMissing": "TXT-record niet gevonden",
+        "valueMismatch": "TXT-record gevonden, maar de waarde komt niet overeen",
+        "dnsFailed": "DNS-resolutie mislukt"
+      },
+      "pageSubtitle": "Koppel je e-maildomeinen, wijs hun gebruikers toe aan organisaties en bepaal wie van hen kan deelnemen.",
+      "linkedTab": "Gekoppelde domeinen",
+      "mappingsTab": "Koppelingen",
+      "accessTab": "Geblokkeerde gebruikers",
+      "requestsTab": "Koppelingsverzoeken",
+      "linkDomain": "Domein koppelen",
+      "sendRequest": "Verzoek verzenden",
+      "linkMethod": "Hoe bewijs je eigendom",
+      "method": {
+        "dns": "DNS-record",
+        "approved": "Goedgekeurd verzoek",
+        "request": "Koppelingsverzoek",
+        "dnsTitle": "Een DNS TXT-record toevoegen",
+        "dnsDesc": "Automatisch geverifieerd zodra het record is gepubliceerd. Ideaal als je de DNS van het domein beheert.",
+        "requestTitle": "Een koppeling aanvragen bij OpenObserve",
+        "requestDesc": "Ons team beoordeelt het verzoek en koppelt het domein zodra het is goedgekeurd."
+      },
+      "searchDomains": "Domeinen zoeken",
+      "searchMappings": "Zoeken op domein of organisatie",
+      "searchRequests": "Zoeken op domein, organisatie of aanvrager",
+      "status": "Status",
+      "linkedVia": "Gekoppeld via",
+      "lastChecked": "Laatst gecontroleerd",
+      "linked": "Domein gekoppeld. Voeg de DNS-record toe om het te verifiëren.",
+      "verified": "Domein geverifieerd",
+      "notVerifiedYet": "De DNS-record is nog niet gevonden. Het kan even duren voordat deze is doorgevoerd.",
+      "requestSent": "Koppelverzoek verzonden",
+      "requestFailed": "Verzenden van het koppelverzoek mislukt",
+      "keepRecordHint": "Laat deze record staan. Eigendom wordt elke {minutes} minuten opnieuw gecontroleerd; als de record langer dan {grace} minuten ontbreekt, wordt het domein als mislukt gemarkeerd en worden de toewijzingen ervan niet meer toegepast.",
+      "removeDomain": "Domein verwijderen",
+      "removeTitle": "Domein verwijderen?",
+      "removeBody": "{domain} wordt ontkoppeld van deze organisatie.",
+      "removeWithMappingsBody": "{domain} wordt ontkoppeld van deze organisatie en de {count} toewijzing ervan wordt verwijderd. | {domain} wordt ontkoppeld van deze organisatie en de {count} toewijzingen ervan worden verwijderd.",
+      "removed": "Domein verwijderd",
+      "domainRequired": "Domein is vereist",
+      "mappingDomainHelp": "Alleen geverifieerde domeinen kunnen worden toegewezen.",
+      "createsRoles": "Maakt rollen aan",
+      "duplicateMapping": "Dit domein is al toegewezen aan die organisatie",
+      "domainNotVerified": "Niet geverifieerd",
+      "noVerifiedDomains": "Toewijzingen gelden voor geverifieerde domeinen. Koppel en verifieer eerst een domein.",
+      "goToLinked": "Een domein koppelen",
+      "goToLinkedDesc": "Verifieer een domein dat u bezit voordat u de gebruikers ervan toewijst",
+      "enforceTitle": "Gebruikers uit andere organisaties verwijderen",
+      "enforceDesc": "Wanneer een gebruiker van een toegewezen domein inlogt via SSO, wordt deze verwijderd uit elke organisatie buiten deze en de facturatiegroep ervan.",
+      "enforceConfirmTitle": "Gebruikers uit andere organisaties verwijderen?",
+      "enforceConfirmBody": "Elke keer dat een gebruiker van wie het e-maildomein hier een toewijzing heeft, inlogt via SSO, wordt deze verwijderd uit elke organisatie die niet deze is of niet in de facturatiegroep ervan zit, inclusief de persoonlijke organisaties.",
+      "enforceConfirmAction": "Inschakelen",
+      "enforceSaved": "Instelling opgeslagen",
+      "blockUsers": "Gebruikers blokkeren",
+      "editBlockedUsers": "Geblokkeerde gebruikers bewerken",
+      "block": "Blokkeren",
+      "blockedCount": "{count} geblokkeerd | {count} geblokkeerd",
+      "blockedEmails": "Geblokkeerde e-mailadressen",
+      "blocklistDomainHelp": "Een van de geverifieerde domeinen van deze organisatie.",
+      "blocklistEmailsHelp": "Deze gebruikers kunnen via SSO niet lid worden van deze organisatie of van de leden van haar facturatiegroep, en worden bij hun volgende aanmelding verwijderd.",
+      "ruleBlockedRequired": "Voeg ten minste één e-mailadres toe om te blokkeren",
+      "noDomainForBlocklist": "Elk geverifieerd domein heeft al geblokkeerde gebruikers. Bewerk de rij ervan om ze te wijzigen.",
+      "unblockAll": "Alles deblokkeren",
+      "unblockAllTitle": "Alle gebruikers deblokkeren?",
+      "unblockAllBody": "Elke geblokkeerde gebruiker van {domain} kan bij de volgende SSO-aanmelding weer lid worden.",
+      "blocklistSaved": "Geblokkeerde gebruikers opgeslagen",
+      "blocklistDeleted": "Gebruikers gedeblokkeerd",
+      "blocklistSection": "Geblokkeerde gebruikers per domein",
+      "filterPending": "In afwachting",
+      "filterAll": "Alle",
+      "requestedBy": "Aangevraagd door",
+      "requestedAt": "Aangevraagd",
+      "verifiedAt": "Geverifieerd",
+      "answeredBy": "Beantwoord door",
+      "reason": "Reden",
+      "reasonHelp": "Wordt getoond aan de organisatie die het verzoek heeft ingediend.",
+      "reasonRequired": "Een reden is vereist om een verzoek af te wijzen",
+      "approve": "Goedkeuren",
+      "reject": "Afwijzen",
+      "approveTitle": "Koppelverzoek goedkeuren?",
+      "rejectTitle": "Koppelverzoek afwijzen?",
+      "approveBody": "{domain} wordt aan {org} gekoppeld zonder DNS-controle.",
+      "rejectBody": "{org} krijgt {domain} niet.",
+      "requestApproved": "{domain} gekoppeld",
+      "requestRejected": "Verzoek voor {domain} afgewezen",
+      "decisionFailed": "Kan het verzoek niet bijwerken"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Selecteer een optie voor detecteren bij"
   },
   "search_history": {
-    "title": "Zoekgeschiedenis",
+    "title": "Gebruik & kostenhistorie",
     "get_history": "Geschiedenis ophalen",
     "executed_at": "Uitgevoerd op",
     "sql_query": "SQL-zoekopdracht",
-    "delayMessage": "De zoekgeschiedenis kan worden vertraagd door"
+    "delayMessage": "Gebruik & kostenhistorie kan vertraagd zijn met"
   },
   "correlation": {
     "unstableDimensionNote": "Instabiele dimensie - verandert bij herstart van pod. Standaard: alle waarden.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Gegevens zijn vers",
     "dataGettingStale": "Gegevens worden muf",
     "dataStale": "Gegevens zijn verouderd",
-    "lastRefreshed": "Laatst ververst: {time}"
+    "lastRefreshed": "Laatst ververst: {time}",
+    "refresh": "Vernieuwen",
+    "refreshWithAge": "Vernieuwen, laatst vernieuwd {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Probe-fout"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "klik",
       "actionType": "type",
       "all": "Alle",
@@ -19868,6 +20280,13 @@
       "attemptN": "Attempt {n}",
       "detailAction": "Actie",
       "detailSelector": "Selector",
+      "detailStepId": "Stap-ID",
+      "detailTargetUrl": "Doel-URL",
+      "detailStatus": "Status",
+      "detailSkipReason": "Reden voor overslaan",
+      "stepStatusSkipped": "Overgeslagen",
+      "stepStatusUnknown": "Onbekend",
+      "skippedCount": "{n} overgeslagen",
       "downloadTrace": "{filename} downloaden",
       "errorFullscreenTitle": "Stap {id}: {action} - Fout",
       "failedAtStartLoad": "Openen van start-URL mislukt",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Maximum {max}. Retries worden binnen dezelfde taak uitgevoerd, dus de hele reeks moet in het checkbudget passen.",
       "retriesMaxBrowserHint": "Maximum {max} voor browserchecks. Elke poging doorloopt het traject opnieuw op elk apparaat, dus meer zou de probe-time-out overschrijden en een fout melden die uw site nooit had.",
       "retryDelay": "Wacht tot",
-      "retryDelaySuffix": "Ik zit tussen de nieuwe pogingen.",
+      "retryDelaySuffix": "seconden tussen herpogingen.",
       "schedule": "Schema",
       "scheduleLater": "Later plannen",
       "scheduleLaterTooltip": "Kies een toekomstige datum en tijd om de cheque te activeren.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Configuratie opnieuw starten — kopieer het installatiecommando van deze agent om de installatie opnieuw uit te voeren / docker opnieuw te starten (bijv. na een tokenrotatie)",
         "noAgents": "Er hebben zich nog geen agenten geregistreerd voor deze locatie.",
         "agentsUnavailable": "De agents van deze locatie zijn geregistreerd bij een ander cluster en zijn hier niet zichtbaar.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Controles die vanaf deze locatie worden uitgevoerd",
         "checkName": "Naam",
         "noChecks": "Er zijn nog geen controles toegewezen aan deze locatie.",
@@ -20546,7 +20967,7 @@
       "nodes": "Knopen",
       "modelPricing": "Modelprijzen",
       "searchSchedulers": "Planners voor zoektaken",
-      "searchHistory": "Zoekgeschiedenis",
+      "searchHistory": "Gebruik & kostenhistorie",
       "sessions": "Sessies",
       "evalTemplates": "Online evaluaties — Sjablonen",
       "scorers": "Online evaluaties — Scorers",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Lijst vernieuwen",
       "alertTemplatesAdd": "Nieuwe sjabloon toevoegen",
       "alertTemplatesRefresh": "Lijst verversen",
-      "logsSearchHistory": "Zoekgeschiedenis openen",
+      "logsSearchHistory": "Gebruik & kostenhistorie openen",
       "alertsImport": "Alarm importeren",
       "panelEditorRun": "Query uitvoeren/toepassen",
       "panelEditorSave": "Opslaan en verder bewerken",
@@ -21131,6 +21552,7 @@
         "system": "systeem"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Beschikbaar",
         "passed": "Geslaagd",
         "healthy": "Gezond",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Navigeren naar alarm mislukt",
       "alertNotFound": "Alarm niet gevonden",
-      "alertNotFoundInAlerts": "Alarm \"{name}\" niet gevonden in {count} alarmen",
       "failedToLoadAlerts": "Laden van alarmen mislukt",
       "alertsDeletedSuccessfully": "{count} alarm succesvol verwijderd | {count} alarmen succesvol verwijderd",
       "failedToDeleteAlerts": "Verwijderen van {count} alarm mislukt | Verwijderen van {count} alarmen mislukt",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Even geduld terwijl sjablonen worden geladen...",
       "alertSavedSuccessfully": "Alarm succesvol opgeslagen.",
       "alertUpdatedSuccessfully": "Alarm succesvol bijgewerkt.",
-      "openingDedupConfig": "Deduplicatieconfiguratie openen voor: {name}",
       "editingAlert": "Alarm bewerken: {name}",
       "ack": {
         "acked": "{name} bevestigd",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Modelprijseditor",
     "storageSettings": "Opslaginstellingen",
     "domainManagement": "Domeinbeheer",
+    "orgDomainMapping": "Domeinbeheer",
     "slackApp": "Slack",
     "regexPatterns": "Regex-patronen",
     "syntheticsLocations": "Synthetics-locaties",
@@ -26099,7 +26520,7 @@
       "logged": "Geregistreerd"
     },
     "policy": {
-      "gateHint": "Van wijzigingen aan bestaande alarmen wordt alleen deduplicatie zelfstandig toegepast, met een snapshot van de vorige status en een beoordelingsperiode: behouden als de controles slagen, teruggedraaid als ze falen. Al het overige wacht op goedkeuring met één klik.",
+      "gateHint": "Van wijzigingen aan bestaande alarmen wordt alleen het inschakelen van herhalingen onderdrukken zelfstandig toegepast, met een momentopname van de vorige status en een beoordelingsvenster: behouden als de controles slagen, teruggedraaid als ze mislukken. Al het andere wacht op goedkeuring met één klik.",
       "off": "Uit",
       "suggest": "Suggereren",
       "auto": "Auto",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Houd de oproep tegen totdat het onderzoek is afgerond, maximaal 2 minuten. Open faalgedrag: als triage een timeout krijgt of mislukt, wordt er alsnog een oproep gedaan, wordt gemeld dat het onderzoek nog loopt of is mislukt, en de oorzaak volgt in de thread."
       },
       "classes": {
-        "EnableDeduplication": "Deduplicatie inschakelen voor een alarm dat zich binnen enkele minuten herhaalt.",
+        "EnableDeduplication": "Herhalingen onderdrukken inschakelen voor een alarm dat bij elke evaluatie meldt.",
         "CreateDetector": "Maak een anomaliedetector voor de verzoeken, fouten of latentie van een service.",
         "RaiseThreshold": "Verhoog een drempel die op gezonde dagen afgaat.",
         "LengthenEvaluationWindow": "Verleng het venster van een alarm dat flappert.",
@@ -26667,10 +27088,10 @@
           "on": "verbindingsalarm"
         },
         "L-302": {
-          "done": "De 3 checkout-latentiealarmen samengevoegd tot één",
-          "why": "Ze gingen 94% van de tijd samen af, dus één vertraging gaf je 3 keer een piketmelding.",
-          "from": "3 alarmen",
-          "to": "1",
+          "done": "Herhalingen onderdrukken ingeschakeld voor de 3 checkout-latentiealarmen",
+          "why": "Ze meldden bij elke evaluatie zolang ze afgingen, waardoor je door één vertraging 120 keer werd opgeroepen.",
+          "from": "Elke evaluatie",
+          "to": "Eén keer per wijziging",
           "on": "checkout-latentie"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "Ik heb piket opgeroepen omdat bij checkout betalingen mislukken.",
         "recsHeld": "Ik heb een klein probleem met recommendations achtergehouden voor de samenvatting van vrijdag.",
         "diskApproved": "Je hebt goedgekeurd dat het schijfalarm op ingest-1 naar {to}% wordt verhoogd.",
-        "latencyGrouped": "Ik heb de drie traagheidsalarmen van checkout samengevoegd tot één, zodat één enkele vertraging maar één keer piket oproept.",
+        "latencyGrouped": "Ik heb herhalingen onderdrukken ingeschakeld voor de drie checkout-traagheidsalarmen, zodat één enkele vertraging maar één oproep oplevert.",
         "queueFixed": "Ik heb workers voor de orders-wachtrij toegevoegd, maar de wachtrij bleef groeien, dus ik heb ze teruggedraaid en piket opgeroepen.",
         "loginPaged": "Ik heb piket opgeroepen vanwege traag inloggen.",
         "queuePermission": "Je hebt me toegestaan zelf wachtrij-workers toe te voegen, tot 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Pipelinestatus",
       "legendToggle": "Deze status op de kaart tonen of verbergen"
     }
+  },
+  "recentSearches": {
+    "title": "Recente zoekopdrachten",
+    "aboutKeptDays": "Alleen jouw zoekopdrachten in {org}, alleen voor jou zichtbaar. {days} dag bewaard; zoekopdrachten met een ster blijven tot je ze verwijdert. | Alleen jouw zoekopdrachten in {org}, alleen voor jou zichtbaar. {days} dagen bewaard; zoekopdrachten met een ster blijven tot je ze verwijdert.",
+    "aboutKeptForever": "Alleen jouw zoekopdrachten in {org}, alleen voor jou zichtbaar. Bewaard tot je ze verwijdert.",
+    "pageTitle": {
+      "logs": "Recente zoekopdrachten in logs",
+      "traces": "Recente zoekopdrachten in traces",
+      "metrics": "Recente zoekopdrachten in metrieken",
+      "dbm": "Recente zoekopdrachten",
+      "profiles": "Recente zoekopdrachten"
+    },
+    "page": {
+      "logs": "Logs",
+      "traces": "Traces",
+      "metrics": "Metrieken",
+      "dbm": "Database",
+      "profiles": "Profielen"
+    },
+    "allPages": "Alle pagina's",
+    "viewAll": "Alles bekijken",
+    "failedCount": "{count} mislukt",
+    "keyHints": "↑↓ verplaatsen · PgUp/PgDn door query scrollen · Enter uitvoeren · Shift+Enter alleen laden · Esc sluiten",
+    "loadToFix": "Laden om te herstellen",
+    "emptyTitle": "Nog geen recente zoekopdrachten",
+    "loadError": "Recente zoekopdrachten konden niet worden geladen",
+    "retry": "Opnieuw proberen",
+    "warning": "Voltooid met een waarschuwing: time-out of gedeeltelijke resultaten",
+    "failed": "Mislukt",
+    "ranCount": "{count}x uitgevoerd",
+    "lineCount": "{count} regel | {count} regels",
+    "relativeWindow": "Afgelopen {period}",
+    "rerunNow": "Nu opnieuw uitvoeren",
+    "rerunOriginal": "Op oorspronkelijke tijd",
+    "loadOnly": "Laden zonder uitvoeren",
+    "copyLink": "Link kopiëren",
+    "copyQuery": "Query kopiëren",
+    "star": "Ster toevoegen",
+    "unstar": "Ster verwijderen",
+    "linkCopied": "Link gekopieerd",
+    "queryCopied": "Query gekopieerd",
+    "copyFunction": "Functie kopiëren",
+    "functionCopied": "Functie gekopieerd",
+    "functionLabel": "Functie (VRL)",
+    "searchPlaceholder": "Zoek in queries en streams",
+    "allStreams": "Alle streams",
+    "statusAll": "Elke status",
+    "statusOk": "Geslaagd",
+    "statusError": "Mislukt",
+    "starredOnly": "Alleen met ster",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "Filter op uitvoeringsdatum",
+    "today": "Vandaag",
+    "yesterday": "Gisteren",
+    "noMatch": "Geen zoekopdrachten die aan deze filters voldoen",
+    "reset": "Alles resetten",
+    "resetFilters": "Filters resetten",
+    "loadMore": "Meer laden",
+    "clear": "Mijn geschiedenis wissen",
+    "confirmClear": "Geschiedenis wissen",
+    "clearBodyPage": "Hiermee verwijder je je {count} recente {page}-zoekopdracht in {org}. Opgeslagen weergaven worden niet beïnvloed. | Hiermee verwijder je je {count} recente {page}-zoekopdrachten in {org}. Opgeslagen weergaven worden niet beïnvloed.",
+    "clearBodyAll": "Hiermee verwijder je je {count} recente zoekopdracht in {org} binnen Logs, Traces en Metrics. Opgeslagen weergaven worden niet beïnvloed. | Hiermee verwijder je je {count} recente zoekopdrachten in {org} binnen Logs, Traces en Metrics. Opgeslagen weergaven worden niet beïnvloed.",
+    "includeStarred": "Verwijder ook mijn {count} zoekopdracht met ster | Verwijder ook mijn {count} zoekopdrachten met ster",
+    "recentRow": "Recente zoekopdracht",
+    "deletedQuery": "{query} verwijderd",
+    "undo": "Ongedaan maken"
   }
 }
diff --git a/web/src/locales/languages/pl-PL.json b/web/src/locales/languages/pl-PL.json
index 1e398f21a0..90cf9a6c1d 100644
--- a/web/src/locales/languages/pl-PL.json
+++ b/web/src/locales/languages/pl-PL.json
@@ -486,7 +486,11 @@
       "monitors": "monitory",
       "modelPricing": "definicje cen modeli",
       "variables": "zmienne",
-      "experiments": "eksperymenty"
+      "experiments": "eksperymenty",
+      "linkedDomains": "połączone domeny",
+      "domainMappings": "mapowania domen",
+      "domainRequests": "prośby o połączenie",
+      "blockedUsers": "zablokowani użytkownicy"
     },
     "demo": {
       "pageTitle": "Stany puste — pełny zestaw do przeglądu",
@@ -572,6 +576,30 @@
       "action": "Nowe zadanie",
       "actionDesc": "Podaj OpenObserve swój endpoint i przetestuj połączenie."
     },
+    "noLinkedDomains": {
+      "title": "Nie ma jeszcze połączonych domen",
+      "description": "Połącz domenę e-mail, której jesteś właścicielem, aby mapować jej użytkowników do swoich organizacji i kontrolować, kto może się logować.",
+      "dns": "Dodaj rekord DNS",
+      "dnsDesc": "Zweryfikuj własność za pomocą rekordu TXT",
+      "request": "Poproś o połączenie",
+      "requestDesc": "Poproś OpenObserve o połączenie domeny za Ciebie"
+    },
+    "noDomainMappings": {
+      "title": "Nie ma jeszcze mapowań domen",
+      "description": "Automatycznie dodawaj użytkowników, którzy logują się za pomocą zweryfikowanej domeny, do tej organizacji lub organizacji z jej grupy rozliczeniowej.",
+      "action": "Dodaj mapowanie",
+      "actionDesc": "Wybierz domenę, organizację i rolę"
+    },
+    "noBlockedUsers": {
+      "title": "Brak zablokowanych użytkowników",
+      "description": "Każdy użytkownik z Twoich zweryfikowanych domen może dołączyć. Zablokuj konkretnych użytkowników, aby im to uniemożliwić.",
+      "action": "Zablokuj użytkowników",
+      "actionDesc": "Wybierz domenę i adresy e-mail do zablokowania"
+    },
+    "noDomainRequests": {
+      "title": "Brak próśb o połączenie",
+      "description": "Tutaj pojawiają się prośby organizacji o połączenie domeny."
+    },
     "noDowntimes": {
       "title": "Brak okien serwisowych",
       "description": "Okno serwisowe pozwala alertom, wykrywaniu anomalii i kontrolom syntetycznym działać dalej, a na zaplanowany okres wstrzymuje ich powiadomienia.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Wyłącz automatyczne uruchamianie",
     "autoRefreshWithValue": "Automatyczne odświeżanie: {value}",
     "searchHistory": "Historia wyszukiwania",
+    "usageCostHistory": "Historia użycia i kosztów",
     "createScheduledSearch": "Utwórz zaplanowane wyszukiwanie",
     "listScheduledSearch": "Lista zaplanowanych wyszukiwań",
     "scheduleSearchJob": "Zaplanuj zadanie wyszukiwania",
@@ -1355,6 +1384,8 @@
     "scanSize": "Rozmiar skanowania",
     "deltaScanSize": "Delta rozmiaru skanowania",
     "scannedSoFar": "Przeskanowano {size}",
+    "quickModeHiddenFields": "Tryb szybki jest włączony. Ten wiersz pokazuje {shown} z {total} pól.",
+    "turnOffQuickMode": "Wyłącz tryb szybki",
     "resultsProgressLabel": "Postęp wyszukiwania",
     "histogramTitleError": "Błąd podczas generowania tytułu histogramu.",
     "selectLogStream": "Wybierz strumień logów",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Brak danych sieciowych dla tego widoku",
     "apiEmptyDescription": "Wybrany strumień nie ma żądań zasobów ani sieci w tym zakresie czasu. Metryki sieci pojawią się, gdy aplikacja zacznie instrumentować swoje wywołania HTTP.",
     "skipInactivity": "Pomiń nieaktywność",
+    "fullScreen": "Pełny ekran",
+    "exitFullScreen": "Wyjdź z pełnego ekranu",
     "error": "Błąd",
     "errorCount": "Liczba błędów",
     "all": "Wszystkie",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Dodaj drugi krok, aby dodać ten lejek do pulpitu",
         "snapshot": "Panel zachowa te kroki, filtry i reguły zdarzeń nazwanych w obecnej postaci."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Przegląd wydajności",
+      "filterService": "Usługa",
+      "filterEnv": "Środowisko",
+      "filterVersion": "Wersja",
+      "filterAll": "Wszystkie",
+      "verdictPass": "Core Web Vitals: zaliczone",
+      "verdictFail": "Core Web Vitals: wymagają uwagi",
+      "verdictAllPass": "Wszystkie zaliczone",
+      "verdictNeedWork": "{count} z {total} wymaga poprawy | {count} z {total} wymagają poprawy",
+      "percentileLabel": "Percentyl",
+      "bandGood": "Dobre",
+      "bandNeeds": "Wymaga poprawy",
+      "bandPoor": "Słabe",
+      "bandGoodPct": "{n}% dobre",
+      "bandNeedsPct": "{n}% wymaga poprawy",
+      "bandPoorPct": "{n}% słabe",
+      "bandAria": "{good}% dobre, {needs}% wymaga poprawy, {poor}% słabe",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} szybciej",
+      "deltaSlower": "{v} wolniej",
+      "deltaNone": "bez zmian",
+      "deltaNoPrev": "za mało wcześniejszych danych",
+      "kpiSessions": "Sesje",
+      "kpiErrorFree": "Sesje bez błędów",
+      "kpiErrors": "Łączna liczba błędów",
+      "kpiUnhandled": "Nieobsłużone błędy",
+      "kpiRegion": "Kluczowe wskaźniki",
+      "sparkAria": "{label}: trend w wybranym zakresie",
+      "chartTitle": "Sesje i błędy",
+      "chartInterval": "na przedział",
+      "legendSessions": "Sesje",
+      "legendErrors": "Błędy",
+      "releaseMarker": "{version} — pierwsze wystąpienie: {time}",
+      "chartTableToggle": "Pokaż tabelę danych",
+      "chartTableHide": "Ukryj tabelę danych",
+      "chartTime": "Czas",
+      "pagesTitle": "Strony do naprawy w pierwszej kolejności",
+      "pagesHint": "Uszeregowane według wpływu: ruch ważony udziałem wyświetleń, w których któryś ze wskaźników Core Web Vitals przekroczył próg lub wystąpił błąd. Kliknij stronę, aby zobaczyć jej sesje, a liczbę błędów, aby przejść do Śledzenia błędów.",
+      "pagesColPage": "Strona",
+      "pagesColViews": "Wyświetlenia",
+      "pagesColErrors": "Błędy",
+      "pagesColImpact": "Wpływ",
+      "pagesLegend": "▲ wymaga poprawy · ■ słabe · brak oznaczenia oznacza dobre. Strony z liczbą wyświetleń poniżej {n} są ukryte.",
+      "pagesOpenSessions": "Otwórz sesje dla {path}",
+      "pagesOpenErrors": "Błąd: {count}, otwórz Śledzenie błędów | Błędy: {count}, otwórz Śledzenie błędów",
+      "pagesImpactAria": "Wpływ {n} na 100",
+      "markNeeds": "wymaga poprawy",
+      "markPoor": "słabe",
+      "diffTitle": "Największa różnica",
+      "diffBody": "INP p75 wynosi {inp}, {ratio}x więcej niż w pozostałych segmentach. To korelacja do zbadania, a nie potwierdzona przyczyna.",
+      "diffNone": "Żaden segment nie wyróżnia się na tle pozostałych w tym zakresie.",
+      "diffLink": "Pokaż objęte sesje",
+      "segmentLabel": "Segment",
+      "segBrowser": "Przeglądarka",
+      "segDevice": "Urządzenie",
+      "segCountry": "Kraj",
+      "segInp": "INP {v}",
+      "segShare": "{n}% wyświetleń",
+      "segNone": "Brak danych dla tego segmentu.",
+      "releaseTitle": "Porównanie wersji",
+      "releaseHint": "{cur} w porównaniu z {prev}. Początek wersji to moment pierwszego wykrycia danej wersji.",
+      "releaseMetric": "Metryka",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Bez błędów",
+      "releaseSessions": "Sesje",
+      "releaseLink": "Błędy w wersji {version}",
+      "frustrationTitle": "Frustracja użytkowników",
+      "frustrationHint": "Problemy, których nie wychwytują wskaźniki",
+      "rageClicks": "Wściekłe kliknięcia",
+      "deadClicks": "Martwe kliknięcia",
+      "stateLoading": "Ładowanie {panel}…",
+      "stateEmptyTitle": "Brak wyświetleń stron w tym zakresie",
+      "stateEmptyBody": "Poszerz zakres czasu, usuń filtr lub sprawdź, czy SDK przeglądarki wysyła zdarzenia wyświetleń.",
+      "stateEmptyAction": "Skonfiguruj SDK",
+      "stateLowTitle": "Tylko {count} wyświetlenie strony | Tylko {count} wyświetleń stron",
+      "stateLowBody": "Percentyle są niewiarygodne przy mniej niż {min} wyświetleniach, więc werdykt jest ukryty. Wartości pokazano wyłącznie informacyjnie.",
+      "stateErrorTitle": "Nie udało się załadować {panel}",
+      "stateErrorBody": "Zapytanie nie powiodło się lub przekroczyło limit czasu. Inne panele nie są tym objęte.",
+      "retry": "Ponów",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "kluczowe wskaźniki",
+      "panelPages": "strony",
+      "panelSegments": "segmenty",
+      "panelRelease": "porównanie wersji",
+      "panelFrustration": "frustracja użytkowników",
+      "schemaErrorTitle": "Nie udało się załadować schematu RUM",
+      "schemaErrorBody": "Nie udało się odczytać pól strumienia, więc przegląd nie może ustalić, które panele pokazać.",
+      "pagesShowAll": "Pokaż wszystkie {n} stron",
+      "pagesShowFewer": "Pokaż mniej stron",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Brak stron z wystarczającą liczbą wyświetleń",
+      "pagesEmptyBody": "Aby strona została uwzględniona w rankingu, potrzebuje co najmniej {n} wyświetleń w tym zakresie.",
+      "segEmptyTitle": "Brak danych o segmentach",
+      "segEmptyBody": "Dla tych wyświetleń nie zarejestrowano wartości przeglądarki, urządzenia, systemu operacyjnego, kraju ani połączenia.",
+      "releaseEmptyTitle": "Wymagane dwie wersje",
+      "releaseEmptyBody": "Porównanie wydań wymaga co najmniej dwóch wersji widocznych w tym zakresie.",
+      "releaseBefore": "Wersja {version} była już aktywna przed tym zakresem, więc nie pokazano czasu jej pierwszego wystąpienia.",
+      "pageErrorTitle": "Nie udało się wczytać przeglądu wydajności",
+      "pageErrorBody": "Zapytania nie powiodły się lub przekroczyły limit czasu. Ponów próbę, aby ponownie wczytać wszystkie panele.",
+      "verdictOver": "{vital} przekracza dobry próg {threshold} dla {pct}% odsłon.",
+      "verdictAllThree": "Wszystkie trzy wskaźniki Core Web Vitals spełniają próg przy p75.",
+      "verdictAllSome": "Wszystkie oceniane wskaźniki Core Web Vitals ({n}) spełniają próg przy p75.",
+      "releaseNewErrors": "{count} nowy błąd w tym wydaniu | W tym wydaniu nowe błędy: {count}",
+      "verdictNoData": "Brak danych Core Web Vitals",
+      "verdictNoDataLead": "Żadna z {count} odsłony w tym zakresie nie zgłosiła LCP, INP ani CLS. | Żadna z {count} odsłon w tym zakresie nie zgłosiła LCP, INP ani CLS.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Otwórz sesje.",
+      "pagesTableLabel": "Strony uszeregowane według wpływu",
+      "verdictSessions": "{count} sesja w tym zakresie. | W tym zakresie liczba sesji: {count}.",
+      "verdictCompare": "W porównaniu z poprzednim okresem.",
+      "deltaLower": "{v} mniej",
+      "deltaHigher": "{v} więcej",
+      "forbiddenTitle": "Brak uprawnień do wyświetlania {panel}",
+      "forbiddenBody": "Poproś administratora o dostęp do strumienia danych RUM.",
+      "pageForbiddenTitle": "Brak uprawnień do wyświetlania przeglądu wydajności",
+      "asideLabel": "Gdzie i co się zmieniło",
+      "pagesAbout": "O tym rankingu",
+      "chartPerFiveMinutes": "co 5 minut",
+      "chartPerThirtyMinutes": "co 30 minut",
+      "chartPerHour": "co godzinę",
+      "chartPerSixHours": "co 6 godzin",
+      "chartPerDay": "dziennie",
+      "chartIntervalOther": "na przedział",
+      "chartTableCaption": "Sesje i błędy na przedział",
+      "deltaChange": "{delta} względem poprzedniego okresu",
+      "deltaChangePts": "{delta} pkt względem poprzedniego okresu",
+      "deltaFlat": "Bez zmian względem poprzedniego okresu",
+      "deltaNewMsg": "Nowe względem poprzedniego okresu",
+      "verdictP75Note": "Ocena zawsze opiera się na p75; p50 i p95 zmieniają tylko wartości.",
+      "releaseNote": "Porównuje dwie najnowsze wersje, niezależnie od ustawienia filtru Wersja.",
+      "kpiEmptyTitle": "Brak sesji w tym zakresie",
+      "kpiEmptyBody": "Poszerz zakres czasu lub wyczyść filtr.",
+      "releaseImproved": "poprawa",
+      "releaseWorse": "pogorszenie",
+      "segOs": "OS",
+      "segConnection": "Połączenie",
+      "pagesAllLink": "Wszystkie strony",
+      "pagesAllLinkAria": "Wszystkie strony w Analityce produktu",
+      "frustrationReplayLink": "Obejrzyj nagranie",
+      "frustrationReplayHint": "Otwiera sesje z oznakami frustracji w tym zakresie; te, które zostały zarejestrowane, mają nagranie.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "W tym zakresie nic nie zostało zarejestrowane. Poszerz zakres czasu lub skonfiguruj pakiet SDK przeglądarki, jeśli ta aplikacja nie wysłała jeszcze danych.",
+      "stateEmptyFiltered": "Nic nie pasuje do tych filtrów w tym zakresie. Wyczyść filtry, aby zobaczyć wszystkie usługi, środowiska i wersje.",
+      "clearFilters": "Wyczyść filtry",
+      "stateRefreshing": "Odświeżanie {panel}",
+      "tileOpenSessions": "{label}: {value}. Otwarte sesje",
+      "tileOpenErrors": "{label}: {value}. Otwarte śledzenie błędów",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Ten przegląd uwzględnia wyłącznie sesje przeglądarki. Metryki aplikacji mobilnej znajdują się poniżej.",
+      "mixedMobileNote": "Poniższe filtry dotyczą wyłącznie metryk aplikacji mobilnej."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Usuń",
     "confirmDeleteHead": "Usuń użytkownika",
     "confirmDeleteMsg": "Czy na pewno chcesz usunąć użytkownika {name}?",
+    "block": "Zablokuj",
+    "confirmBlockHead": "Zablokuj użytkownika",
+    "confirmBlockMsg": "{email} dołączył przez Twoją zweryfikowaną domenę. Zablokowanie doda tę osobę do ograniczeń domenowych tej organizacji i usunie ją z tej organizacji. Z innych zmapowanych organizacji zostanie usunięta przy następnym logowaniu.",
     "cancel": "Anuluj",
     "save": "Zapisz",
     "ok": "OK",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Cofnij zaproszenie",
     "revokeInvitationMsg": "Czy na pewno chcesz cofnąć zaproszenie dla {email}?",
     "deleteUsersTitle": "Usuń użytkowników",
-    "deleteUsersMsg": "Czy na pewno chcesz usunąć {count} użytkownika? | Czy na pewno chcesz usunąć {count} użytkowników?"
+    "deleteUsersMsg": "Czy na pewno chcesz usunąć {count} użytkownika? | Czy na pewno chcesz usunąć {count} użytkowników?",
+    "deleteUsersBlockNote": "{count} z nich dołączyło przez Twoją zweryfikowaną domenę i zostanie zablokowanych zamiast usuniętych."
   },
   "invitation": {
     "pendingInvitations": "Oczekujące zaproszenia",
@@ -3403,8 +3597,6 @@
       },
       "show": "Pokaż",
       "searchPermissions": "Szukaj uprawnień",
-      "filterModules": "Filtruj moduły",
-      "noModuleMatch": "Brak modułów pasujących do filtra",
       "moduleScopeAll": "Wszystkie",
       "moduleScopeGranted": "Wybrane",
       "noGrantedModule": "Nie wybrano jeszcze żadnego modułu",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Uprawnienie | Uprawnienia",
       "summaryReachSome": "{count} z {total}",
       "summaryEmptyTitle": "Ta rola jeszcze nic nie przyznaje",
-      "summaryEmptyDescription": "Wybierz moduł po lewej stronie lub zacznij od presetu.",
+      "summaryEmptyDescription": "Zacznij od presetu lub wybierz moduły z listy.",
       "presetReadonlyTitle": "Tylko do odczytu",
       "presetReadonlyDescription": "Lista i odczyt w każdym module",
       "presetDbmTitle": "Podgląd monitorowania baz danych",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "Żaden z {total} strumieni metryk Kubernetes nie istnieje jeszcze w tej organizacji, więc nic nie zostało wstępnie wybrane.",
       "rumPresetSeeded": "Wstępnie wybrano dostęp do odczytu dla {matched} z {total} strumieni RUM, a także mapy źródeł i wszelkie uprawnienia do RUM Product Analytics. Sprawdź przed zapisaniem.",
       "rumPresetNoMatch": "Żaden z {total} strumieni RUM jeszcze nie istnieje w tej organizacji, więc nic w nich nie zostało wstępnie wybrane; mapy źródeł i wszelkie uprawnienia do RUM Product Analytics zostały jednak przygotowane.",
-      "moduleGroupFleet": "Flota"
+      "moduleGroupFleet": "Flota",
+      "filterModulesTasks": "Filtruj moduły",
+      "noModuleMatchQuery": "Żaden moduł nie pasuje do „{query}”",
+      "noModuleMatchHint": "Szukaj według modułu, grupy lub zadania, na przykład slack, panel lub token.",
+      "presetAlertManagerTitle": "Menedżer alertów",
+      "presetAlertManagerDescription": "Tworzenie alertów i zarządzanie nimi, ich miejscami docelowymi i wiadomościami",
+      "presetAlertViewerTitle": "Podgląd alertów",
+      "presetAlertViewerDescription": "Przeglądanie alertów, miejsc docelowych i szablonów bez ich zmieniania",
+      "presetDashboardEditorTitle": "Edytor pulpitów",
+      "presetDashboardEditorDescription": "Tworzenie i edycja pulpitów, z dostępem do odczytu odpytywanych danych",
+      "presetDashboardViewerTitle": "Podgląd pulpitów",
+      "presetDashboardViewerDescription": "Otwieranie pulpitów i odczyt danych, na których opierają się ich panele",
+      "presetPipelineEditorTitle": "Edytor potoków",
+      "presetPipelineEditorDescription": "Tworzenie potoków i funkcji, z dostępem do odczytu strumieni i tabel wzbogacania",
+      "presetApplied": "{title}: dodano {permissions}. Przejrzyj zmiany przed zapisaniem.",
+      "presetPermissionCount": "{count} uprawnienie | uprawnienia: {count}",
+      "companionReasonAlertStreams": "aby zapisywać alerty. Serwer sprawdza dostęp do strumieni przy zapisie",
+      "companionReasonAlertDestinations": "aby wybrać, dokąd są wysyłane alerty",
+      "companionReasonDestinationTemplates": "aby wybrać szablon wiadomości, którego wymaga każde miejsce docelowe",
+      "companionReasonDashboardStreams": "aby wczytać dane paneli",
+      "presetsTitle": "Presety",
+      "presetsClose": "Zamknij presety",
+      "presetsShow": "Pokaż presety",
+      "presetsSubtitle": "Dodaj uprawnienia z presetu do tej roli. Nic nie zostanie usunięte.",
+      "presetsSectionBuiltin": "Wbudowane",
+      "presetsSectionJob": "Według stanowiska",
+      "presetAddsTooltip": "Dodaje {count} uprawnienie | Dodaje uprawnienia: {count}",
+      "presetInRole": "W roli",
+      "presetInRoleTooltip": "Ta rola ma już wszystko z tego presetu",
+      "presetBack": "Wszystkie presety",
+      "presetModuleCount": "{count} moduł | moduły: {count}",
+      "presetSummaryAdds": "Dodaje {permissions} ({modules}).",
+      "presetSummaryWrite": "Dostęp do zapisu w modułach: {modules}.",
+      "presetSummaryViewOnly": "Tylko podgląd: nie można niczego tworzyć, edytować ani usuwać.",
+      "presetSummaryHasAll": "Ta rola ma już wszystko z tego presetu.",
+      "presetSummarySkipped": "{count} uprawnienie, które ta rola już ma, zostanie pominięte. | Pominięte uprawnienia, które ta rola już ma: {count}.",
+      "presetStillMissing": "Nadal brakuje po dodaniu: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "Po dodaniu niczego nie będzie brakować.",
+      "neededBy": "Wymagane przez {modules}",
+      "stillNeededBy": "Nadal wymagane przez {modules}",
+      "presetReadsEveryStream": "Odczytuje wszystkie strumienie w tej organizacji, także nowe.",
+      "presetAddButton": "Dodaj {count} uprawnienie | Dodaj uprawnienia ({count})",
+      "presetNothingToAdd": "Nic do dodania",
+      "presetApplyNote": "Dodane uprawnienia stają się niezapisanymi zmianami. Przejrzyj je przed zapisaniem.",
+      "presetLoadingStreams": "Wczytywanie strumieni",
+      "presetNoMatchingStreams": "W tej organizacji nie ma jeszcze pasujących strumieni.",
+      "reviewMissingTooltip": "Brakuje {count} modułu, aby ta rola działała | Brakujące moduły potrzebne do działania tej roli: {count}",
+      "notAddedYetTitle": "Jeszcze nie dodano · {modules}",
+      "companionAdd": "Dodaj",
+      "companionAddItem": "Dodaj {item}",
+      "companionAddAll": "Dodaj wszystkie",
+      "companionOpenStreams": "Otwórz strumienie",
+      "companionOpenStreamsTooltip": "Wybierz, które strumienie ta rola może odczytywać",
+      "companionNeeds": "{module} tego potrzebuje, {reason}.",
+      "companionNeedsThis": "{module} potrzebuje tego uprawnienia, {reason}.",
+      "companionStillNeedsThis": "{module} nadal potrzebuje tego uprawnienia, {reason}.",
+      "yourChanges": "Twoje zmiany",
+      "yourChangesCount": "{changes} ({modules})",
+      "yourChangesNone": "Jeszcze brak",
+      "changeCount": "{count} zmiana | zmiany: {count}",
+      "changeOtherGroup": "Inne",
+      "saveSuccessCounts": "Zapisano: {changes} ({modules}).",
+      "effectCan": "Może {actions} {target}.",
+      "effectCannot": "Nie może już {actions} {target}.",
+      "effectCanLoadDestinations": "Może wczytać listę miejsc docelowych.",
+      "effectCannotLoadDestinations": "Nie może już wczytać listy miejsc docelowych.",
+      "effectCanLoadTemplates": "Może wczytać listę szablonów.",
+      "effectCannotLoadTemplates": "Nie może już wczytać listy szablonów.",
+      "verbView": "wyświetlać",
+      "verbSeeListOf": "widzieć na liście",
+      "verbList": "listować",
+      "verbOpen": "otwierać",
+      "verbCreate": "tworzyć",
+      "verbEdit": "edytować",
+      "verbDelete": "usuwać",
+      "targetEveryStream": "każdy strumień (logi, metryki, trace i indeksy), w tym nowe",
+      "targetTypeStreams": "wszystkie strumienie {type}",
+      "targetOneStream": "strumień {type} {name}",
+      "targetAlertsEveryFolder": "alerty we wszystkich folderach, w tym w nowych folderach",
+      "targetAlertsInFolder": "alerty w folderze {name}",
+      "targetOneAlert": "alert {name}",
+      "targetDashboardsEveryFolder": "pulpity we wszystkich folderach, w tym w nowych folderach",
+      "targetDashboardsInFolder": "pulpity w folderze {name}",
+      "targetOneDashboard": "pulpit {name}",
+      "targetReportsEveryFolder": "raporty we wszystkich folderach, w tym w nowych folderach",
+      "targetReportsInFolder": "raporty w folderze {name}",
+      "targetOneReport": "raport {name}",
+      "targetEveryDestination": "każde miejsce docelowe alertów (Slack, e-mail, webhooki), w tym nowe",
+      "targetOneDestination": "miejsce docelowe {name}",
+      "targetEveryTemplate": "każdy szablon powiadomień, w tym nowe",
+      "targetOneTemplate": "szablon {name}",
+      "targetAllOf": "wszystkie {module}, w tym nowe",
+      "targetItemIn": "{name} w {module}",
+      "noteDestinationsFiltered": "Widzą tylko miejsca docelowe, które mogą też otworzyć. Dodaj „Pobierz” tutaj lub w pojedynczych miejscach docelowych, aby wybrać, które.",
+      "noteTemplatesFiltered": "Widzą tylko szablony, które mogą też otworzyć. Dodaj „Pobierz” tutaj lub w pojedynczych szablonach, aby wybrać, które.",
+      "presetStreamsFailed": "Nie udało się wczytać listy strumieni.",
+      "presetRetry": "Ponów próbę",
+      "presetRestored": "{title}: przywrócono {permissions}. Przejrzyj zmiany przed zapisaniem.",
+      "presetSummaryRestores": "Zachowuje {count} uprawnienie oznaczone przez Ciebie do usunięcia. | Zachowuje uprawnienia oznaczone przez Ciebie do usunięcia: {count}.",
+      "presetRestoreButton": "Zachowaj {count} uprawnienie | Zachowaj uprawnienia ({count})",
+      "effectStillAllowed": "Brak zmiany dostępu: szersze uprawnienie nadal na to pozwala."
     },
     "rolesPage": {
       "subtitle": "Role łączą uprawnienia — przypisz je do użytkowników, kont usługi lub grup, aby przyznać dostęp.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Użytkownik zaktualizowany pomyślnie.",
       "userDeletedSuccess": "Użytkownik usunięty pomyślnie.",
       "errorDeletingUser": "Błąd podczas usuwania użytkownika.",
+      "userBlockedSuccess": "Użytkownik został pomyślnie zablokowany.",
+      "errorBlockingUser": "Błąd podczas blokowania użytkownika.",
+      "blockedButNotRemoved": "Użytkownik został zablokowany, ale nie można było usunąć go z tej organizacji.",
+      "blockedUsersSuccess": "Pomyślnie zablokowano {count} użytkownika | Pomyślnie zablokowano {count} użytkowników",
+      "blockedUsersPartial": "Zablokowano i usunięto {count} użytkownika, ale nie udało się usunąć {failed} z tej organizacji | Zablokowano i usunięto {count} użytkowników, ale nie udało się usunąć {failed} z tej organizacji",
+      "blockedUsersNotRemoved": "Zablokowano {count} użytkownika, ale nie udało się usunąć go z tej organizacji | Zablokowano {count} użytkowników, ale nie udało się usunąć ich z tej organizacji",
       "pleaseWait": "Proszę czekać...",
       "invitationRevokedSuccess": "Zaproszenie odwołane pomyślnie.",
       "errorRevokingInvitation": "Błąd podczas odwoływania zaproszenia.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Trace są przechwytywane za pomocą eBPF: nie są potrzebne zmiany w kodzie ani SDK. Kontekst trace'a przechodzi między usługami tylko przez HTTP w postaci jawnej (w aplikacjach Go także przez HTTPS, z wyjątkiem węzłów z kernel lockdown). Śledzony jest proces pasujący do któregokolwiek z portów, ścieżki pliku wykonywalnego lub wiersza poleceń; wzorce glob nie mogą zawierać `,`, `{'{'}` ani `{'}'}`, a port pasuje do każdego procesu, który ma na nim gniazdo. Wymaga Helm 3.14+ i operatora OpenTelemetry v0.142.0+; jeśli Twój jest starszy, najpierw go zaktualizuj poleceniem `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Jeśli eBPF był już włączony przy starszym operatorze, uruchom polecenie ponownie z `--force` (`--force-replace` w Helm 4). Ponowne uruchomienie powyższego polecenia instalacji resetuje wydanie i wyłącza eBPF, więc potem uruchom to polecenie ponownie. Przestrzeń nazw `openobserve-collector` musi zezwalać na uprzywilejowane pody, a węzły muszą działać pod Linuksem na amd64 lub arm64 z jądrem 5.8+ (lub 4.18 z rodziny RHEL z backportami eBPF) i BTF. Nie wybieraj aplikacji, które już wysyłają własne trace'y, ani podów używających sidecara Go `inject-go`.",
       "k8sEbpfVariant": "eBPF (dowolny język, bez zmian w kodzie)",
       "k8sLibrariesVariant": "Biblioteki językowe (automatyczna instrumentacja)",
+      "k8sNetworkFlowsDesc": "eBPF DaemonSet kolektora rejestruje **bajty przesyłane między obciążeniami przez dowolny protokół TCP lub UDP** na każdym węźle z systemem Linux, w tym bazy danych, pamięci podręczne i inne usługi, które nie są śledzone. Są one raportowane jako metryka `obi_network_flow_bytes` z etykietami właściciela źródła i miejsca docelowego (Deployment, StatefulSet, Node, …) oraz przestrzeni nazw. Działa z tracingiem eBPF i bez niego.",
+      "k8sNetworkFlowsNote": "Wymaga Helm w wersji 3.14+ oraz operatora OpenTelemetry w wersji v0.142.0+. Przestrzeń nazw `openobserve-collector` musi zezwalać na uprzywilejowane pody, a węzły muszą działać pod kontrolą Linuksa na amd64 lub arm64, z jądrem 5.8+ (lub 4.18 z rodziny RHEL z backportami eBPF) i BTF. Pody eBPF działają w sieci hosta, a własne metryki kolektora nasłuchują na `127.0.0.1:8888` w każdym węźle, więc ten port musi być tam wolny. Ustawione wcześniej selektory trace eBPF są zachowywane. Ponowne uruchomienie powyższego polecenia instalacji resetuje wydanie i wyłącza tę funkcję, więc po zakończeniu uruchom to polecenie ponownie. Te same bajty mogą być zgłaszane więcej niż raz: ruch między węzłami jest zgłaszany przez oba węzły, a połączenie z Service jest wykazywane zarówno dla samego Service, jak i dla obciążenia za nim. Przewodnik po przepływach sieciowych eBPF wyjaśnia, jak je odpytywać bez podwójnego liczenia.",
+      "k8sNetworkFlowsTitle": "Zobacz, które obciążenia komunikują się ze sobą: przepływy sieciowe eBPF",
       "k8sInstallerNote": "To automatycznie instaluje cert-managera, operatora OpenTelemetry i kolektor OpenObserve.",
       "k8sInternalEndpointNote": "Użyj tego, gdy OpenObserve działa w tym samym klastrze — ruch nigdy go nie opuszcza.",
       "k8sTroubleAnnotationA": "Wstrzyknięcie następuje przy tworzeniu poda, więc istniejące pody pozostają bez zmian do czasu restartu — uruchom `kubectl rollout restart deployment -n my-namespace`. Potwierdź, że adnotacja została dodana, za pomocą `kubectl get ns my-namespace -o yaml`, i sprawdź, czy wartość pasuje do `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "Instalacja kończy się błędem dotyczącym webhooka admission",
       "linuxAgentFixBody": "Instalator uruchamia agenta jako usługę systemd. Jeśli nic nie dociera, potwierdź, że działa, i przeczytaj jego logi pod kątem błędu uwierzytelniania lub łączności:",
       "linuxTracesNote": "Trace są przechwytywane za pomocą eBPF: nie są potrzebne zmiany w kodzie ani SDK. Śledzony jest proces pasujący do któregokolwiek z portów, ścieżki pliku wykonywalnego lub wiersza poleceń; wzorce glob nie mogą zawierać `,`, `{'{'}` ani `{'}'}`. Śledzenie wymaga systemu Linux 5.8+ (lub 4.18 z rodziny RHEL z backportami eBPF) z BTF; agent działa wtedy jako root. Jeśli host nie może śledzić, instalacja zatrzymuje się i pozostawia działającego agenta bez zmian. Jeśli agent następnie nie uruchomi się z włączonym śledzeniem, zostaje ono wyłączone — podobnie jak logi i metryki — dopóki nie uruchomisz ponownie polecenia **Logs & metrics** lub nie naprawisz przyczyny i nie uruchomisz ponownie z włączonym śledzeniem. Śledzone aplikacje dodają nagłówek W3C `traceparent` do wychodzących żądań HTTP w postaci jawnego tekstu. Poniższy przewodnik po śledzeniu eBPF omawia HTTPS i powtarzające się flagi.",
+      "linuxNetworkFlowsDesc": "Uruchom instalator z opcją `--network-flows`, aby raportować **bajty wysyłane i odbierane przez ten host przez dowolny protokół TCP lub UDP** jako metrykę `obi_network_flow_bytes`. Każdy przepływ jest oznaczany etykietami `src_cidr` i `dst_cidr` odpowiadającymi sieciom z listy, więc podaj każdemu hostowi tę samą listę: jeden wpis `/32` na host tworzy mapę host–host.",
+      "linuxNetworkFlowsNote": "Wymaga Linuksa 5.8+ (lub jądra 4.18 z rodziny RHEL z backportami eBPF) z BTF; agent działa wtedy jako root. Działa ze śledzeniem i bez niego, ale każde uruchomienie instalatora zastępuje konfigurację agenta: aby zachować włączone śledzenie, dodaj flagi `--trace-*` i `--service-name` z polecenia **Logi, metryki i trace eBPF**. Jeśli host nie może uruchomić eBPF, instalacja zatrzymuje się i pozostawia działającego agenta bez zmian. Jeśli następnie przechwytywanie sieci nie uruchomi się, agent zostaje wyłączony — logi i metryki również — dopóki nie uruchomisz ponownie polecenia **Logi i metryki** lub nie naprawisz przyczyny i nie uruchomisz go ponownie z `--network-flows`. Ruch między dwoma hostami, na których działa agent, jest zgłaszany przez każdego z nich, a ruch loopback jest liczony, chyba że oba końce mają ten sam adres. Poniższy przewodnik po przepływach sieciowych eBPF wyjaśnia etykiety i sposób odpytywania ich bez podwójnego liczenia.",
+      "linuxNetworkFlowsTitle": "Zobacz, które hosty komunikują się ze sobą: przepływy sieciowe eBPF",
       "linuxTracesVerifyNote": "Przy włączonym śledzeniu trace pojawią się, gdy śledzona aplikacja obsłuży żądanie.",
+      "ebpfNetworkFlowsGuideLink": "Przewodnik po przepływach sieciowych eBPF",
       "ebpfTracingGuideLink": "Przewodnik po śledzeniu eBPF",
       "logsMetricsTracesVariant": "Logi, metryki i trace eBPF",
       "logsMetricsVariant": "Logi i metryki",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Skieruj dowolny eksporter OpenTelemetry na OpenObserve — kolektor lub SDK, HTTP lub gRPC. Twój punkt końcowy i token są wypełnione poniżej.",
       "taglineWindows": "Zainstaluj agenta OpenObserve na dowolnym hoście Windows — Event Log, liczniki wydajności i metryki hosta.",
       "testAgain": "Przetestuj ponownie",
+      "networkFlowsHelp": "Wpisy CIDR lub CIDR=NAZWA, oddzielone przecinkami bez spacji; każdy CIDR wymaga długości prefiksu, np. 10.0.1.5/32, a nazwy mogą zawierać wyłącznie litery, cyfry, ., _ i -. Adresy, które nie pasują do żadnego wpisu, pozostają bez etykiety; 0.0.0.0/0=other oznacza resztę IPv4, a ::/0=other6 resztę IPv6.",
+      "networkFlowsLabel": "Sieci do etykietowania",
+      "networkFlowsRequired": "Podaj co najmniej jedną sieć: przepływy są oznaczane etykietami sieci z listy.",
       "traceCmdHelp": "Dla aplikacji w Pythonie, Node.js i Javie.",
       "traceCmdLabel": "Wiersz poleceń",
       "traceExeLabel": "Ścieżka pliku wykonywalnego",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Ukryj komórki poniżej",
     "heatmapHideBelowTooltip": "Komórki o mniejszej wartości pozostają puste.",
     "heatmapHideBelowNote": "Komórki poniżej {value} są ukryte",
+    "boxplotWhisker": "Wąsy",
+    "boxplotWhiskerMinMax": "Od minimum do maksimum",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Pole wiadomości",
+    "logsLevelField": "Pole poziomu",
+    "logsTimeField": "Pole czasu",
+    "htmlPanelFieldTooltip": "Pozostaw puste, aby wykryć kolumnę z wyników zapytania",
+    "logsOrder": "Kolejność",
+    "logsOrderNewest": "Najnowsze najpierw",
+    "logsOrderOldest": "Najstarsze najpierw",
+    "logsOrderTooltip": "Porządkuje wiersze zwrócone przez zapytanie. Niezmienione zapytanie startowe jest też pobierane w tej kolejności, więc „Najstarsze najpierw” pokazuje najwcześniejsze logi.",
+    "logsShowTime": "Pokaż czas",
+    "logsWrap": "Zawijaj wiersze",
+    "logsPrettifyJson": "Formatuj JSON",
     "distributionBucketCount": "Liczba przedziałów",
     "distributionBucketSize": "Szerokość przedziału",
     "distributionBucketSizeTooltip": "Szerokość każdego przedziału w jednostkach pola. Jeśli ustawiona, zastępuje liczbę przedziałów.",
@@ -7822,6 +8145,8 @@
       "gauge": "Wskaźnik",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Wykres pudełkowy",
+      "logs": "Logi",
       "barGauge": "Wskaźnik słupkowy",
       "distribution": "Rozkład",
       "treemap": "Mapa drzewa",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: Brak wymaganego argumentu na pozycji {index}",
       "fieldNotAllowedForMetric": "Pole {label} nie jest dozwolone dla wykresu metrycznego",
       "rawValueSampled": "Na podstawie pierwszych {count} wierszy",
+      "addAtMostOneFieldFor": "Dodaj co najwyżej jedno pole dla {label}",
+      "boxplotMin": "Min",
+      "boxplotMax": "Maks",
+      "boxplotLowerWhisker": "Dolny wąs",
+      "boxplotUpperWhisker": "Górny wąs",
+      "boxplotMedian": "Mediana",
+      "boxplotSamples": "Próbki",
+      "boxplotOutlier": "Wartość odstająca",
       "fieldNotAllowedForDistribution": "Pole {label} jest niedozwolone na wykresie rozkładu",
       "distributionCount": "Liczba",
       "addAtLeastOneFieldFor": "Dodaj co najmniej jedno pole dla {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Brak dostępu",
       "urlHiddenHint": "Nie możesz wyświetlić pulpitu tego linku, więc jego publiczny URL jest ukryty.",
       "orgDisabledHint": "Linki publiczne są wyłączone w tej organizacji",
+      "orgDisabledBanner": "Linki publiczne są wyłączone dla tej organizacji, więc żaden link nie jest udostępniany. Administrator może je ponownie włączyć.",
+      "disabledPaused": "Wyłączone · Wstrzymane",
       "takeOver": "Przejmij",
       "takeOverTitle": "Przejąć ten link?",
       "takeOverBody": "Staniesz się osobą publikującą. Strona publiczna pokaże to, co masz prawo widzieć, a to może być więcej lub mniej niż wcześniej. Każdy, kto ma URL, zachowuje dostęp, a link jest od teraz aktywny.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Grupa",
     "wellSubgroup": "Podgrupa",
     "wellSize": "Rozmiar",
+    "wellCategory": "Kategoria",
     "value": "Wartość"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Odsuń wartość wyzwalającą od obserwowanego stanu ustalonego.",
       "lengthenEvaluationWindow": "Wydłuż okno ewaluacji",
       "lengthenEvaluationWindowDesc": "Poszerz okres, aby krótki skok nie wyzwalał alertu.",
-      "enableDeduplication": "Włącz deduplikację",
-      "enableDeduplicationDesc": "Scal powtarzające się wyzwolenia w oknie deduplikacji.",
+      "enableDeduplication": "Włącz pomijanie powtórzeń",
+      "enableDeduplicationDesc": "Powiadamiaj raz na zmianę stanu zamiast przy każdej ocenie.",
       "reviewForDeletion": "Przejrzyj do usunięcia",
       "reviewForDeletionDesc": "Potwierdź, że zapytanie wciąż odpowiada rzeczywistości, zanim wycofasz alert.",
       "fixAlertQuery": "Napraw zapytanie alertu",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "ID organizacji",
     "alertCreationTitle": "Tworzenie alertu",
     "noAlertsFound": "Nie znaleziono alertów",
-    "suppressedByDeduplication": "Pominięty przez deduplikację",
-    "occurrence": "{count} wystąpienie | wystąpienia: {count}",
     "groupedNotification": "Powiadomienie zgrupowane",
     "alertsBatchedTogether": "alerty zgrupowane razem",
-    "notificationSent": "Powiadomienie wysłano",
-    "occurrencesDeduplicated": "zdeduplikowane wystąpienia",
     "alertExecutionDetails": "Szczegóły wykonania alertu",
     "evaluationTime": "Czas oceny",
     "queryTime": "Czas zapytania",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "Do: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Korelacja czasowa",
     "serviceGraphTooltipServiceDependency": "Zależność usługi",
-    "totalAlerts": "Łączna liczba alertów",
-    "usingDeduplication": "Korzystające z deduplikacji",
-    "deduplicationConfiguredTooltip": "Alerty ze skonfigurowaną deduplikacją",
-    "suppressionRate24h": "Współczynnik tłumienia (24h)",
     "suppressed": "stłumione /",
-    "total": "łącznie",
-    "passedLabel": "Zaliczone:",
-    "pendingBatches": "Oczekujące partie",
-    "pendingBatchesTooltip": "Alerty oczekujące na zgrupowanie",
     "historyTimeline": {
       "firing": "Wyzwolony",
       "ok": "OK",
@@ -10089,7 +10413,8 @@
     "endTime": "Czas zakończenia",
     "duration": "Czas trwania",
     "retries": "Ponowne próby",
-    "dedup": "Deduplikacja",
+    "suppression": "Pomijanie powtórzeń",
+    "suppressedAsRepeat": "Pominięto jako powtórzenie",
     "validation": {
       "streamTypeRequired": "Typ strumienia jest wymagany.",
       "streamNameRequired": "Nazwa strumienia jest wymagana.",
@@ -10281,15 +10606,6 @@
     "all": "Wszystkie",
     "history": "Historia alertów",
     "searcHistory": "Wprowadź nazwę alertu",
-    "deduplication": {
-      "fingerprintFields": "Grupuj podobne alerty według",
-      "fingerprintFieldsHint": "Wybierz pola, które powodują podobieństwo alertów (np. nazwa hosta, usługa). Pozostaw puste, aby automatycznie wykryć na podstawie kwerendy.",
-      "fingerprintFieldsTooltip": "Wybierz pola, które muszą być zgodne, aby alerty były uznane za duplikaty. Na przykład wybranie 'hostname' oznacza, że alerty z tego samego hosta będą grupowane. Różne typy alertów (np. wysokie CPU vs wysoka pamięć) nigdy nie są grupowane, nawet jeśli pochodzą z tego samego hosta. Pozostaw puste, aby automatycznie wykryć na podstawie typu zapytania.",
-      "timeWindow": "Uznaj alerty za identyczne w ciągu",
-      "timeWindowHint": "Okres czasu do grupowania podobnych alertów. Pozostaw puste, aby dopasować do interwału sprawdzania.",
-      "timeWindowTooltip": "Jak długo pamiętać ostatnie alerty do grupowania. Jeśli podobny alert wystąpi w tym czasie, nie zostanie wysłany ponownie. Pozostaw puste, aby użyć interwału sprawdzania alertu.",
-      "fingerprintFieldsHelp": "Pozostaw puste, aby automatycznie wykryć na podstawie kwerendy (SQL: kolumny GROUP BY, PromQL: etykiety, niestandardowe: pola warunku)"
-    },
     "summary": {
       "scrollToBottom": "Przewiń do dołu",
       "title": "Podsumowanie",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Powiadom mnie, gdy skonfigurowane warunki są spełnione"
       }
     },
-    "correlation": {
-      "title": "Korelacja alertów",
-      "description": "Skonfiguruj, jak alerty są korelowane i deduplikowane w całej organizacji. Alerty z pasującymi wartościami odcisku palca będą grupowane razem.",
-      "semanticFieldNote": "Uwaga: Mapowania pól semantycznych są konfigurowane w zakładce Tożsamość usługi.",
-      "enableOrgLevel": "Włącz deduplikację na poziomie organizacji",
-      "enableOrgLevelTooltip": "Włącz funkcje deduplikacji i korelacji dla wszystkich alertów w tej organizacji",
-      "enableCrossAlert": "Włącz deduplikację między alertami",
-      "enableCrossAlertTooltip": "Pozwól różnym alertom deduplikować się nawzajem, gdy mają ten sam odcisk palca",
-      "fingerprintGroups": "Grupy odcisków palca między alertami",
-      "fingerprintGroupsTooltip": "Wybierz, które grupy semantyczne mają być używane do tworzenia odcisków palca między alertami. Alerty będą deduplikowane, jeśli mają te same wartości dla tych wymiarów.",
-      "fingerprintGroupsHint": "Wybierz co najmniej jedną grupę semantyczną do deduplikacji między alertami",
-      "fingerprintGroupsRequired": "Co najmniej jedna grupa semantyczna musi być wybrana",
-      "defaultWindow": "Domyślne okno korelacji (minuty)",
-      "defaultWindowTooltip": "W przypadku braku dopasowania pola semantycznego, alerty i dane z danego okresu są uważane za powiązane",
-      "defaultWindowDescription": "W przypadku braku dopasowania pola semantycznego, alerty i dane z danego okresu są uważane za powiązane",
-      "defaultWindowPlaceholder": "Użyj domyślnie okresu alertu",
-      "cancelButton": "Anuluj",
-      "saveButton": "Zapisz",
-      "settingsSaved": "Ustawienia deduplikacji organizacji zostały pomyślnie zapisane",
-      "settingsSaveError": "Nie udało się zapisać ustawień"
-    },
     "placeholders": {
       "typeSomething": "Wpisz coś",
       "value": "Wartość",
       "selectColumn": "Wybierz kolumnę",
       "savedFunctions": "Zapisane funkcje",
-      "autoUsesCheckInterval": "Auto (używa interwału sprawdzania)",
       "addTag": "Dodaj tag i naciśnij Enter"
     },
     "steps": {
       "compareWithPast": "Porównaj z przeszłością",
-      "deduplication": "Deduplikacja",
       "advanced": "Zaawansowane"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Co powinno wyzwolić alert",
       "compareWithPast": "Porównaj bieżące wyniki z danymi z innego okresu",
       "alertSettings": "Ustaw reguły alertu i wybierz, jak chcesz być powiadamiany.",
-      "deduplication": "Unikaj wielokrotnego wysyłania tego samego alertu poprzez grupowanie podobnych alertów razem.",
       "advanced": "Zmienne kontekstowe, opis i szablon wiersza"
     },
     "failedToFetchHistory": "Nie udało się pobrać historii alertów",
@@ -10399,8 +10691,6 @@
         "closeActions": "Zamknij akcje",
         "viewAlertHistory": "Zobacz historię alertów",
         "actionsFor": "Akcje dla:",
-        "configureDedup": "Skonfiguruj deduplikację",
-        "configureDedupTooltip": "Skonfiguruj deduplikację dla tego alertu",
         "editAlert": "Edytuj alert",
         "editAlertTooltip": "Edytuj konfigurację alertu",
         "viewHistory": "Wyświetl historię",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "nowa wiadomość \"Rozwiązany\"",
       "keepFiringFor": "Utrzymuj stan alarmu przez",
       "keepFiringForTooltip": "Odczekaj tak długo po ustąpieniu warunku przed przywróceniem. 0 przywraca natychmiast.",
+      "suppressRepeats": "Pomijaj powtórzenia",
+      "suppressRepeatsTooltip": "Powiadamiaj raz, gdy alert zacznie być wyzwolony lub zmieni poziom, a nie przy każdej ocenie. Pozostaw wyłączone, aby nadal otrzymywać przypomnienia po każdym okresie wyciszenia.",
       "keepFiringForInvalid": "Wprowadź 0 lub więcej sekund",
       "keepFiringForTooLong": "Wprowadź maksymalnie 86400 sekund (24 godziny)"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Ten adres email został już dodany",
     "confirmRemoveEmail": "Czy na pewno chcesz usunąć adres e-mail {email}?",
     "domainNeedsEmails": "Domena '{domain}' musi mieć co najmniej jeden adres email, gdy nie zezwalasz wszystkim użytkownikom",
+    "noAllowedEmailsDenyAll": "Nie ma jeszcze dozwolonych adresów e-mail, więc każdy użytkownik z domeny {domain} jest odrzucany.",
     "domainSettingsSaved": "Ustawienia domeny zapisane pomyślnie",
     "errorSavingDomainSettings": "Błąd podczas zapisywania ustawień domeny",
     "noDomainMessage": "Brak skonfigurowanych domen. Dodaj domeny powyżej, aby ograniczyć dostęp.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Skonfiguruj co najmniej jeden zestaw tożsamości przed zapisaniem.",
       "discoveredServicesTab": "Odkryte usługi",
       "serviceDiscoveryTab": "Reguły wykrywania",
-      "alertCorrelationTab": "Grupowanie alertów",
       "fieldAliasesTab": "Mapowania pól",
       "fieldAliasesSaved": "Aliasy pól zostały zapisane pomyślnie",
       "fieldAliasesSaveError": "Nie udało się zapisać aliasów pól",
@@ -14079,27 +14371,144 @@
     "runsIn": "Działa w",
     "recommendedByFieldCoverage": "Zalecane na podstawie pokrycia pól w Twoich strumieniach.",
     "listConjunctionAndTwo": "{first} i {last}",
-    "domainOrgMappings": {
-      "title": "Mapowania domen na organizacje",
-      "subtitle": "Nowi użytkownicy logujący się z pasującą domeną e-mail są automatycznie dodawani do organizacji.",
+    "orgDomainMapping": {
+      "tabLabel": "Zarządzanie domenami",
+      "tabDesc": "Połącz swoje domeny e-mail, mapuj ich użytkowników do organizacji i kontroluj, którzy z nich mogą dołączać.",
+      "loadFailed": "Nie udało się załadować ustawień organizacji",
       "addMapping": "Dodaj mapowanie",
       "editMapping": "Edytuj mapowanie",
-      "empty": "Brak mapowań. Użyj „{addLabel}”, aby dodać mapowanie.",
       "domain": "Domena e-mail",
-      "domainHelp": "Część po {at_sign} w adresie e-mail użytkownika.",
+      "domainHelp": "Część adresu e-mail użytkownika po znaku {at_sign}. Domena jest połączona z tą organizacją i musi zostać zweryfikowana przez DNS.",
+      "domainHelpRequest": "Część adresu e-mail użytkownika po znaku {at_sign}. Domena zostanie powiązana z tą organizacją, gdy OpenObserve zatwierdzi żądanie.",
       "organization": "Organizacja",
-      "organizationPlaceholder": "Identyfikator organizacji",
-      "organizationHelp": "Identyfikator organizacji, do której dodawani są pasujący użytkownicy.",
+      "organizationHelp": "Ta organizacja lub jedna z organizacji należących do jej grupy rozliczeniowej.",
       "organizationRequired": "Organizacja jest wymagana",
       "baseRole": "Rola podstawowa",
-      "baseRoleHelp": "Rola przyznawana pasującym użytkownikom w tej organizacji.",
-      "roleClaimName": "Claim ról",
+      "baseRoleHelp": "Rola nadawana, gdy użytkownik zostanie dodany do tej organizacji. Obecni członkowie zachowują swoją bieżącą rolę.",
+      "roleClaimName": "Claim roli",
       "roleClaimNamePlaceholder": "Nazwa claimu, np. groups",
-      "roleClaimNameHelp": "Opcjonalne. Claim tokena zawierający niestandardowe role użytkownika; przy każdym logowaniu jego niestandardowe role w tej organizacji są z nim synchronizowane.",
-      "createMissingRoles": "Twórz role z claimu, które nie istnieją w organizacji",
-      "duplicateDomain": "Mapowanie dla tej domeny już istnieje",
-      "confirmRemove": "Czy na pewno chcesz usunąć mapowanie dla {name}?",
-      "deleteTitle": "Usuń mapowanie"
+      "roleClaimNameHelp": "Opcjonalne. Claim tokenu SSO zawierający listę ról niestandardowych użytkownika. Przy każdym logowaniu przez SSO role niestandardowe użytkownika w tej organizacji są zastępowane rolami z claimu; role z claimu, które nie istnieją, są pomijane, chyba że zostaną utworzone.",
+      "createMissingRoles": "Utwórz role z claimu, które nie istnieją w organizacji",
+      "verifyNow": "Zweryfikuj teraz",
+      "details": "Szczegóły",
+      "detailsDialogTitle": "Szczegóły połączenia dla {domain}",
+      "approvedLinkInfo": "Powiązano przez OpenObserve po zatwierdzeniu prośby o powiązanie. Rekord DNS nie jest potrzebny.",
+      "pendingRequestInfo": "OpenObserve rozpatruje tę prośbę. Nie trzeba nic robić do czasu jej zatwierdzenia.",
+      "rejectedRequestInfo": "OpenObserve odrzuciło tę prośbę.",
+      "verifyDialogTitle": "Zweryfikuj {domain}",
+      "recordDialogTitle": "Rekord DNS dla {domain}",
+      "lastCheckFailed": "Ostatnie sprawdzenie nie powiodło się: {reason}",
+      "state": {
+        "pending": "Oczekuje",
+        "verified": "Zweryfikowano",
+        "failed": "Niepowodzenie",
+        "requested": "Oczekuje na zatwierdzenie",
+        "approved": "Zatwierdzono",
+        "rejected": "Odrzucono"
+      },
+      "saved": "Zapisano mapowanie domeny",
+      "saveFailed": "Nie udało się zapisać ustawień",
+      "linkFailed": "Nie udało się powiązać domeny",
+      "unlinkFailed": "Nie udało się odłączyć domeny",
+      "verifyFailed": "Weryfikacja nie powiodła się",
+      "deleted": "Usunięto mapowanie",
+      "deleteTitle": "Usunąć mapowanie?",
+      "deleteMappingBody": "Użytkownicy z domeny {domain} nie będą już dodawani do organizacji {org} podczas logowania.",
+      "recordInstructions": "Dodaj ten rekord DNS TXT u swojego dostawcy DNS:",
+      "txtNameLabel": "Nazwa rekordu",
+      "txtValueLabel": "Wartość rekordu",
+      "copyTxtName": "Kopiuj nazwę rekordu",
+      "copyTxtValue": "Kopiuj wartość rekordu",
+      "txtNameCopied": "Skopiowano nazwę rekordu",
+      "txtValueCopied": "Skopiowano wartość rekordu",
+      "verifyHint": "Weryfikacja odbywa się automatycznie co {minutes} min. Możesz również zweryfikować teraz.",
+      "alreadyLinked": "Ta domena jest już powiązana z tą organizacją",
+      "failureReason": {
+        "recordMissing": "Nie znaleziono rekordu TXT",
+        "valueMismatch": "Znaleziono rekord TXT, ale wartość się nie zgadza",
+        "dnsFailed": "Nie udało się rozwiązać nazwy DNS"
+      },
+      "pageSubtitle": "Powiąż swoje domeny e-mail, przypisz ich użytkowników do organizacji i kontroluj, którzy z nich mogą dołączyć.",
+      "linkedTab": "Powiązane domeny",
+      "mappingsTab": "Mapowania",
+      "accessTab": "Zablokowani użytkownicy",
+      "requestsTab": "Prośby o powiązanie",
+      "linkDomain": "Powiąż domenę",
+      "sendRequest": "Wyślij prośbę",
+      "linkMethod": "Jak potwierdzić własność",
+      "method": {
+        "dns": "Rekord DNS",
+        "approved": "Zatwierdzona prośba",
+        "request": "Prośba o powiązanie",
+        "dnsTitle": "Dodaj rekord DNS TXT",
+        "dnsDesc": "Weryfikacja odbywa się automatycznie po opublikowaniu rekordu. Najlepsza opcja, gdy zarządzasz DNS domeny.",
+        "requestTitle": "Poproś OpenObserve o powiązanie",
+        "requestDesc": "Nasz zespół rozpatrzy prośbę i po zatwierdzeniu powiąże domenę."
+      },
+      "searchDomains": "Szukaj domen",
+      "searchMappings": "Szukaj według domeny lub organizacji",
+      "searchRequests": "Szukaj według domeny, organizacji lub osoby zgłaszającej",
+      "status": "Status",
+      "linkedVia": "Połączono przez",
+      "lastChecked": "Ostatnio sprawdzono",
+      "linked": "Domena połączona. Dodaj rekord DNS, aby ją zweryfikować.",
+      "verified": "Domena zweryfikowana",
+      "notVerifiedYet": "Nie znaleziono jeszcze rekordu DNS. Propagacja może zająć trochę czasu.",
+      "requestSent": "Wysłano żądanie połączenia",
+      "requestFailed": "Nie udało się wysłać żądania połączenia",
+      "keepRecordHint": "Pozostaw ten rekord na miejscu. Własność jest ponownie sprawdzana co {minutes} min; jeśli rekord będzie nieobecny dłużej niż {grace} min, domena zostanie oznaczona jako nieprawidłowa, a jej mapowania przestaną obowiązywać.",
+      "removeDomain": "Usuń domenę",
+      "removeTitle": "Usunąć domenę?",
+      "removeBody": "{domain} zostanie odłączona od tej organizacji.",
+      "removeWithMappingsBody": "{domain} zostanie odłączona od tej organizacji, a jej mapowanie ({count}) zostanie usunięte. | {domain} zostanie odłączona od tej organizacji, a jej mapowania ({count}) zostaną usunięte.",
+      "removed": "Domena usunięta",
+      "domainRequired": "Domena jest wymagana",
+      "mappingDomainHelp": "Mapować można tylko zweryfikowane domeny.",
+      "createsRoles": "Tworzy role",
+      "duplicateMapping": "Ta domena jest już mapowana do tej organizacji",
+      "domainNotVerified": "Niezweryfikowana",
+      "noVerifiedDomains": "Mapowania dotyczą zweryfikowanych domen. Najpierw połącz i zweryfikuj domenę.",
+      "goToLinked": "Połącz domenę",
+      "goToLinkedDesc": "Zweryfikuj posiadaną domenę, zanim zmapujesz jej użytkowników",
+      "enforceTitle": "Usuwaj użytkowników z innych organizacji",
+      "enforceDesc": "Gdy użytkownik z mapowanej domeny zaloguje się przez SSO, zostanie usunięty ze wszystkich organizacji poza tą i jej grupą rozliczeniową.",
+      "enforceConfirmTitle": "Usunąć użytkowników z innych organizacji?",
+      "enforceConfirmBody": "Za każdym razem, gdy użytkownik, którego domena e-mail ma tutaj mapowanie, zaloguje się przez SSO, zostanie usunięty ze wszystkich organizacji, które nie są tą organizacją ani nie wchodzą w skład jej grupy rozliczeniowej, w tym z jego organizacji osobistych.",
+      "enforceConfirmAction": "Włącz",
+      "enforceSaved": "Ustawienie zapisane",
+      "blockUsers": "Blokuj użytkowników",
+      "editBlockedUsers": "Edytuj zablokowanych użytkowników",
+      "block": "Blokuj",
+      "blockedCount": "{count} zablokowany | {count} zablokowanych",
+      "blockedEmails": "Zablokowane adresy e-mail",
+      "blocklistDomainHelp": "Jedna ze zweryfikowanych domen tej organizacji.",
+      "blocklistEmailsHelp": "Ci użytkownicy nie mogą przez SSO dołączyć do tej organizacji ani do jej grupy rozliczeniowej, a przy następnym logowaniu zostaną z nich usunięci.",
+      "ruleBlockedRequired": "Dodaj co najmniej jeden adres e-mail do zablokowania.",
+      "noDomainForBlocklist": "Każda zweryfikowana domena ma już zablokowanych użytkowników. Edytuj jej wiersz, aby ich zmienić.",
+      "unblockAll": "Odblokuj wszystkich",
+      "unblockAllTitle": "Odblokować wszystkich użytkowników?",
+      "unblockAllBody": "Każdy zablokowany użytkownik domeny {domain} będzie mógł ponownie dołączyć przy następnym logowaniu przez SSO.",
+      "blocklistSaved": "Zapisano zablokowanych użytkowników",
+      "blocklistDeleted": "Użytkownicy odblokowani",
+      "blocklistSection": "Zablokowani użytkownicy według domeny",
+      "filterPending": "Oczekujące",
+      "filterAll": "Wszystkie",
+      "requestedBy": "Zgłoszone przez",
+      "requestedAt": "Zgłoszono",
+      "verifiedAt": "Zweryfikowano",
+      "answeredBy": "Odpowiedział",
+      "reason": "Powód",
+      "reasonHelp": "Wyświetlane organizacji, która zgłosiła prośbę.",
+      "reasonRequired": "Aby odrzucić prośbę, wymagane jest podanie powodu.",
+      "approve": "Zatwierdź",
+      "reject": "Odrzuć",
+      "approveTitle": "Zatwierdzić prośbę o powiązanie?",
+      "rejectTitle": "Odrzucić prośbę o powiązanie?",
+      "approveBody": "Domena {domain} zostanie powiązana z {org} bez weryfikacji DNS.",
+      "rejectBody": "Organizacja {org} nie otrzyma domeny {domain}.",
+      "requestApproved": "Powiązano {domain}",
+      "requestRejected": "Odrzucono prośbę dotyczącą {domain}",
+      "decisionFailed": "Nie udało się zaktualizować prośby"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Wybierz opcję wykrywania w"
   },
   "search_history": {
-    "title": "Historia wyszukiwania",
+    "title": "Historia użycia i kosztów",
     "get_history": "Pobierz historię",
     "executed_at": "Wykonano o",
     "sql_query": "Zapytanie SQL",
-    "delayMessage": "Historia wyszukiwania może być opóźniona o"
+    "delayMessage": "Historia użycia i kosztów może być opóźniona o"
   },
   "correlation": {
     "unstableDimensionNote": "Niestabilny wymiar - zmiany po restarcie poda. Domyślnie: wszystkie wartości.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Dane są świeże",
     "dataGettingStale": "Dane zaczynają się przedawniać",
     "dataStale": "Dane są nieaktualne",
-    "lastRefreshed": "Ostatnie odświeżenie: {time}"
+    "lastRefreshed": "Ostatnie odświeżenie: {time}",
+    "refresh": "Odśwież",
+    "refreshWithAge": "Odśwież, ostatnio odświeżono {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Błąd sondy"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "kliknij",
       "actionType": "wpisz",
       "all": "Wszystkie",
@@ -19868,6 +20280,13 @@
       "attemptN": "Próba {n}",
       "detailAction": "Akcja",
       "detailSelector": "Selektor",
+      "detailStepId": "ID kroku",
+      "detailTargetUrl": "Docelowy URL",
+      "detailStatus": "Status",
+      "detailSkipReason": "Powód pominięcia",
+      "stepStatusSkipped": "Pominięty",
+      "stepStatusUnknown": "Nieznany",
+      "skippedCount": "Pominięte: {n}",
       "downloadTrace": "Pobierz {filename}",
       "errorFullscreenTitle": "Krok {id}: {action} - Błąd",
       "failedAtStartLoad": "Nie udało się otworzyć początkowego URL",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Maksimum {max}. Ponowienia są uruchamiane w ramach tego samego zadania, więc cała sekwencja musi zmieścić się w budżecie kontroli.",
       "retriesMaxBrowserHint": "Maksimum {max} dla kontroli przeglądarki. Każda próba ponownie uruchamia podróż na każdym urządzeniu, więc więcej przekroczyłoby limit czasu sondy i zgłosiło awarię, której Twoja witryna nigdy nie miała.",
       "retryDelay": "Poczekaj",
-      "retryDelaySuffix": "ms między ponownymi próbami.",
+      "retryDelaySuffix": "sekund między ponownymi próbami.",
       "schedule": "Harmonogram",
       "scheduleLater": "Zaplanuj później",
       "scheduleLaterTooltip": "Wybierz przyszłą datę i godzinę, aby aktywować sprawdzenie.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Konfiguracja restartu — skopiuj polecenie konfiguracji tego agenta, aby ponownie uruchomić instalację / restart dockera (np. po rotacji tokenu)",
         "noAgents": "Żaden agent nie zarejestrował się jeszcze dla tej lokalizacji.",
         "agentsUnavailable": "Agenci tej lokalizacji zarejestrowali się w innym klastrze i nie są tutaj widoczni.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Kontrole uruchamiane z tej lokalizacji",
         "checkName": "Nazwa",
         "noChecks": "Żadne kontrole nie zostały jeszcze przypisane do tej lokalizacji.",
@@ -20546,7 +20967,7 @@
       "nodes": "Węzły",
       "modelPricing": "Ceny modeli",
       "searchSchedulers": "Harmonogramy wyszukiwania",
-      "searchHistory": "Historia wyszukiwania",
+      "searchHistory": "Historia użycia i kosztów",
       "sessions": "Sesje",
       "evalTemplates": "Ewaluacje online — Szablony",
       "scorers": "Ewaluacje online — Ewaluatory",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Odśwież listę",
       "alertTemplatesAdd": "Dodaj nowy szablon",
       "alertTemplatesRefresh": "Odśwież listę",
-      "logsSearchHistory": "Otwórz historię wyszukiwania",
+      "logsSearchHistory": "Otwórz historię użycia i kosztów",
       "alertsImport": "Importuj alert",
       "panelEditorRun": "Wykonaj / zastosuj zapytanie",
       "panelEditorSave": "Zapisz i edytuj dalej",
@@ -21131,6 +21552,7 @@
         "system": "system"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Dostępny",
         "passed": "Zaliczony",
         "healthy": "Zdrowy",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Nie udało się przejść do alertu",
       "alertNotFound": "Nie znaleziono alertu",
-      "alertNotFoundInAlerts": "Nie znaleziono alertu \"{name}\" wśród alertów ({count}).",
       "failedToLoadAlerts": "Nie udało się załadować alertów",
       "alertsDeletedSuccessfully": "Pomyślnie usunięto {count} alert | Pomyślnie usunięto alerty: {count}",
       "failedToDeleteAlerts": "Nie udało się usunąć {count} alertu | Nie udało się usunąć {count} alertów",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Proszę czekać podczas ładowania szablonów...",
       "alertSavedSuccessfully": "Alert został zapisany.",
       "alertUpdatedSuccessfully": "Alert został zaktualizowany.",
-      "openingDedupConfig": "Otwieranie konfiguracji deduplikacji dla: {name}",
       "editingAlert": "Edytowanie alertu: {name}",
       "ack": {
         "acked": "Potwierdzono {name}",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Edytor cen modeli",
     "storageSettings": "Ustawienia przechowywania",
     "domainManagement": "Zarządzanie domenami",
+    "orgDomainMapping": "Zarządzanie domenami",
     "slackApp": "Slack",
     "regexPatterns": "Wzorce wyrażeń regularnych",
     "syntheticsLocations": "Lokalizacje syntetyczne",
@@ -26099,7 +26520,7 @@
       "logged": "Zarejestrowano"
     },
     "policy": {
-      "gateHint": "Spośród zmian w istniejących alertach tylko deduplikacja stosuje się samodzielnie, z migawką stanu poprzedniego i okresem przeglądu: utrzymana, jeśli testy przejdą, wycofana, jeśli nie. Wszystko inne czeka na zatwierdzenie jednym kliknięciem.",
+      "gateHint": "Spośród zmian w istniejących alertach tylko włączenie pomijania powtórzeń jest stosowane automatycznie, z migawką stanu sprzed zmiany i oknem weryfikacji: zachowywane, jeśli sprawdzenia zakończą się pomyślnie, wycofywane, jeśli nie. Wszystko inne czeka na zatwierdzenie jednym kliknięciem.",
       "off": "Wył.",
       "suggest": "Sugeruj",
       "auto": "Auto",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Wstrzymuje wezwanie, aż analiza się zakończy, maksymalnie na 2 minuty. Przy awarii przepuszcza: jeśli triage przekroczy limit czasu lub zawiedzie, i tak wysyła wezwanie, informując, że analiza wciąż trwa lub nie powiodła się, a przyczyna pojawia się w wątku."
       },
       "classes": {
-        "EnableDeduplication": "Włącz deduplikację dla alertu, który powtarza się w ciągu kilku minut.",
+        "EnableDeduplication": "Włącz pomijanie powtórzeń dla alertu, który powiadamia przy każdej ocenie.",
         "CreateDetector": "Utwórz detektor anomalii dla żądań, błędów lub opóźnień usługi.",
         "RaiseThreshold": "Podnieś próg alertu, który wyzwala się w dniach, gdy wszystko działa poprawnie.",
         "LengthenEvaluationWindow": "Wydłuż okno alertu, który wielokrotnie zmienia stan.",
@@ -26667,10 +27088,10 @@
           "on": "alert połączenia"
         },
         "L-302": {
-          "done": "Pogrupowałem 3 alerty opóźnienia checkout w jeden",
-          "why": "Zadziałały razem w 94% przypadków, więc jedno spowolnienie wezwało Cię 3 razy.",
-          "from": "3 alerty",
-          "to": "1",
+          "done": "Włączono pomijanie powtórzeń dla 3 alertów opóźnień finalizacji zamówienia",
+          "why": "Powiadamiały przy każdej ocenie, dopóki pozostawały wyzwolone, więc jedno spowolnienie wywołało 120 wezwań.",
+          "from": "Każda ocena",
+          "to": "Raz na zmianę stanu",
           "on": "opóźnienie checkout"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "Wezwałem dyżurnego w sprawie nieudanych płatności w checkout.",
         "recsHeld": "Odłożyłem drobny problem z recommendations na piątkowe podsumowanie.",
         "diskApproved": "Zatwierdziłeś podniesienie alertu dyskowego na ingest-1 do {to}%.",
-        "latencyGrouped": "Pogrupowałem trzy alerty o spowolnieniu checkout w jeden, dzięki czemu pojedyncze spowolnienie wzywa dyżurnego tylko raz.",
+        "latencyGrouped": "Włączyłem pomijanie powtórzeń dla trzech alertów spowolnienia finalizacji zamówienia, więc pojedyncze spowolnienie wywołuje jedno wezwanie.",
         "queueFixed": "Dodałem workery kolejki orders, ale kolejka nadal rosła, więc wycofałem tę zmianę i wezwałem dyżurnego.",
         "loginPaged": "Wezwałem dyżurnego w sprawie wolnego logowania.",
         "queuePermission": "Zezwoliłeś mi samodzielnie dodawać workery kolejek, maksymalnie do 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Status potoku",
       "legendToggle": "Pokaż lub ukryj ten status na mapie"
     }
+  },
+  "recentSearches": {
+    "title": "Ostatnie wyszukiwania",
+    "aboutKeptDays": "Tylko Twoje wyszukiwania w {org}, widoczne tylko dla Ciebie. Przechowywane przez {days} dzień; oznaczone gwiazdką pozostają, aż je usuniesz. | Tylko Twoje wyszukiwania w {org}, widoczne tylko dla Ciebie. Przechowywane przez {days} dni; oznaczone gwiazdką pozostają, aż je usuniesz.",
+    "aboutKeptForever": "Tylko Twoje wyszukiwania w {org}, widoczne tylko dla Ciebie. Przechowywane do usunięcia.",
+    "pageTitle": {
+      "logs": "Ostatnie wyszukiwania logów",
+      "traces": "Ostatnie wyszukiwania trace",
+      "metrics": "Ostatnie wyszukiwania metryk",
+      "dbm": "Ostatnie wyszukiwania",
+      "profiles": "Ostatnie wyszukiwania"
+    },
+    "page": {
+      "logs": "Logi",
+      "traces": "Trace",
+      "metrics": "Metryki",
+      "dbm": "Baza danych",
+      "profiles": "Profile"
+    },
+    "allPages": "Wszystkie strony",
+    "viewAll": "Zobacz wszystkie",
+    "failedCount": "{count} nieudanych",
+    "keyHints": "↑↓ przesuń · PgUp/PgDn przewiń zapytanie · Enter uruchom · Shift+Enter tylko wczytaj · Esc zamknij",
+    "loadToFix": "Wczytaj, aby poprawić",
+    "emptyTitle": "Brak ostatnich wyszukiwań",
+    "loadError": "Nie udało się wczytać ostatnich wyszukiwań",
+    "retry": "Ponów",
+    "warning": "Zakończono z ostrzeżeniem: przekroczono limit czasu lub częściowe wyniki",
+    "failed": "Nieudane",
+    "ranCount": "uruchomiono {count}x",
+    "lineCount": "{count} wiersz | {count} wierszy",
+    "relativeWindow": "Ostatnie {period}",
+    "rerunNow": "Uruchom ponownie teraz",
+    "rerunOriginal": "W oryginalnym czasie",
+    "loadOnly": "Wczytaj bez uruchamiania",
+    "copyLink": "Kopiuj link",
+    "copyQuery": "Kopiuj zapytanie",
+    "star": "Oznacz gwiazdką",
+    "unstar": "Usuń gwiazdkę",
+    "linkCopied": "Skopiowano link",
+    "queryCopied": "Skopiowano zapytanie",
+    "copyFunction": "Kopiuj funkcję",
+    "functionCopied": "Skopiowano funkcję",
+    "functionLabel": "Funkcja (VRL)",
+    "searchPlaceholder": "Szukaj zapytań i strumieni",
+    "allStreams": "Wszystkie strumienie",
+    "statusAll": "Dowolny status",
+    "statusOk": "Powodzenie",
+    "statusError": "Nieudane",
+    "starredOnly": "Tylko oznaczone gwiazdką",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "Filtruj według daty uruchomienia",
+    "today": "Dzisiaj",
+    "yesterday": "Wczoraj",
+    "noMatch": "Żadne wyszukiwania nie pasują do tych filtrów",
+    "reset": "Zresetuj wszystko",
+    "resetFilters": "Zresetuj filtry",
+    "loadMore": "Wczytaj więcej",
+    "clear": "Wyczyść moją historię",
+    "confirmClear": "Wyczyść historię",
+    "clearBodyPage": "Spowoduje to usunięcie {count} ostatniego wyszukiwania na stronie {page} w organizacji {org}. Zapisane widoki nie zostaną zmienione. | Spowoduje to usunięcie {count} ostatnich wyszukiwań na stronie {page} w organizacji {org}. Zapisane widoki nie zostaną zmienione.",
+    "clearBodyAll": "Spowoduje to usunięcie {count} ostatniego wyszukiwania w organizacji {org} w modułach Logi, Trace i Metryki. Zapisane widoki nie zostaną zmienione. | Spowoduje to usunięcie {count} ostatnich wyszukiwań w organizacji {org} w modułach Logi, Trace i Metryki. Zapisane widoki nie zostaną zmienione.",
+    "includeStarred": "Usuń także moje {count} wyszukiwanie oznaczone gwiazdką | Usuń także moje {count} wyszukiwań oznaczonych gwiazdką",
+    "recentRow": "Ostatnie wyszukiwanie",
+    "deletedQuery": "Usunięto {query}",
+    "undo": "Cofnij"
   }
 }
diff --git a/web/src/locales/languages/pt-PT.json b/web/src/locales/languages/pt-PT.json
index a9be3782cb..1dc7f5281a 100644
--- a/web/src/locales/languages/pt-PT.json
+++ b/web/src/locales/languages/pt-PT.json
@@ -486,7 +486,11 @@
       "monitors": "monitores",
       "modelPricing": "definições de preço de modelo",
       "variables": "variáveis",
-      "experiments": "experimentos"
+      "experiments": "experimentos",
+      "linkedDomains": "domínios vinculados",
+      "domainMappings": "mapeamentos de domínio",
+      "domainRequests": "solicitações de vínculo",
+      "blockedUsers": "utilizadores bloqueados"
     },
     "demo": {
       "pageTitle": "Estados vazios — conjunto completo para revisão",
@@ -572,6 +576,30 @@
       "action": "Nova tarefa",
       "actionDesc": "Aponte o OpenObserve para o seu endpoint e teste a ligação."
     },
+    "noLinkedDomains": {
+      "title": "Nenhum domínio vinculado ainda",
+      "description": "Associe um domínio de e-mail que detém para mapear os seus utilizadores para as suas organizações e controlar quem pode iniciar sessão.",
+      "dns": "Adicionar um registro DNS",
+      "dnsDesc": "Verifique a propriedade com um registro TXT",
+      "request": "Solicitar um vínculo",
+      "requestDesc": "Peça ao OpenObserve para vincular o domínio para você"
+    },
+    "noDomainMappings": {
+      "title": "Nenhum mapeamento de domínio ainda",
+      "description": "Adicione automaticamente a esta organização, ou aos membros do seu grupo de faturação, os utilizadores que iniciam sessão com um domínio verificado.",
+      "action": "Adicionar mapeamento",
+      "actionDesc": "Escolha um domínio, uma organização e uma função"
+    },
+    "noBlockedUsers": {
+      "title": "Nenhum utilizador bloqueado",
+      "description": "Todos os utilizadores dos seus domínios verificados podem iniciar sessão. Bloqueie utilizadores específicos para impedir o acesso.",
+      "action": "Bloquear utilizadores",
+      "actionDesc": "Escolha um domínio e os e-mails a bloquear"
+    },
+    "noDomainRequests": {
+      "title": "Nenhuma solicitação de vínculo",
+      "description": "Solicitações de organizações para vincular um domínio aparecem aqui."
+    },
     "noDowntimes": {
       "title": "Ainda não há janelas de manutenção",
       "description": "Uma janela de manutenção mantém os alertas, as deteções de anomalias e as verificações sintéticas em execução e interrompe as respetivas notificações durante uma janela que agendar.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Desativar a execução automática",
     "autoRefreshWithValue": "Atualização automática: {value}",
     "searchHistory": "Histórico de pesquisa",
+    "usageCostHistory": "Histórico de utilização e custos",
     "createScheduledSearch": "Criar pesquisa agendada",
     "listScheduledSearch": "Listar pesquisas agendadas",
     "scheduleSearchJob": "Agendar trabalho de pesquisa",
@@ -1355,6 +1384,8 @@
     "scanSize": "Tamanho da análise",
     "deltaScanSize": "Tamanho da análise delta",
     "scannedSoFar": "Analisado {size}",
+    "quickModeHiddenFields": "O modo rápido está ativo. Esta linha mostra {shown} de {total} campos.",
+    "turnOffQuickMode": "Desativar modo rápido",
     "resultsProgressLabel": "Progresso da pesquisa",
     "histogramTitleError": "Erro ao gerar o título do histograma.",
     "selectLogStream": "Selecione o stream de logs",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Sem dados de rede para esta visualização",
     "apiEmptyDescription": "O stream selecionado não tem pedidos de recurso ou rede neste intervalo de tempo. As métricas de rede aparecem quando a aplicação instrumenta as suas chamadas HTTP.",
     "skipInactivity": "Ignorar inatividade",
+    "fullScreen": "Ecrã inteiro",
+    "exitFullScreen": "Sair do ecrã inteiro",
     "error": "Erro",
     "errorCount": "Contagem de erros",
     "all": "Todos",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Adicione uma segunda etapa para adicionar este funil a um dashboard",
         "snapshot": "O painel mantém estas etapas, filtros e regras de eventos nomeados como estão agora."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Visão geral do desempenho",
+      "filterService": "Serviço",
+      "filterEnv": "Ambiente",
+      "filterVersion": "Versão",
+      "filterAll": "Todos",
+      "verdictPass": "Core Web Vitals aprovados",
+      "verdictFail": "Core Web Vitals precisam de atenção",
+      "verdictAllPass": "Tudo aprovado",
+      "verdictNeedWork": "{count} de {total} a melhorar | {count} de {total} a melhorar",
+      "percentileLabel": "Percentil",
+      "bandGood": "Bom",
+      "bandNeeds": "A melhorar",
+      "bandPoor": "Fraco",
+      "bandGoodPct": "{n}% bom",
+      "bandNeedsPct": "{n}% a melhorar",
+      "bandPoorPct": "{n}% fraco",
+      "bandAria": "{good}% bom, {needs}% a melhorar, {poor}% fraco",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} mais rápido",
+      "deltaSlower": "{v} mais lento",
+      "deltaNone": "sem alteração",
+      "deltaNoPrev": "dados anteriores insuficientes",
+      "kpiSessions": "Sessões",
+      "kpiErrorFree": "Sessões sem erros",
+      "kpiErrors": "Total de erros",
+      "kpiUnhandled": "Erros não tratados",
+      "kpiRegion": "Indicadores principais",
+      "sparkAria": "Tendência de {label} no intervalo selecionado",
+      "chartTitle": "Sessões e erros",
+      "chartInterval": "por intervalo",
+      "legendSessions": "Sessões",
+      "legendErrors": "Erros",
+      "releaseMarker": "{version} vista pela primeira vez em {time}",
+      "chartTableToggle": "Mostrar tabela de dados",
+      "chartTableHide": "Ocultar tabela de dados",
+      "chartTime": "Hora",
+      "pagesTitle": "Páginas a corrigir primeiro",
+      "pagesHint": "Classificadas por impacto: tráfego ponderado pela proporção de visualizações com uma métrica vital acima do respetivo limite ou com um erro. Clique numa página para ver as respetivas sessões ou numa contagem de erros para abrir o Error Tracking.",
+      "pagesColPage": "Página",
+      "pagesColViews": "Visualizações",
+      "pagesColErrors": "Erros",
+      "pagesColImpact": "Impacto",
+      "pagesLegend": "▲ a melhorar · ■ fraco · sem marca significa bom. As páginas com menos de {n} visualizações estão ocultas.",
+      "pagesOpenSessions": "Abrir sessões para {path}",
+      "pagesOpenErrors": "{count} erro, abrir o Error Tracking | {count} erros, abrir o Error Tracking",
+      "pagesImpactAria": "Impacto {n} de 100",
+      "markNeeds": "a melhorar",
+      "markPoor": "fraco",
+      "diffTitle": "Maior diferença",
+      "diffBody": "O INP p75 é {inp}, {ratio}x os outros segmentos. Uma correlação a investigar, não uma causa comprovada.",
+      "diffNone": "Nenhum segmento se destaca dos restantes neste intervalo.",
+      "diffLink": "Ver sessões afetadas",
+      "segmentLabel": "Segmento",
+      "segBrowser": "Navegador",
+      "segDevice": "Dispositivo",
+      "segCountry": "País",
+      "segInp": "INP {v}",
+      "segShare": "{n}% das visualizações",
+      "segNone": "Sem dados para este segmento.",
+      "releaseTitle": "Comparação de versões",
+      "releaseHint": "{cur} em comparação com {prev}. O início da versão é a primeira vez que uma versão é vista.",
+      "releaseMetric": "Métrica",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Sem erros",
+      "releaseSessions": "Sessões",
+      "releaseLink": "Erros em {version}",
+      "frustrationTitle": "Frustração do utilizador",
+      "frustrationHint": "Problemas que as métricas vitais não detetam",
+      "rageClicks": "Cliques de frustração",
+      "deadClicks": "Cliques sem efeito",
+      "stateLoading": "A carregar {panel}…",
+      "stateEmptyTitle": "Sem visualizações de página neste intervalo",
+      "stateEmptyBody": "Alargue o intervalo de tempo, limpe um filtro ou verifique se o SDK do navegador está a enviar eventos de visualização.",
+      "stateEmptyAction": "Configurar o SDK",
+      "stateLowTitle": "Apenas {count} visualização de página | Apenas {count} visualizações de página",
+      "stateLowBody": "Os percentis não são fiáveis com menos de {min} visualizações, pelo que o veredito está oculto. Os valores são apresentados para referência.",
+      "stateErrorTitle": "Não foi possível carregar {panel}",
+      "stateErrorBody": "A consulta falhou ou excedeu o tempo limite. Os outros painéis não são afetados.",
+      "retry": "Tentar novamente",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "indicadores principais",
+      "panelPages": "páginas",
+      "panelSegments": "segmentos",
+      "panelRelease": "comparação de versões",
+      "panelFrustration": "frustração do utilizador",
+      "schemaErrorTitle": "Não foi possível carregar o esquema RUM",
+      "schemaErrorBody": "Não foi possível ler os campos do stream, pelo que a visão geral não consegue decidir que painéis mostrar.",
+      "pagesShowAll": "Mostrar todas as {n} páginas",
+      "pagesShowFewer": "Mostrar menos páginas",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Sem páginas com visualizações suficientes",
+      "pagesEmptyBody": "As páginas precisam de pelo menos {n} visualizações neste intervalo para serem classificadas.",
+      "segEmptyTitle": "Sem dados de segmentos",
+      "segEmptyBody": "Não foram registados valores de navegador, dispositivo, SO, país ou ligação para estas visualizações.",
+      "releaseEmptyTitle": "São necessárias duas versões",
+      "releaseEmptyBody": "A comparação de versões requer pelo menos duas versões observadas neste intervalo.",
+      "releaseBefore": "{version} já estava ativa antes deste intervalo, pelo que a hora da primeira deteção não é apresentada.",
+      "pageErrorTitle": "Não foi possível carregar a visão geral do desempenho",
+      "pageErrorBody": "As consultas falharam ou excederam o tempo limite. Tente novamente para carregar todos os painéis.",
+      "verdictOver": "{vital} está acima do limiar bom de {threshold} em {pct}% das visualizações de página.",
+      "verdictAllThree": "Os três Core Web Vitals passam em p75.",
+      "verdictAllSome": "Os {n} Core Web Vitals avaliados passam em p75.",
+      "releaseNewErrors": "{count} novo erro nesta versão | {count} novos erros nesta versão",
+      "verdictNoData": "Sem dados de Core Web Vitals",
+      "verdictNoDataLead": "Nenhuma visualização de página neste intervalo reportou LCP, INP ou CLS (num total de {count}). | Nenhuma das {count} visualizações de página neste intervalo reportou LCP, INP ou CLS.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Abrir sessões.",
+      "pagesTableLabel": "Páginas classificadas por impacto",
+      "verdictSessions": "{count} sessão no intervalo. | {count} sessões no intervalo.",
+      "verdictCompare": "Em comparação com o período anterior.",
+      "deltaLower": "{v} inferior",
+      "deltaHigher": "{v} superior",
+      "forbiddenTitle": "Sem permissão para ver {panel}",
+      "forbiddenBody": "Peça a um administrador acesso ao stream de dados de RUM.",
+      "pageForbiddenTitle": "Sem permissão para ver a visão geral do desempenho",
+      "asideLabel": "Onde e o que mudou",
+      "pagesAbout": "Sobre esta classificação",
+      "chartPerFiveMinutes": "por 5 minutos",
+      "chartPerThirtyMinutes": "por 30 minutos",
+      "chartPerHour": "por hora",
+      "chartPerSixHours": "por 6 horas",
+      "chartPerDay": "por dia",
+      "chartIntervalOther": "por intervalo",
+      "chartTableCaption": "Sessões e erros por intervalo",
+      "deltaChange": "{delta} em comparação com o período anterior",
+      "deltaChangePts": "{delta} pts em comparação com o período anterior",
+      "deltaFlat": "Sem alterações em comparação com o período anterior",
+      "deltaNewMsg": "Novo em comparação com o período anterior",
+      "verdictP75Note": "O veredicto usa sempre p75; p50 e p95 alteram apenas os valores.",
+      "releaseNote": "Compara as duas versões mais recentes, independentemente do que indicar o filtro Versão.",
+      "kpiEmptyTitle": "Sem sessões neste intervalo",
+      "kpiEmptyBody": "Alargue o intervalo de tempo ou limpe um filtro.",
+      "releaseImproved": "melhorou",
+      "releaseWorse": "piorou",
+      "segOs": "SO",
+      "segConnection": "Ligação",
+      "pagesAllLink": "Todas as páginas",
+      "pagesAllLinkAria": "Todas as páginas em Análise de produto",
+      "frustrationReplayLink": "Ver uma reprodução",
+      "frustrationReplayHint": "Abre as sessões frustradas neste intervalo; as que foram gravadas têm uma reprodução.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "Nada foi registado neste intervalo. Alargue o intervalo de tempo ou configure o SDK do navegador se esta aplicação ainda não enviou dados.",
+      "stateEmptyFiltered": "Nada corresponde a estes filtros neste intervalo. Limpe os filtros para ver todos os serviços, ambientes e versões.",
+      "clearFilters": "Limpar filtros",
+      "stateRefreshing": "A atualizar {panel}",
+      "tileOpenSessions": "{label}: {value}. Sessões abertas",
+      "tileOpenErrors": "{label}: {value}. Abrir monitorização de erros",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Esta vista geral contabiliza apenas sessões de navegador. As métricas da aplicação móvel estão abaixo.",
+      "mixedMobileNote": "Os filtros abaixo aplicam-se apenas às métricas da aplicação móvel."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Eliminar",
     "confirmDeleteHead": "Eliminar utilizador",
     "confirmDeleteMsg": "Tem a certeza de que pretende eliminar o utilizador {name}?",
+    "block": "Bloquear",
+    "confirmBlockHead": "Bloquear utilizador",
+    "confirmBlockMsg": "{email} entrou por meio do seu domínio verificado. Bloqueá-lo o adiciona às restrições de domínio desta organização e o remove desta organização. Ele será removido de outras organizações mapeadas no próximo login.",
     "cancel": "Cancelar",
     "save": "Guardar",
     "ok": "Ok",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Revogar convite",
     "revokeInvitationMsg": "Tem a certeza de que pretende revogar o convite para {email}?",
     "deleteUsersTitle": "Eliminar utilizadores",
-    "deleteUsersMsg": "Tem a certeza de que pretende eliminar {count} utilizador? | Tem a certeza de que pretende eliminar {count} utilizadores?"
+    "deleteUsersMsg": "Tem a certeza de que pretende eliminar {count} utilizador? | Tem a certeza de que pretende eliminar {count} utilizadores?",
+    "deleteUsersBlockNote": "{count} deles entraram por meio do seu domínio verificado e serão bloqueados em vez de excluídos."
   },
   "invitation": {
     "pendingInvitations": "Convites pendentes",
@@ -3403,8 +3597,6 @@
       },
       "show": "Mostrar",
       "searchPermissions": "Pesquisar Permissões",
-      "filterModules": "Filtrar módulos",
-      "noModuleMatch": "Nenhum módulo corresponde ao seu filtro",
       "moduleScopeAll": "Todos",
       "moduleScopeGranted": "Selecionados",
       "noGrantedModule": "Nenhum módulo selecionado ainda",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Concessão | Concessões",
       "summaryReachSome": "{count} de {total}",
       "summaryEmptyTitle": "Esta função ainda não concede nada",
-      "summaryEmptyDescription": "Escolha um módulo à esquerda ou comece com uma predefinição.",
+      "summaryEmptyDescription": "Comece com uma predefinição ou escolha módulos da lista.",
       "presetReadonlyTitle": "Só de leitura",
       "presetReadonlyDescription": "Listar e obter em todos os módulos",
       "presetDbmTitle": "Visualizador de monitorização de base de dados",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "Nenhum dos {total} streams de métricas do Kubernetes existe ainda nesta organização, pelo que nada foi pré-selecionado.",
       "rumPresetSeeded": "Acesso de leitura pré-selecionado em {matched} de {total} streams de RUM, além de mapas de origem e qualquer concessão de Análise de Produto do RUM. Reveja antes de guardar.",
       "rumPresetNoMatch": "Nenhum dos {total} streams de RUM existe ainda nesta organização, pelo que nada foi pré-selecionado neles; os mapas de origem e quaisquer concessões de Análise de Produto do RUM foram, ainda assim, preparados.",
-      "moduleGroupFleet": "Frota"
+      "moduleGroupFleet": "Frota",
+      "filterModulesTasks": "Filtrar módulos",
+      "noModuleMatchQuery": "Nenhum módulo corresponde a «{query}»",
+      "noModuleMatchHint": "Pesquise por módulo, grupo ou tarefa, por exemplo slack, panel ou token.",
+      "presetAlertManagerTitle": "Gestor de alertas",
+      "presetAlertManagerDescription": "Criar e gerir alertas, os seus destinos e as suas mensagens",
+      "presetAlertViewerTitle": "Visualizador de alertas",
+      "presetAlertViewerDescription": "Ver alertas, destinos e modelos sem os alterar",
+      "presetDashboardEditorTitle": "Editor de dashboards",
+      "presetDashboardEditorDescription": "Criar e editar dashboards, com acesso de leitura aos dados que consultam",
+      "presetDashboardViewerTitle": "Visualizador de dashboards",
+      "presetDashboardViewerDescription": "Abrir dashboards e ler os dados por trás dos seus painéis",
+      "presetPipelineEditorTitle": "Editor de pipelines",
+      "presetPipelineEditorDescription": "Criar pipelines e funções, com acesso de leitura aos streams e às tabelas de enriquecimento",
+      "presetApplied": "{title} adicionou {permissions}. Reveja as alterações antes de guardar.",
+      "presetPermissionCount": "{count} permissão | {count} permissões",
+      "companionReasonAlertStreams": "para guardar alertas. O servidor verifica o acesso aos streams ao guardar",
+      "companionReasonAlertDestinations": "para escolher para onde os alertas são enviados",
+      "companionReasonDestinationTemplates": "para escolher o modelo de mensagem, que todos os destinos exigem",
+      "companionReasonDashboardStreams": "para carregar os dados dos painéis",
+      "presetsTitle": "Predefinições",
+      "presetsClose": "Fechar predefinições",
+      "presetsShow": "Mostrar predefinições",
+      "presetsSubtitle": "Adicione as concessões de uma predefinição a esta função. Nada é removido.",
+      "presetsSectionBuiltin": "Integradas",
+      "presetsSectionJob": "Por cargo",
+      "presetAddsTooltip": "Adiciona {count} permissão | Adiciona {count} permissões",
+      "presetInRole": "Na função",
+      "presetInRoleTooltip": "Esta função já tem tudo o que esta predefinição inclui",
+      "presetBack": "Todas as predefinições",
+      "presetModuleCount": "{count} módulo | {count} módulos",
+      "presetSummaryAdds": "Adiciona {permissions} em {modules}.",
+      "presetSummaryWrite": "Acesso de escrita em {modules}.",
+      "presetSummaryViewOnly": "Só visualização: nada pode ser criado, editado ou eliminado.",
+      "presetSummaryHasAll": "Esta função já tem tudo o que esta predefinição inclui.",
+      "presetSummarySkipped": "{count} permissão que esta função já tem é ignorada. | {count} permissões que esta função já tem são ignoradas.",
+      "presetStillMissing": "Ainda em falta depois de adicionar: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "Nada ficará em falta depois de a adicionar.",
+      "neededBy": "Necessário para {modules}",
+      "stillNeededBy": "Ainda necessário para {modules}",
+      "presetReadsEveryStream": "Lê todos os streams desta organização, incluindo os novos.",
+      "presetAddButton": "Adicionar {count} permissão | Adicionar {count} permissões",
+      "presetNothingToAdd": "Nada a adicionar",
+      "presetApplyNote": "As concessões adicionadas tornam-se alterações não guardadas. Reveja-as antes de guardar.",
+      "presetLoadingStreams": "A carregar streams",
+      "presetNoMatchingStreams": "Ainda não há streams correspondentes nesta organização.",
+      "reviewMissingTooltip": "Falta {count} módulo para esta função funcionar | Faltam {count} módulos para esta função funcionar",
+      "notAddedYetTitle": "Ainda não adicionados · {modules}",
+      "companionAdd": "Adicionar",
+      "companionAddItem": "Adicionar {item}",
+      "companionAddAll": "Adicionar tudo",
+      "companionOpenStreams": "Abrir streams",
+      "companionOpenStreamsTooltip": "Escolha os streams que esta função pode ler",
+      "companionNeeds": "{module} precisa disso {reason}.",
+      "companionNeedsThis": "{module} precisa disto {reason}.",
+      "companionStillNeedsThis": "{module} ainda precisa disto {reason}.",
+      "yourChanges": "As suas alterações",
+      "yourChangesCount": "{changes} em {modules}",
+      "yourChangesNone": "Nenhuma ainda",
+      "changeCount": "{count} alteração | {count} alterações",
+      "changeOtherGroup": "Outros",
+      "saveSuccessCounts": "Guardado: {changes} em {modules}.",
+      "effectCan": "Pode {actions} {target}.",
+      "effectCannot": "Já não pode {actions} {target}.",
+      "effectCanLoadDestinations": "Pode carregar a lista de destinos.",
+      "effectCannotLoadDestinations": "Já não pode carregar a lista de destinos.",
+      "effectCanLoadTemplates": "Pode carregar a lista de modelos.",
+      "effectCannotLoadTemplates": "Já não pode carregar a lista de modelos.",
+      "verbView": "ver",
+      "verbSeeListOf": "ver na lista",
+      "verbList": "listar",
+      "verbOpen": "abrir",
+      "verbCreate": "criar",
+      "verbEdit": "editar",
+      "verbDelete": "eliminar",
+      "targetEveryStream": "todos os streams (logs, métricas, traces e índices), incluindo novos",
+      "targetTypeStreams": "todos os streams de {type}",
+      "targetOneStream": "o stream de {type} {name}",
+      "targetAlertsEveryFolder": "os alertas em todas as pastas, incluindo pastas novas",
+      "targetAlertsInFolder": "os alertas da pasta {name}",
+      "targetOneAlert": "o alerta {name}",
+      "targetDashboardsEveryFolder": "os dashboards em todas as pastas, incluindo pastas novas",
+      "targetDashboardsInFolder": "os dashboards da pasta {name}",
+      "targetOneDashboard": "o dashboard {name}",
+      "targetReportsEveryFolder": "os relatórios em todas as pastas, incluindo pastas novas",
+      "targetReportsInFolder": "os relatórios da pasta {name}",
+      "targetOneReport": "o relatório {name}",
+      "targetEveryDestination": "todos os destinos de alertas (Slack, email, webhooks), incluindo novos",
+      "targetOneDestination": "o destino {name}",
+      "targetEveryTemplate": "todos os modelos de notificação, incluindo novos",
+      "targetOneTemplate": "o modelo {name}",
+      "targetAllOf": "todos os {module}, incluindo novos",
+      "targetItemIn": "{name} em {module}",
+      "noteDestinationsFiltered": "Só veem os destinos que também podem abrir. Adicione «Obter» aqui, ou em destinos individuais, para escolher quais.",
+      "noteTemplatesFiltered": "Só veem os modelos que também podem abrir. Adicione «Obter» aqui, ou em modelos individuais, para escolher quais.",
+      "presetStreamsFailed": "Não foi possível carregar a lista de streams.",
+      "presetRetry": "Tentar novamente",
+      "presetRestored": "{title} restaurou {permissions}. Reveja as alterações antes de guardar.",
+      "presetSummaryRestores": "Mantém {count} permissão que marcou para remoção. | Mantém {count} permissões que marcou para remoção.",
+      "presetRestoreButton": "Manter {count} permissão | Manter {count} permissões",
+      "effectStillAllowed": "Sem alteração de acesso: uma permissão mais ampla ainda o permite."
     },
     "rolesPage": {
       "subtitle": "As funções agrupam permissões — atribua-as a utilizadores, contas de serviço ou grupos para conceder acesso.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Utilizador atualizado com sucesso.",
       "userDeletedSuccess": "Utilizador eliminado com sucesso.",
       "errorDeletingUser": "Erro ao eliminar utilizador.",
+      "userBlockedSuccess": "Usuário bloqueado com sucesso.",
+      "errorBlockingUser": "Erro ao bloquear o utilizador.",
+      "blockedButNotRemoved": "O utilizador foi bloqueado, mas não foi possível removê-lo desta organização.",
+      "blockedUsersSuccess": "{count} utilizador bloqueado com sucesso | {count} utilizadores bloqueados com sucesso",
+      "blockedUsersPartial": "{count} utilizador bloqueado e removido, mas não foi possível remover {failed} desta organização | {count} utilizadores bloqueados e removidos, mas não foi possível remover {failed} desta organização",
+      "blockedUsersNotRemoved": "{count} utilizador bloqueado, mas não foi possível removê-lo desta organização | {count} utilizadores bloqueados, mas não foi possível removê-los desta organização",
       "pleaseWait": "Aguarde...",
       "invitationRevokedSuccess": "Convite revogado com sucesso.",
       "errorRevokingInvitation": "Erro ao revogar convite.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Os traces são capturados com eBPF: não são necessárias alterações de código nem SDK. O contexto de rastreio só passa entre serviços por HTTP em texto simples (nas apps Go também por HTTPS, exceto em nós com kernel lockdown). Um processo que corresponda a qualquer uma das portas, ao caminho do executável ou à linha de comando é rastreado; os globs não podem conter `,`, `{'{'}` ou `{'}'}`, e uma porta corresponde a qualquer processo com um socket nela. Requer Helm 3.14+ e o operador do OpenTelemetry v0.142.0+; se o seu for mais antigo, atualize-o primeiro com `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Se o eBPF já estava ativado com um operador mais antigo, execute o comando novamente com `--force` (`--force-replace` no Helm 4). Voltar a executar o comando de instalação acima repõe a release e desativa o eBPF, por isso execute este comando novamente depois. O namespace `openobserve-collector` tem de permitir pods privilegiados, e os nós têm de executar Linux em amd64 ou arm64 com kernel 5.8+ (ou RHEL da família 4.18 com backports de eBPF) e BTF. Não selecione aplicações que já enviam os seus próprios traces, nem pods que usam o sidecar Go `inject-go`.",
       "k8sEbpfVariant": "eBPF (qualquer linguagem, sem alterar código)",
       "k8sLibrariesVariant": "Bibliotecas de linguagem (autoinstrumentação)",
+      "k8sNetworkFlowsDesc": "O DaemonSet eBPF do coletor regista os **bytes enviados entre cargas de trabalho através de qualquer protocolo TCP ou UDP** em cada nó Linux, incluindo bases de dados, caches e outros serviços que não têm trace. Chegam como a métrica `obi_network_flow_bytes`, etiquetada com o proprietário de origem e de destino (Deployment, StatefulSet, Node, …) e o namespace. Funciona com ou sem rastreio eBPF.",
+      "k8sNetworkFlowsNote": "Requer o Helm 3.14+ e o operador OpenTelemetry v0.142.0+. O namespace `openobserve-collector` tem de permitir pods privilegiados, e os nós têm de executar Linux em amd64 ou arm64 com kernel 5.8+ (ou família RHEL 4.18 com backports de eBPF) e BTF. Os pods eBPF são executados na rede do host, e as métricas do próprio coletor escutam em `127.0.0.1:8888` de cada nó, pelo que essa porta tem de estar livre nesse nó. Os seletores de trace eBPF que já definiu são mantidos. Voltar a executar o comando de instalação acima repõe a release e desativa esta opção, por isso execute novamente este comando depois. Os mesmos bytes podem ser reportados mais do que uma vez: o tráfego entre nós é reportado por ambos os nós, e uma ligação a um Service é reportada tanto pelo Service como pela carga de trabalho por trás dele. O guia de fluxos de rede eBPF explica como consultá-los sem contagem dupla.",
+      "k8sNetworkFlowsTitle": "Veja quais cargas de trabalho comunicam entre si: fluxos de rede eBPF",
       "k8sInstallerNote": "Isto instala cert-manager, o operador do OpenTelemetry e o coletor do OpenObserve automaticamente.",
       "k8sInternalEndpointNote": "Use isto quando o OpenObserve estiver no mesmo cluster — o tráfego nunca o deixa.",
       "k8sTroubleAnnotationA": "A injeção ocorre na criação do pod, então os pods existentes não são afetados até serem reiniciados — execute `kubectl rollout restart deployment -n my-namespace`. Confirme se a anotação foi aplicada com `kubectl get ns my-namespace -o yaml` e verifique se o valor corresponde a `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "A instalação falha com um erro sobre o webhook de admissão",
       "linuxAgentFixBody": "O instalador inicia o agente como um serviço systemd. Se nada chegar, confirme se está em execução e leia os logs para ver se há um erro de autenticação ou conectividade:",
       "linuxTracesNote": "Os traces são capturados com eBPF: não são necessárias alterações de código nem SDK. Um processo que corresponda a qualquer uma das portas, ao caminho do executável ou à linha de comando é rastreado; os globs não podem conter `,`, `{'{'}` ou `{'}'}`. O rastreio requer Linux 5.8+ (ou RHEL da família 4.18 com backports de eBPF) com BTF; o agente então é executado como root. Se o host não puder rastrear, a instalação é interrompida e deixa o agente em execução intacto. Se o agente então falhar ao iniciar com o rastreio ativado, ele é desativado — logs e métricas também — até que você execute novamente o comando **Logs e métricas**, ou corrija a causa e execute novamente com rastreio. Aplicativos rastreados adicionam um cabeçalho `traceparent` W3C a solicitações HTTP de texto simples de saída. O guia de rastreio eBPF abaixo aborda HTTPS e flags repetidas.",
+      "linuxNetworkFlowsDesc": "Execute o instalador com `--network-flows` para comunicar os **bytes que este host envia e recebe através de qualquer protocolo TCP ou UDP**, como a métrica `obi_network_flow_bytes`. Cada fluxo é etiquetado com `src_cidr` e `dst_cidr` com as redes que indicar, por isso forneça a todos os hosts a mesma lista: uma entrada `/32` por host dá um mapa entre hosts.",
+      "linuxNetworkFlowsNote": "Requer Linux 5.8+ (ou família RHEL 4.18 com backports de eBPF) com BTF; o agente é então executado como root. Funciona com ou sem tracing, mas cada execução do instalador substitui a configuração do agente: para manter o tracing ativo, adicione as opções `--trace-*` e `--service-name` do comando **Logs, métricas e traces eBPF**. Se o host não conseguir executar eBPF, a instalação para e deixa o agente em execução sem alterações. Se a captura de rede não arrancar depois disso, o agente é desativado — incluindo logs e métricas — até voltar a executar o comando **Logs e métricas**, ou corrigir a causa e voltar a executar com `--network-flows`. O tráfego entre dois hosts que ambos executam o agente é reportado por cada um deles, e o tráfego de loopback é contabilizado, a menos que ambas as extremidades tenham o mesmo endereço. O guia de fluxos de rede eBPF abaixo explica os rótulos e como consultar os fluxos sem contagem dupla.",
+      "linuxNetworkFlowsTitle": "Veja quais hosts comunicam entre si: fluxos de rede eBPF",
       "linuxTracesVerifyNote": "Com o rastreio ativo, os traces aparecem assim que uma app rastreada processar um pedido.",
+      "ebpfNetworkFlowsGuideLink": "Guia de fluxos de rede eBPF",
       "ebpfTracingGuideLink": "Guia de rastreamento eBPF",
       "logsMetricsTracesVariant": "Logs, métricas e traces eBPF",
       "logsMetricsVariant": "Registros e métricas",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Aponte qualquer exportador OpenTelemetry para o OpenObserve — coletor ou SDK, HTTP ou gRPC. O seu endpoint e token estão preenchidos abaixo.",
       "taglineWindows": "Instale o agente do OpenObserve em qualquer host Windows — Log de Eventos, contadores de desempenho e métricas do host.",
       "testAgain": "Testar novamente",
+      "networkFlowsHelp": "Entradas CIDR ou CIDR=NAME, separadas por vírgulas e sem espaços; cada CIDR precisa de um comprimento de prefixo, por exemplo 10.0.1.5/32, e os nomes só podem conter letras, dígitos, ., _ e -. Os endereços que não correspondem a nenhuma entrada ficam sem etiqueta; 0.0.0.0/0=other dá nome ao resto do IPv4, ::/0=other6 ao resto do IPv6.",
+      "networkFlowsLabel": "Redes a etiquetar",
+      "networkFlowsRequired": "Indique pelo menos uma rede: os fluxos são etiquetados com as redes que indicar.",
       "traceCmdHelp": "Para apps Python, Node.js e Java.",
       "traceCmdLabel": "Linha de comandos",
       "traceExeLabel": "Caminho do executável",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Ocultar células abaixo de",
     "heatmapHideBelowTooltip": "As células com um valor inferior ficam vazias.",
     "heatmapHideBelowNote": "As células abaixo de {value} estão ocultas",
+    "boxplotWhisker": "Bigodes",
+    "boxplotWhiskerMinMax": "Mínimo a máximo",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Campo da mensagem",
+    "logsLevelField": "Campo do nível",
+    "logsTimeField": "Campo da hora",
+    "htmlPanelFieldTooltip": "Deixe vazio para detetar a coluna a partir dos resultados da consulta",
+    "logsOrder": "Ordem",
+    "logsOrderNewest": "Mais recentes primeiro",
+    "logsOrderOldest": "Mais antigos primeiro",
+    "logsOrderTooltip": "Ordena as linhas devolvidas pela consulta. Uma consulta inicial não alterada também é obtida nesta ordem, por isso «Mais antigos primeiro» mostra os registos mais antigos.",
+    "logsShowTime": "Mostrar hora",
+    "logsWrap": "Quebrar linhas",
+    "logsPrettifyJson": "Formatar JSON",
     "distributionBucketCount": "Número de intervalos",
     "distributionBucketSize": "Tamanho do intervalo",
     "distributionBucketSizeTooltip": "Largura de cada intervalo nas unidades do campo. Quando definido, substitui o número de intervalos.",
@@ -7822,6 +8145,8 @@
       "gauge": "Gauge",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Diagrama de caixa",
+      "logs": "Registos",
       "barGauge": "Indicador de barras",
       "distribution": "Distribuição",
       "treemap": "Mapa em árvore",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: Argumento obrigatório ausente na posição {index}",
       "fieldNotAllowedForMetric": "O campo {label} não é permitido para gráfico de métricas",
       "rawValueSampled": "Com base nas primeiras {count} linhas",
+      "addAtMostOneFieldFor": "Adicione no máximo um campo para {label}",
+      "boxplotMin": "Mín",
+      "boxplotMax": "Máx",
+      "boxplotLowerWhisker": "Bigode inferior",
+      "boxplotUpperWhisker": "Bigode superior",
+      "boxplotMedian": "Mediana",
+      "boxplotSamples": "Amostras",
+      "boxplotOutlier": "Valor atípico",
       "fieldNotAllowedForDistribution": "O campo {label} não é permitido no gráfico de distribuição",
       "distributionCount": "Contagem",
       "addAtLeastOneFieldFor": "Adicione pelo menos um campo para o {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Sem acesso",
       "urlHiddenHint": "Não tem permissão para ver o painel desta ligação, por isso o respetivo URL público está oculto.",
       "orgDisabledHint": "As ligações públicas estão desativadas nesta organização",
+      "orgDisabledBanner": "Os links públicos estão desativados para esta organização, por isso não é disponibilizado nenhum link. Um administrador pode voltar a ativá-los.",
+      "disabledPaused": "Desativado · Em pausa",
       "takeOver": "Assumir",
       "takeOverTitle": "Assumir este link?",
       "takeOverBody": "Passa a ser o autor da publicação. A página pública vai mostrar o que tem permissão para ver, o que pode ser mais ou menos do que antes. Quem tiver o URL mantém o acesso, e o link fica ativo de imediato.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Grupo",
     "wellSubgroup": "Subgrupo",
     "wellSize": "Tamanho",
+    "wellCategory": "Categoria",
     "value": "Valor"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Afaste o valor de disparo do estado estável observado.",
       "lengthenEvaluationWindow": "Ampliar a janela de avaliação",
       "lengthenEvaluationWindowDesc": "Amplie o período para que um pico curto já não dispare o alerta.",
-      "enableDeduplication": "Ativar a desduplicação",
-      "enableDeduplicationDesc": "Agrupe disparos repetidos dentro de uma janela de desduplicação.",
+      "enableDeduplication": "Ativar a supressão de repetições",
+      "enableDeduplicationDesc": "Notifica uma vez por alteração de estado, em vez de a cada avaliação.",
       "reviewForDeletion": "Rever para eliminação",
       "reviewForDeletionDesc": "Confirme que a consulta ainda corresponde à realidade antes de desativar o alerta.",
       "fixAlertQuery": "Corrigir a consulta do alerta",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "ID da organização",
     "alertCreationTitle": "Criação de alerta",
     "noAlertsFound": "Nenhum alerta encontrado",
-    "suppressedByDeduplication": "Suprimido pela desduplicação",
-    "occurrence": "{count} ocorrência | {count} ocorrências",
     "groupedNotification": "Notificação agrupada",
     "alertsBatchedTogether": "alertas agrupados em lote",
-    "notificationSent": "Notificação enviada",
-    "occurrencesDeduplicated": "ocorrências desduplicadas",
     "alertExecutionDetails": "Detalhes da execução do alerta",
     "evaluationTime": "Tempo de avaliação",
     "queryTime": "Tempo de consulta",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "Até: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Correlação temporal",
     "serviceGraphTooltipServiceDependency": "Dependência de serviço",
-    "totalAlerts": "Total de Alertas",
-    "usingDeduplication": "A usar Desduplicação",
-    "deduplicationConfiguredTooltip": "Alertas com desduplicação configurada",
-    "suppressionRate24h": "Taxa de Supressão (24h)",
     "suppressed": "suprimidos /",
-    "total": "total",
-    "passedLabel": "Aprovados:",
-    "pendingBatches": "Lotes Pendentes",
-    "pendingBatchesTooltip": "Alertas a aguardar agrupamento",
     "historyTimeline": {
       "firing": "Disparado",
       "ok": "Ok",
@@ -10089,7 +10413,8 @@
     "endTime": "Hora de Fim",
     "duration": "Duração",
     "retries": "Tentativas",
-    "dedup": "Desduplicação",
+    "suppression": "Supressão",
+    "suppressedAsRepeat": "Suprimido como repetição",
     "validation": {
       "streamTypeRequired": "O tipo de Stream é obrigatório.",
       "streamNameRequired": "O nome do Stream é obrigatório.",
@@ -10281,15 +10606,6 @@
     "all": "Todos",
     "history": "Histórico de alertas",
     "searcHistory": "Introduza o nome do alerta",
-    "deduplication": {
-      "fingerprintFields": "Campos de impressão digital",
-      "fingerprintFieldsHint": "Selecione os campos que tornam os alertas semelhantes (por exemplo, hostname, service). Deixe em branco para detetar automaticamente com base na consulta.",
-      "fingerprintFieldsTooltip": "Escolha os campos que devem coincidir para que os alertas sejam considerados duplicados. Por exemplo, selecionar 'hostname' significa que os alertas do mesmo host são agrupados. Tipos de alerta diferentes (por exemplo, CPU elevada vs. memória elevada) nunca são agrupados, mesmo que venham do mesmo host. Deixe em branco para deteção automática com base no tipo de consulta.",
-      "timeWindow": "Janela de tempo (minutos)",
-      "timeWindowHint": "Durante quanto tempo rastrear as impressões digitais do alerta. Deixe em branco para usar o período de alerta.",
-      "timeWindowTooltip": "Durante quanto tempo os alertas recentes são lembrados para agrupamento. Se ocorrer um alerta semelhante dentro deste tempo, não é enviado novamente. Deixe em branco para usar o intervalo de verificação do alerta.",
-      "fingerprintFieldsHelp": "Deixe vazio para detetar automaticamente com base na consulta (SQL: colunas GROUP BY, PromQL: labels, Custom: campos de condição)"
-    },
     "summary": {
       "scrollToBottom": "Deslocar até ao fim",
       "title": "Resumo",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Alerte-me quando as condições configuradas forem cumpridas"
       }
     },
-    "correlation": {
-      "title": "Correlação de alertas",
-      "description": "Configure como os alertas são correlacionados e desduplicados em toda a organização. Os alertas com valores de impressão digital correspondentes serão agrupados.",
-      "semanticFieldNote": "Nota: Os mapeamentos de campos semânticos são configurados no separador Identidade do serviço.",
-      "enableOrgLevel": "Ativar a desduplicação ao nível da organização",
-      "enableOrgLevelTooltip": "Ative as funcionalidades de desduplicação e correlação para todos os alertas desta organização",
-      "enableCrossAlert": "Ativar a desduplicação de alertas cruzados",
-      "enableCrossAlertTooltip": "Permita que diferentes alertas se desduplicem quando partilham a mesma impressão digital",
-      "fingerprintGroups": "Grupos de impressão digital de alerta cruzado",
-      "fingerprintGroupsTooltip": "Selecione quais grupos semânticos usar para impressão digital de alerta cruzado. Os alertas serão desduplicados se partilharem os mesmos valores para estas dimensões.",
-      "fingerprintGroupsHint": "Selecione pelo menos um grupo semântico para desduplicação de alertas cruzados",
-      "fingerprintGroupsRequired": "Pelo menos um grupo semântico deve ser selecionado",
-      "defaultWindow": "Janela de correlação predefinida (minutos)",
-      "defaultWindowTooltip": "Na ausência de correspondência de campo semântico, alertas e dados de determinada duração são considerados relacionados",
-      "defaultWindowDescription": "Na ausência de correspondência de campo semântico, alertas e dados de determinada duração são considerados relacionados",
-      "defaultWindowPlaceholder": "Usar o período de alerta por predefinição",
-      "cancelButton": "Cancelar",
-      "saveButton": "Guardar configurações",
-      "settingsSaved": "Definições de deduplicação da organização guardadas com sucesso",
-      "settingsSaveError": "Falha ao guardar definições"
-    },
     "placeholders": {
       "typeSomething": "Introduza algo",
       "value": "Valor",
       "selectColumn": "Selecionar coluna",
       "savedFunctions": "Funções guardadas",
-      "autoUsesCheckInterval": "Automático (usa intervalo de verificação)",
       "addTag": "Adicione uma tag e prima Enter"
     },
     "steps": {
       "compareWithPast": "Compare com o passado",
-      "deduplication": "Desduplicação",
       "advanced": "Avançado"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "O que deve acionar o alerta",
       "compareWithPast": "Compare os resultados atuais com dados de outro período",
       "alertSettings": "Defina as suas regras de alerta e escolha como gostaria de ser notificado.",
-      "deduplication": "Evite enviar o mesmo alerta várias vezes agrupando alertas semelhantes.",
       "advanced": "Variáveis de contexto, descrição e modelo de linha"
     },
     "failedToFetchHistory": "Falha ao obter o histórico de alertas",
@@ -10399,8 +10691,6 @@
         "closeActions": "Fechar ações",
         "viewAlertHistory": "Ver histórico de alertas",
         "actionsFor": "Ações para:",
-        "configureDedup": "Configurar a desduplicação",
-        "configureDedupTooltip": "Configurar a desduplicação para este alerta",
         "editAlert": "Editar alerta",
         "editAlertTooltip": "Editar configuração de alerta",
         "viewHistory": "Ver histórico",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "nova mensagem \"Resolvido\"",
       "keepFiringFor": "Continuar a disparar durante",
       "keepFiringForTooltip": "Aguarde este tempo depois de a condição deixar de se verificar antes de recuperar. 0 recupera imediatamente.",
+      "suppressRepeats": "Suprimir repetições",
+      "suppressRepeatsTooltip": "Notifica uma vez quando o alerta começa a disparar ou muda de nível, não a cada avaliação. Deixe-o desativado para continuar a receber lembretes após cada período de silêncio.",
       "keepFiringForInvalid": "Introduza 0 ou mais segundos",
       "keepFiringForTooLong": "Introduza no máximo 86400 segundos (24 horas)"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Este endereço de e-mail já foi adicionado",
     "confirmRemoveEmail": "Tem a certeza de que pretende remover o email {email}?",
     "domainNeedsEmails": "O domínio '{domain}' deve ter pelo menos um endereço de e-mail quando não são permitidos todos os utilizadores",
+    "noAllowedEmailsDenyAll": "Ainda não há nenhum e-mail permitido, por isso todos os utilizadores de {domain} são recusados.",
     "domainSettingsSaved": "Definições de domínio guardadas com sucesso",
     "errorSavingDomainSettings": "Erro ao guardar as definições do domínio",
     "noDomainMessage": "Nenhum domínio configurado. Adicione domínios acima para restringir o acesso.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Configure pelo menos um conjunto de identidades antes de guardar.",
       "discoveredServicesTab": "Serviços descobertos",
       "serviceDiscoveryTab": "Regras de Deteção",
-      "alertCorrelationTab": "Correlação de alertas",
       "fieldAliasesTab": "Mapeamentos de Campos",
       "fieldAliasesSaved": "Aliases de campos guardados com sucesso",
       "fieldAliasesSaveError": "Falha ao guardar os aliases de campos",
@@ -14079,16 +14371,16 @@
     "runsIn": "Executa em",
     "recommendedByFieldCoverage": "Recomendado com base na cobertura de campos nos seus streams.",
     "listConjunctionAndTwo": "{first} e {last}",
-    "domainOrgMappings": {
-      "title": "Mapeamentos de domínio para organização",
-      "subtitle": "Novos utilizadores que iniciam sessão com um domínio de e-mail correspondente são adicionados à organização automaticamente.",
+    "orgDomainMapping": {
+      "tabLabel": "Gerenciamento de domínios",
+      "tabDesc": "Associe os seus domínios de e-mail, mapeie os seus utilizadores para organizações e controle quais deles podem iniciar sessão.",
+      "loadFailed": "Falha ao carregar as configurações da organização",
       "addMapping": "Adicionar mapeamento",
       "editMapping": "Editar mapeamento",
-      "empty": "Nenhum mapeamento ainda. Use “{addLabel}” para adicionar um.",
       "domain": "Domínio de e-mail",
       "domainHelp": "A parte após {at_sign} no endereço de e-mail do utilizador.",
+      "domainHelpRequest": "A parte após {at_sign} no endereço de email do utilizador. O domínio é associado a esta organização assim que a OpenObserve aprovar o pedido.",
       "organization": "Organização",
-      "organizationPlaceholder": "Identificador da organização",
       "organizationHelp": "O identificador da organização à qual os utilizadores correspondentes são adicionados.",
       "organizationRequired": "A organização é obrigatória",
       "baseRole": "Função base",
@@ -14097,9 +14389,126 @@
       "roleClaimNamePlaceholder": "Nome do claim, ex.: groups",
       "roleClaimNameHelp": "Opcional. Claim do token que lista as funções personalizadas do utilizador; em cada início de sessão, as funções personalizadas do utilizador nessa organização são sincronizadas com esse claim.",
       "createMissingRoles": "Criar as funções do claim que não existem na organização",
-      "duplicateDomain": "Já existe um mapeamento para este domínio",
-      "confirmRemove": "Tem a certeza de que pretende eliminar o mapeamento de {name}?",
-      "deleteTitle": "Eliminar mapeamento"
+      "verifyNow": "Verificar agora",
+      "details": "Detalhes",
+      "detailsDialogTitle": "Detalhes do vínculo para {domain}",
+      "approvedLinkInfo": "Vinculado pelo OpenObserve após uma solicitação de vínculo. Nenhum registro DNS é necessário.",
+      "pendingRequestInfo": "O OpenObserve está analisando esta solicitação. Nada a fazer até que seja aprovada.",
+      "rejectedRequestInfo": "O OpenObserve rejeitou esta solicitação.",
+      "verifyDialogTitle": "Verificar {domain}",
+      "recordDialogTitle": "Registro DNS para {domain}",
+      "lastCheckFailed": "A última verificação falhou: {reason}",
+      "state": {
+        "pending": "Pendente",
+        "verified": "Verificado",
+        "failed": "Com falha",
+        "requested": "Aguardando aprovação",
+        "approved": "Aprovado",
+        "rejected": "Rejeitado"
+      },
+      "saved": "Mapeamento de domínio salvo",
+      "saveFailed": "Falha ao guardar as definições",
+      "linkFailed": "Falha ao vincular o domínio",
+      "unlinkFailed": "Falha ao desvincular o domínio",
+      "verifyFailed": "Falha na verificação",
+      "deleted": "Mapeamento removido",
+      "deleteTitle": "Eliminar mapeamento",
+      "deleteMappingBody": "Usuários de {domain} não serão mais adicionados a {org} quando fizerem login.",
+      "recordInstructions": "Adicione este registro TXT de DNS no seu provedor de DNS:",
+      "txtNameLabel": "Nome do registro",
+      "txtValueLabel": "Valor do registro",
+      "copyTxtName": "Copiar nome do registro",
+      "copyTxtValue": "Copiar valor do registro",
+      "txtNameCopied": "Nome do registro copiado",
+      "txtValueCopied": "Valor do registro copiado",
+      "verifyHint": "A verificação é executada automaticamente a cada {minutes} minutos. Você também pode verificar agora.",
+      "alreadyLinked": "Este domínio já está vinculado a esta organização",
+      "failureReason": {
+        "recordMissing": "Registro TXT não encontrado",
+        "valueMismatch": "Registro TXT encontrado, mas o valor não corresponde",
+        "dnsFailed": "Falha na resolução de DNS"
+      },
+      "pageSubtitle": "Associe os seus domínios de e-mail, mapeie os seus utilizadores para organizações e controle quais deles podem iniciar sessão.",
+      "linkedTab": "Domínios vinculados",
+      "mappingsTab": "Mapeamentos",
+      "accessTab": "Usuários bloqueados",
+      "requestsTab": "Solicitações de vínculo",
+      "linkDomain": "Vincular domínio",
+      "sendRequest": "Enviar solicitação",
+      "linkMethod": "Como comprovar a propriedade",
+      "method": {
+        "dns": "Registro DNS",
+        "approved": "Solicitação aprovada",
+        "request": "Solicitação de vínculo",
+        "dnsTitle": "Adicionar um registro TXT de DNS",
+        "dnsDesc": "Verificado automaticamente assim que o registro for publicado. Ideal quando você gerencia o DNS do domínio.",
+        "requestTitle": "Solicitar um vínculo ao OpenObserve",
+        "requestDesc": "A nossa equipa analisa o pedido e associa o domínio após a aprovação."
+      },
+      "searchDomains": "Pesquisar domínios",
+      "searchMappings": "Pesquisar por domínio ou organização",
+      "searchRequests": "Pesquisar por domínio, organização ou solicitante",
+      "status": "Status",
+      "linkedVia": "Vinculado via",
+      "lastChecked": "Última verificação",
+      "linked": "Domínio vinculado. Adicione o registro DNS para verificá-lo.",
+      "verified": "Domínio verificado",
+      "notVerifiedYet": "O registro DNS ainda não foi encontrado. Pode levar algum tempo para propagar.",
+      "requestSent": "Solicitação de vínculo enviada",
+      "requestFailed": "Falha ao enviar a solicitação de vínculo",
+      "keepRecordHint": "Mantenha este registro no lugar. A propriedade é verificada novamente a cada {minutes} minutos; se o registro estiver ausente por mais de {grace} minutos, o domínio será marcado como com falha e seus mapeamentos deixarão de ser aplicados.",
+      "removeDomain": "Remover domínio",
+      "removeTitle": "Remover domínio?",
+      "removeBody": "{domain} será desvinculado desta organização.",
+      "removeWithMappingsBody": "{domain} será desvinculado desta organização e seu {count} mapeamento será removido. | {domain} será desvinculado desta organização e seus {count} mapeamentos serão removidos.",
+      "removed": "Domínio removido",
+      "domainRequired": "O domínio é obrigatório",
+      "mappingDomainHelp": "Somente domínios verificados podem ser mapeados.",
+      "createsRoles": "Cria papéis",
+      "duplicateMapping": "Este domínio já está mapeado para essa organização",
+      "domainNotVerified": "Não verificado",
+      "noVerifiedDomains": "Os mapeamentos se aplicam a domínios verificados. Vincule e verifique um domínio primeiro.",
+      "goToLinked": "Vincular um domínio",
+      "goToLinkedDesc": "Verifique um domínio que detém antes de mapear os seus utilizadores",
+      "enforceTitle": "Remover utilizadores de outras organizações",
+      "enforceDesc": "Quando um utilizador de um domínio mapeado inicia sessão via SSO, é removido de todas as organizações exceto esta e as do seu grupo de faturação.",
+      "enforceConfirmTitle": "Remover utilizadores de outras organizações?",
+      "enforceConfirmBody": "Sempre que um utilizador cujo domínio de e-mail tenha aqui um mapeamento iniciar sessão via SSO, será removido de todas as organizações que não sejam esta ou as do seu grupo de faturação, incluindo as suas organizações pessoais.",
+      "enforceConfirmAction": "Ativar",
+      "enforceSaved": "Configuração salva",
+      "blockUsers": "Bloquear utilizadores",
+      "editBlockedUsers": "Editar utilizadores bloqueados",
+      "block": "Bloquear",
+      "blockedCount": "{count} bloqueado | {count} bloqueados",
+      "blockedEmails": "E-mails bloqueados",
+      "blocklistDomainHelp": "Um dos domínios verificados desta organização.",
+      "blocklistEmailsHelp": "Estes utilizadores não podem iniciar sessão via SSO nesta organização nem nas organizações do seu grupo de faturação, e são removidos delas no próximo acesso.",
+      "ruleBlockedRequired": "Adicione pelo menos um e-mail para bloquear",
+      "noDomainForBlocklist": "Todos os domínios verificados já têm utilizadores bloqueados. Edite a linha do domínio para os alterar.",
+      "unblockAll": "Desbloquear todos",
+      "unblockAllTitle": "Desbloquear todos os utilizadores?",
+      "unblockAllBody": "Todos os utilizadores bloqueados de {domain} poderão voltar a iniciar sessão no próximo acesso via SSO.",
+      "blocklistSaved": "Usuários bloqueados salvos",
+      "blocklistDeleted": "Usuários desbloqueados",
+      "blocklistSection": "Usuários bloqueados por domínio",
+      "filterPending": "Pendente",
+      "filterAll": "Todos",
+      "requestedBy": "Solicitado por",
+      "requestedAt": "Solicitado em",
+      "verifiedAt": "Verificado",
+      "answeredBy": "Respondido por",
+      "reason": "Motivo",
+      "reasonHelp": "Exibido para a organização que fez a solicitação.",
+      "reasonRequired": "É necessário um motivo para rejeitar uma solicitação",
+      "approve": "Aprovar",
+      "reject": "Rejeitar",
+      "approveTitle": "Aprovar solicitação de vinculação?",
+      "rejectTitle": "Rejeitar solicitação de vinculação?",
+      "approveBody": "{domain} será vinculado a {org} sem verificação de DNS.",
+      "rejectBody": "{org} não receberá {domain}.",
+      "requestApproved": "{domain} vinculado",
+      "requestRejected": "Solicitação de {domain} rejeitada",
+      "decisionFailed": "Falha ao atualizar a solicitação"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Selecione a opção de detetar em"
   },
   "search_history": {
-    "title": "Histórico de pesquisa",
+    "title": "Histórico de utilização e custos",
     "get_history": "Obter histórico",
     "executed_at": "Executado em",
     "sql_query": "Consulta SQL",
-    "delayMessage": "O histórico de pesquisa pode ser atrasado em"
+    "delayMessage": "O histórico de utilização e custos pode sofrer um atraso de"
   },
   "correlation": {
     "unstableDimensionNote": "Dimensão instável - muda quando o pod é reiniciado. Padrão: todos os valores.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Os dados estão atualizados",
     "dataGettingStale": "Os dados estão a ficar obsoletos",
     "dataStale": "Os dados estão obsoletos",
-    "lastRefreshed": "Última atualização: {time}"
+    "lastRefreshed": "Última atualização: {time}",
+    "refresh": "Atualizar",
+    "refreshWithAge": "Atualizar, última atualização {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Erro de sonda"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "clique",
       "actionType": "introduzir",
       "all": "Todos",
@@ -19868,6 +20280,13 @@
       "attemptN": "Tentativa {n}",
       "detailAction": "Ação",
       "detailSelector": "Seletor",
+      "detailStepId": "ID do passo",
+      "detailTargetUrl": "URL de destino",
+      "detailStatus": "Estado",
+      "detailSkipReason": "Motivo da omissão",
+      "stepStatusSkipped": "Ignorado",
+      "stepStatusUnknown": "Desconhecido",
+      "skippedCount": "{n} ignorados",
       "downloadTrace": "Transferir {filename}",
       "errorFullscreenTitle": "Etapa {id}: {action} - Erro",
       "failedAtStartLoad": "Falha ao abrir o URL inicial",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Máximo {max}. As tentativas são executadas no mesmo job, portanto toda a sequência deve caber no orçamento da verificação.",
       "retriesMaxBrowserHint": "Máximo {max} para verificações de navegador. Cada tentativa reexecuta a jornada em todos os dispositivos, por isso mais tentativas excederiam o tempo limite da sonda e reportariam uma falha que o seu site nunca teve.",
       "retryDelay": "Aguarde",
-      "retryDelaySuffix": "ms entre as novas tentativas.",
+      "retryDelaySuffix": "segundos entre tentativas.",
       "schedule": "Agendamento",
       "scheduleLater": "Agende mais tarde",
       "scheduleLaterTooltip": "Escolha uma data e hora futuras para ativar a verificação.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Configuração de reinício — copie o comando de configuração deste agente para reexecutar a instalação / reinício do docker (por exemplo, após uma rotação de token)",
         "noAgents": "Nenhum agente se registou para este local ainda.",
         "agentsUnavailable": "Os agentes deste local registaram-se noutro cluster e não estão visíveis aqui.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Verificações em execução a partir deste local",
         "checkName": "Nome",
         "noChecks": "Nenhuma verificação está atribuída a este local ainda.",
@@ -20546,7 +20967,7 @@
       "nodes": "Nós",
       "modelPricing": "Preços do modelo",
       "searchSchedulers": "Agendadores de pesquisa",
-      "searchHistory": "Histórico de pesquisa",
+      "searchHistory": "Histórico de utilização e custos",
       "sessions": "Sessões",
       "evalTemplates": "Avaliações online — Modelos",
       "scorers": "Avaliações online — Avaliadores",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Atualizar lista",
       "alertTemplatesAdd": "Adicionar novo modelo",
       "alertTemplatesRefresh": "Atualizar lista",
-      "logsSearchHistory": "Abrir histórico de pesquisa",
+      "logsSearchHistory": "Abrir histórico de utilização e custos",
       "alertsImport": "Importar alerta",
       "panelEditorRun": "Executar/aplicar consulta",
       "panelEditorSave": "Guardar e continuar a editar",
@@ -21131,6 +21552,7 @@
         "system": "sistema"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Ativo",
         "passed": "Aprovado",
         "healthy": "Saudável",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Falha ao navegar para o alerta",
       "alertNotFound": "Alerta não encontrado",
-      "alertNotFoundInAlerts": "Alerta \"{name}\" não encontrado em {count} alertas",
       "failedToLoadAlerts": "Falha ao carregar alertas",
       "alertsDeletedSuccessfully": "{count} alerta eliminado com sucesso | {count} alertas eliminados com sucesso",
       "failedToDeleteAlerts": "Falha ao eliminar {count} alerta | Falha ao eliminar {count} alertas",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Aguarde enquanto carrega os modelos...",
       "alertSavedSuccessfully": "Alerta guardado com sucesso.",
       "alertUpdatedSuccessfully": "Alerta atualizado com sucesso.",
-      "openingDedupConfig": "A abrir configuração de deduplicação para: {name}",
       "editingAlert": "A editar alerta: {name}",
       "ack": {
         "acked": "{name} reconhecido",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Editor de Preços de Modelo",
     "storageSettings": "Definições de Armazenamento",
     "domainManagement": "Gestão de Domínio",
+    "orgDomainMapping": "Gerenciamento de domínios",
     "slackApp": "Slack",
     "regexPatterns": "Padrões Regex",
     "syntheticsLocations": "Locais de Synthetics",
@@ -26099,7 +26520,7 @@
       "logged": "Registado"
     },
     "policy": {
-      "gateHint": "Entre alterações em alertas existentes, apenas a deduplicação se aplica sozinha, com um snapshot do estado anterior e uma janela de revisão: mantida se as verificações passarem, revertida se falharem. Todo o resto aguarda aprovação com um clique.",
+      "gateHint": "Entre alterações a alertas existentes, apenas a ativação da supressão de repetições é aplicada automaticamente, com um snapshot do estado anterior e uma janela de revisão: mantido se as verificações passarem, revertido se falharem. Tudo o resto aguarda aprovação com um clique.",
       "off": "Desativado",
       "suggest": "Sugerir",
       "auto": "Automático",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Retém o acionamento até a investigação ser concluída, durante até 2 minutos. Falha aberta: se a triagem expirar ou falhar, aciona mesmo assim, informa que a investigação ainda está em curso ou falhou, e a causa segue na thread."
       },
       "classes": {
-        "EnableDeduplication": "Ativar a deduplicação para um alerta que se repete em poucos minutos.",
+        "EnableDeduplication": "Ativar a supressão de repetições para um alerta que notifica a cada avaliação.",
         "CreateDetector": "Criar um detetor de anomalias para pedidos, erros ou latência de um serviço.",
         "RaiseThreshold": "Elevar um limite que dispara em dias saudáveis.",
         "LengthenEvaluationWindow": "Aumentar a janela de um alerta que oscila.",
@@ -26667,10 +27088,10 @@
           "on": "alerta de ligação"
         },
         "L-302": {
-          "done": "Agrupei os 3 alertas de latência do checkout num só",
-          "why": "Dispararam juntos 94% das vezes, por isso uma lentidão acionou-o 3 vezes.",
-          "from": "3 alertas",
-          "to": "1",
+          "done": "Ativou a supressão de repetições nos 3 alertas de latência de checkout",
+          "why": "Notificavam a cada avaliação enquanto permaneciam disparados, por isso uma única lentidão acionou-o 120 vezes.",
+          "from": "Em cada avaliação",
+          "to": "Uma vez por alteração",
           "on": "latência do checkout"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "Acionei o piquete porque o checkout estava a falhar nos pagamentos.",
         "recsHeld": "Retive um problema menor com recommendations para o resumo de sexta-feira.",
         "diskApproved": "Aprovou aumentar o alerta de disco em ingest-1 para {to}%.",
-        "latencyGrouped": "Agrupei os três alertas de lentidão do checkout num só, para que uma única lentidão acione o piquete apenas uma vez.",
+        "latencyGrouped": "Ativei a supressão de repetições nos três alertas de lentidão do checkout, para que uma única lentidão acione apenas uma vez.",
         "queueFixed": "Adicionei workers à fila do orders, mas a fila continuou a crescer, por isso reverti-os e acionei o piquete.",
         "loginPaged": "Acionei o piquete devido ao início de sessão lento.",
         "queuePermission": "Permitiu-me adicionar workers de fila por conta própria, até 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Estado do pipeline",
       "legendToggle": "Mostrar ou ocultar este estado no mapa"
     }
+  },
+  "recentSearches": {
+    "title": "Pesquisas recentes",
+    "aboutKeptDays": "Apenas as suas pesquisas em {org}, visíveis apenas para si. Mantidas durante {days} dia; as pesquisas com estrela permanecem até que as remova. | Apenas as suas pesquisas em {org}, visíveis apenas para si. Mantidas durante {days} dias; as pesquisas com estrela permanecem até que as remova.",
+    "aboutKeptForever": "Apenas as suas pesquisas em {org}, visíveis apenas para si. Mantidas até serem eliminadas.",
+    "pageTitle": {
+      "logs": "Pesquisas recentes de logs",
+      "traces": "Pesquisas recentes de traces",
+      "metrics": "Pesquisas recentes de métricas",
+      "dbm": "Pesquisas recentes",
+      "profiles": "Pesquisas recentes"
+    },
+    "page": {
+      "logs": "Logs",
+      "traces": "Traces",
+      "metrics": "Métricas",
+      "dbm": "Base de dados",
+      "profiles": "Perfis"
+    },
+    "allPages": "Todas as páginas",
+    "viewAll": "Ver tudo",
+    "failedCount": "{count} com falha",
+    "keyHints": "↑↓ mover · PgUp/PgDn deslocar consulta · Enter executar · Shift+Enter apenas carregar · Esc fechar",
+    "loadToFix": "Carregar para corrigir",
+    "emptyTitle": "Ainda não há pesquisas recentes",
+    "loadError": "Não foi possível carregar as pesquisas recentes",
+    "retry": "Tentar novamente",
+    "warning": "Terminou com um aviso: tempo limite excedido ou resultados parciais",
+    "failed": "Falhou",
+    "ranCount": "executada {count}x",
+    "lineCount": "{count} linha | {count} linhas",
+    "relativeWindow": "Últimos {period}",
+    "rerunNow": "Executar novamente agora",
+    "rerunOriginal": "Na hora original",
+    "loadOnly": "Carregar sem executar",
+    "copyLink": "Copiar link",
+    "copyQuery": "Copiar consulta",
+    "star": "Adicionar estrela",
+    "unstar": "Remover estrela",
+    "linkCopied": "Link copiado",
+    "queryCopied": "Consulta copiada",
+    "copyFunction": "Copiar função",
+    "functionCopied": "Função copiada",
+    "functionLabel": "Função (VRL)",
+    "searchPlaceholder": "Pesquisar consultas e streams",
+    "allStreams": "Todos os streams",
+    "statusAll": "Qualquer estado",
+    "statusOk": "Concluída",
+    "statusError": "Falhada",
+    "starredOnly": "Apenas com estrela",
+    "datePlaceholder": "dd/mm/aaaa",
+    "filterByDateRun": "Filtrar por data de execução",
+    "today": "Hoje",
+    "yesterday": "Ontem",
+    "noMatch": "Nenhuma pesquisa corresponde a estes filtros",
+    "reset": "Repor tudo",
+    "resetFilters": "Repor filtros",
+    "loadMore": "Carregar mais",
+    "clear": "Limpar o meu histórico",
+    "confirmClear": "Limpar histórico",
+    "clearBodyPage": "Isto remove a sua pesquisa recente ({count}) de {page} em {org}. As vistas guardadas não são afetadas. | Isto remove as suas {count} pesquisas recentes de {page} em {org}. As vistas guardadas não são afetadas.",
+    "clearBodyAll": "Isto remove a sua pesquisa recente ({count}) em {org}, em Logs, Traces e Métricas. As vistas guardadas não são afetadas. | Isto remove as suas {count} pesquisas recentes em {org}, em Logs, Traces e Métricas. As vistas guardadas não são afetadas.",
+    "includeStarred": "Remover também a minha pesquisa com estrela ({count}) | Remover também as minhas {count} pesquisas com estrela",
+    "recentRow": "Pesquisa recente",
+    "deletedQuery": "Eliminada {query}",
+    "undo": "Desfazer"
   }
 }
diff --git a/web/src/locales/languages/ru-RU.json b/web/src/locales/languages/ru-RU.json
index 634180cca7..a8b29bce4a 100644
--- a/web/src/locales/languages/ru-RU.json
+++ b/web/src/locales/languages/ru-RU.json
@@ -486,7 +486,11 @@
       "monitors": "мониторы",
       "modelPricing": "определения цен моделей",
       "variables": "переменные",
-      "experiments": "эксперименты"
+      "experiments": "эксперименты",
+      "linkedDomains": "привязанные домены",
+      "domainMappings": "сопоставления доменов",
+      "domainRequests": "запросы на привязку",
+      "blockedUsers": "заблокированные пользователи"
     },
     "demo": {
       "pageTitle": "Пустые состояния — полный набор для проверки",
@@ -572,6 +576,30 @@
       "action": "Новая задача",
       "actionDesc": "Направьте OpenObserve на ваш эндпоинт и проверьте соединение."
     },
+    "noLinkedDomains": {
+      "title": "Привязанных доменов пока нет",
+      "description": "Привяжите принадлежащий вам домен электронной почты, чтобы сопоставлять его пользователей с вашими организациями и контролировать, кто может входить.",
+      "dns": "Добавить DNS-запись",
+      "dnsDesc": "Подтвердите владение с помощью TXT-записи",
+      "request": "Запросить привязку",
+      "requestDesc": "Попросите OpenObserve привязать домен за вас"
+    },
+    "noDomainMappings": {
+      "title": "Сопоставлений доменов пока нет",
+      "description": "Автоматически добавлять пользователей, которые входят через подтверждённый домен, в эту организацию или в участников её биллинговой группы.",
+      "action": "Добавить сопоставление",
+      "actionDesc": "Выберите домен, организацию и роль"
+    },
+    "noBlockedUsers": {
+      "title": "Заблокированных пользователей нет",
+      "description": "Присоединиться может любой пользователь из ваших подтверждённых доменов. Заблокируйте отдельных пользователей, чтобы не пускать их.",
+      "action": "Заблокировать пользователей",
+      "actionDesc": "Выберите домен и адреса электронной почты для блокировки"
+    },
+    "noDomainRequests": {
+      "title": "Запросов на привязку нет",
+      "description": "Здесь отображаются запросы от организаций на привязку домена."
+    },
     "noDowntimes": {
       "title": "Пока нет окон обслуживания",
       "description": "Окно обслуживания не прерывает работу оповещений, обнаружения аномалий и проверок синтетики, но останавливает отправку их уведомлений на заданный вами интервал.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Отключить автоматический запуск",
     "autoRefreshWithValue": "Автообновление: {value}",
     "searchHistory": "История поиска",
+    "usageCostHistory": "История использования и затрат",
     "createScheduledSearch": "Создать запланированный поиск",
     "listScheduledSearch": "Список запланированных поисков",
     "scheduleSearchJob": "Запланировать задачу поиска",
@@ -1355,6 +1384,8 @@
     "scanSize": "Размер сканирования",
     "deltaScanSize": "Дельта размера сканирования",
     "scannedSoFar": "Просканировано {size}",
+    "quickModeHiddenFields": "Быстрый режим включён. В этой строке показано {shown} из {total} полей.",
+    "turnOffQuickMode": "Выключить быстрый режим",
     "resultsProgressLabel": "Прогресс поиска",
     "histogramTitleError": "Ошибка при формировании заголовка гистограммы.",
     "selectLogStream": "Выбрать поток логов",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Нет данных о сети для этого представления",
     "apiEmptyDescription": "В выбранном потоке нет ресурсов или сетевых запросов за этот период времени. Сетевые метрики появятся после того, как приложение начнет инструментировать свои HTTP-вызовы.",
     "skipInactivity": "Пропустить бездействие",
+    "fullScreen": "Полноэкранный режим",
+    "exitFullScreen": "Выйти из полноэкранного режима",
     "error": "Ошибка",
     "errorCount": "Количество ошибок",
     "all": "Все",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Добавьте второй шаг, чтобы добавить эту воронку на дашборд",
         "snapshot": "Панель сохраняет эти шаги, фильтры и правила именованных событий в текущем виде."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Обзор производительности",
+      "filterService": "Сервис",
+      "filterEnv": "Окружение",
+      "filterVersion": "Версия",
+      "filterAll": "Все",
+      "verdictPass": "Core Web Vitals в норме",
+      "verdictFail": "Core Web Vitals требуют внимания",
+      "verdictAllPass": "Все в норме",
+      "verdictNeedWork": "{count} из {total} требует внимания | {count} из {total} требуют внимания",
+      "percentileLabel": "Процентиль",
+      "bandGood": "Хорошо",
+      "bandNeeds": "Требует улучшения",
+      "bandPoor": "Плохо",
+      "bandGoodPct": "{n}% хороших",
+      "bandNeedsPct": "{n}% требуют улучшения",
+      "bandPoorPct": "{n}% плохих",
+      "bandAria": "{good}% хороших, {needs}% требуют улучшения, {poor}% плохих",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} быстрее",
+      "deltaSlower": "{v} медленнее",
+      "deltaNone": "без изменений",
+      "deltaNoPrev": "недостаточно данных за предыдущий период",
+      "kpiSessions": "Сессии",
+      "kpiErrorFree": "Сессии без ошибок",
+      "kpiErrors": "Всего ошибок",
+      "kpiUnhandled": "Необработанные ошибки",
+      "kpiRegion": "Ключевые показатели",
+      "sparkAria": "Динамика {label} за выбранный период",
+      "chartTitle": "Сессии и ошибки",
+      "chartInterval": "за интервал",
+      "legendSessions": "Сессии",
+      "legendErrors": "Ошибки",
+      "releaseMarker": "{version} впервые замечена {time}",
+      "chartTableToggle": "Показать таблицу данных",
+      "chartTableHide": "Скрыть таблицу данных",
+      "chartTime": "Время",
+      "pagesTitle": "Страницы, которые нужно исправить в первую очередь",
+      "pagesHint": "Ранжировано по влиянию: трафик, взвешенный по доле просмотров с показателем выше порога или с ошибкой. Нажмите на страницу, чтобы открыть её сессии, а на число ошибок — чтобы открыть Error Tracking.",
+      "pagesColPage": "Страница",
+      "pagesColViews": "Просмотры",
+      "pagesColErrors": "Ошибки",
+      "pagesColImpact": "Влияние",
+      "pagesLegend": "▲ требует улучшения · ■ плохо · без отметки — хорошо. Страницы с числом просмотров меньше {n} скрыты.",
+      "pagesOpenSessions": "Открыть сессии для {path}",
+      "pagesOpenErrors": "Ошибка: {count}, открыть Error Tracking | Ошибок: {count}, открыть Error Tracking",
+      "pagesImpactAria": "Влияние {n} из 100",
+      "markNeeds": "требует улучшения",
+      "markPoor": "плохо",
+      "diffTitle": "Наибольшее отличие",
+      "diffBody": "INP p75 равен {inp}, что в {ratio}x больше, чем в других сегментах. Это корреляция для исследования, а не доказанная причина.",
+      "diffNone": "В этом диапазоне ни один сегмент не выделяется среди остальных.",
+      "diffLink": "Просмотреть затронутые сессии",
+      "segmentLabel": "Сегмент",
+      "segBrowser": "Браузер",
+      "segDevice": "Устройство",
+      "segCountry": "Страна",
+      "segInp": "INP {v}",
+      "segShare": "{n}% просмотров",
+      "segNone": "Нет данных для этого сегмента.",
+      "releaseTitle": "Сравнение версий",
+      "releaseHint": "{cur} в сравнении с {prev}. Начало релиза — это момент, когда версия впервые обнаружена.",
+      "releaseMetric": "Метрика",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Без ошибок",
+      "releaseSessions": "Сессии",
+      "releaseLink": "Ошибки в {version}",
+      "frustrationTitle": "Фрустрация пользователей",
+      "frustrationHint": "Проблемы, которые не улавливают веб-показатели",
+      "rageClicks": "Яростные клики",
+      "deadClicks": "Мёртвые клики",
+      "stateLoading": "Загрузка {panel}…",
+      "stateEmptyTitle": "В этом диапазоне нет просмотров страниц",
+      "stateEmptyBody": "Расширьте временной диапазон, сбросьте фильтр или проверьте, что браузерный SDK отправляет события просмотров.",
+      "stateEmptyAction": "Настроить SDK",
+      "stateLowTitle": "Только {count} просмотр страницы | Только {count} просмотров страниц",
+      "stateLowBody": "Процентили ненадёжны, если просмотров меньше {min}, поэтому вердикт скрыт. Значения показаны для справки.",
+      "stateErrorTitle": "Не удалось загрузить {panel}",
+      "stateErrorBody": "Запрос завершился ошибкой или превысил время ожидания. Другие панели не затронуты.",
+      "retry": "Повторить",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "ключевые показатели",
+      "panelPages": "страницы",
+      "panelSegments": "сегменты",
+      "panelRelease": "сравнение версий",
+      "panelFrustration": "фрустрация пользователей",
+      "schemaErrorTitle": "Не удалось загрузить схему RUM",
+      "schemaErrorBody": "Не удалось прочитать поля потока, поэтому обзор не может определить, какие панели показывать.",
+      "pagesShowAll": "Показать все страницы ({n})",
+      "pagesShowFewer": "Показать меньше страниц",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Нет страниц с достаточным количеством просмотров",
+      "pagesEmptyBody": "Чтобы попасть в рейтинг, страницам нужно не менее {n} просмотров в этом диапазоне.",
+      "segEmptyTitle": "Нет данных по сегментам",
+      "segEmptyBody": "Для этих просмотров не записаны значения браузера, устройства, ОС, страны или типа подключения.",
+      "releaseEmptyTitle": "Нужны две версии",
+      "releaseEmptyBody": "Для сравнения релизов нужно как минимум две версии в этом диапазоне.",
+      "releaseBefore": "{version} уже использовалась до этого диапазона, поэтому время её первого появления не отображается.",
+      "pageErrorTitle": "Не удалось загрузить обзор производительности",
+      "pageErrorBody": "Запросы завершились ошибкой или превысили время ожидания. Повторите попытку, чтобы загрузить все панели заново.",
+      "verdictOver": "{vital} превышает хороший порог {threshold} для {pct}% просмотров страниц.",
+      "verdictAllThree": "Все три Core Web Vitals в норме на p75.",
+      "verdictAllSome": "Все {n} оценённых Core Web Vitals в норме на p75.",
+      "releaseNewErrors": "{count} новая ошибка в этом релизе | {count} новых ошибок в этом релизе",
+      "verdictNoData": "Нет данных Core Web Vitals",
+      "verdictNoDataLead": "Ни один из {count} просмотра страниц в этом диапазоне не передал LCP, INP или CLS. | Ни один из {count} просмотров страниц в этом диапазоне не передал LCP, INP или CLS.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Открыть сессии.",
+      "pagesTableLabel": "Страницы, упорядоченные по влиянию",
+      "verdictSessions": "{count} сессия в диапазоне. | {count} сессий в диапазоне.",
+      "verdictCompare": "В сравнении с предыдущим периодом.",
+      "deltaLower": "на {v} ниже",
+      "deltaHigher": "на {v} выше",
+      "forbiddenTitle": "Нет разрешения на просмотр {panel}",
+      "forbiddenBody": "Запросите у администратора доступ к потоку данных RUM.",
+      "pageForbiddenTitle": "Нет разрешения на просмотр обзора производительности",
+      "asideLabel": "Где и что изменилось",
+      "pagesAbout": "Об этом рейтинге",
+      "chartPerFiveMinutes": "за 5 минут",
+      "chartPerThirtyMinutes": "за 30 минут",
+      "chartPerHour": "за час",
+      "chartPerSixHours": "за 6 часов",
+      "chartPerDay": "за день",
+      "chartIntervalOther": "за интервал",
+      "chartTableCaption": "Сессии и ошибки по интервалам",
+      "deltaChange": "{delta} к предыдущему периоду",
+      "deltaChangePts": "{delta} п.п. к предыдущему периоду",
+      "deltaFlat": "Без изменений к предыдущему периоду",
+      "deltaNewMsg": "Новое к предыдущему периоду",
+      "verdictP75Note": "Вердикт всегда использует p75; p50 и p95 меняют только значения.",
+      "releaseNote": "Сравнивает две последние версии независимо от фильтра версии.",
+      "kpiEmptyTitle": "В этом диапазоне нет сессий",
+      "kpiEmptyBody": "Расширьте временной диапазон или сбросьте фильтр.",
+      "releaseImproved": "улучшилось",
+      "releaseWorse": "ухудшилось",
+      "segOs": "ОС",
+      "segConnection": "Соединение",
+      "pagesAllLink": "Все страницы",
+      "pagesAllLinkAria": "Все страницы в Продуктовой аналитике",
+      "frustrationReplayLink": "Смотреть запись",
+      "frustrationReplayHint": "Открывает сессии с признаками фрустрации в этом диапазоне; у записанных сессий есть запись для просмотра.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "В этом диапазоне ничего не записано. Расширьте временной диапазон или настройте браузерный SDK, если приложение ещё не отправляло данные.",
+      "stateEmptyFiltered": "В этом диапазоне ничто не соответствует этим фильтрам. Сбросьте фильтры, чтобы увидеть все сервисы, окружения и версии.",
+      "clearFilters": "Сбросить фильтры",
+      "stateRefreshing": "Обновление {panel}",
+      "tileOpenSessions": "{label}: {value}. Открытые сессии",
+      "tileOpenErrors": "{label}: {value}. Открыть отслеживание ошибок",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "В этом обзоре учитываются только сессии браузера. Метрики мобильного приложения приведены ниже.",
+      "mixedMobileNote": "Фильтры ниже применяются только к метрикам мобильного приложения."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Удалить",
     "confirmDeleteHead": "Удалить пользователя",
     "confirmDeleteMsg": "Вы уверены, что хотите удалить пользователя {name}?",
+    "block": "Заблокировать",
+    "confirmBlockHead": "Заблокировать пользователя",
+    "confirmBlockMsg": "{email} вошёл через ваш подтверждённый домен. Блокировка добавит его в ограничения домена этой организации и удалит из этой организации. Из других сопоставленных организаций он будет удалён при следующем входе.",
     "cancel": "Отмена",
     "save": "Сохранить",
     "ok": "ОК",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Отозвать приглашение",
     "revokeInvitationMsg": "Вы уверены, что хотите отозвать приглашение для {email}?",
     "deleteUsersTitle": "Удалить пользователей",
-    "deleteUsersMsg": "Вы уверены, что хотите удалить {count} пользователя? | Вы уверены, что хотите удалить выбранных пользователей ({count})?"
+    "deleteUsersMsg": "Вы уверены, что хотите удалить {count} пользователя? | Вы уверены, что хотите удалить выбранных пользователей ({count})?",
+    "deleteUsersBlockNote": "{count} из них вошли через ваш подтверждённый домен и будут заблокированы, а не удалены."
   },
   "invitation": {
     "pendingInvitations": "Ожидающие приглашения",
@@ -3403,8 +3597,6 @@
       },
       "show": "Показать",
       "searchPermissions": "Поиск разрешений",
-      "filterModules": "Фильтр модулей",
-      "noModuleMatch": "Нет модулей, соответствующих фильтру",
       "moduleScopeAll": "Все",
       "moduleScopeGranted": "Выбранные",
       "noGrantedModule": "Модули пока не выбраны",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Разрешение | Разрешения",
       "summaryReachSome": "{count} из {total}",
       "summaryEmptyTitle": "Эта роль пока ничего не предоставляет",
-      "summaryEmptyDescription": "Выберите модуль слева или начните с шаблона.",
+      "summaryEmptyDescription": "Начните с пресета или выберите модули из списка.",
       "presetReadonlyTitle": "Только чтение",
       "presetReadonlyDescription": "Список и чтение в каждом модуле",
       "presetDbmTitle": "Просмотр мониторинга баз данных",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "В этой организации ещё нет ни одного из потоков метрик Kubernetes (всего {total}), поэтому ничего не было предварительно выбрано.",
       "rumPresetSeeded": "Предварительно выбран доступ на чтение к потокам RUM ({matched} из {total}), а также к картам исходников и любым правам на продуктовую аналитику RUM. Проверьте перед сохранением.",
       "rumPresetNoMatch": "Ни один из потоков RUM (всего {total}) ещё не существует в этой организации, поэтому по ним ничего не было предварительно выбрано; карты исходников и любые права на продуктовую аналитику RUM всё равно были подготовлены.",
-      "moduleGroupFleet": "Парк"
+      "moduleGroupFleet": "Парк",
+      "filterModulesTasks": "Фильтр модулей",
+      "noModuleMatchQuery": "Нет модулей, соответствующих «{query}»",
+      "noModuleMatchHint": "Ищите по модулю, группе или задаче, например slack, panel или token.",
+      "presetAlertManagerTitle": "Менеджер оповещений",
+      "presetAlertManagerDescription": "Создание оповещений и управление ими, их получателями и сообщениями",
+      "presetAlertViewerTitle": "Просмотр оповещений",
+      "presetAlertViewerDescription": "Просмотр оповещений, получателей и шаблонов без их изменения",
+      "presetDashboardEditorTitle": "Редактор дашбордов",
+      "presetDashboardEditorDescription": "Создание и редактирование дашбордов с доступом на чтение к данным, которые они запрашивают",
+      "presetDashboardViewerTitle": "Просмотр дашбордов",
+      "presetDashboardViewerDescription": "Открытие дашбордов и чтение данных, на которых построены их панели",
+      "presetPipelineEditorTitle": "Редактор конвейеров",
+      "presetPipelineEditorDescription": "Создание конвейеров и функций с доступом на чтение к потокам и таблицам обогащения",
+      "presetApplied": "{title}: добавлено {permissions}. Проверьте изменения перед сохранением.",
+      "presetPermissionCount": "{count} разрешение | разрешений: {count}",
+      "companionReasonAlertStreams": "чтобы сохранять оповещения. При сохранении сервер проверяет доступ к потокам",
+      "companionReasonAlertDestinations": "чтобы выбирать, куда отправляются оповещения",
+      "companionReasonDestinationTemplates": "чтобы выбрать шаблон сообщения, который нужен каждому получателю",
+      "companionReasonDashboardStreams": "чтобы загружать данные панелей",
+      "presetsTitle": "Пресеты",
+      "presetsClose": "Закрыть пресеты",
+      "presetsShow": "Показать пресеты",
+      "presetsSubtitle": "Добавьте разрешения из пресета в эту роль. Ничего не удаляется.",
+      "presetsSectionBuiltin": "Встроенные",
+      "presetsSectionJob": "По должности",
+      "presetAddsTooltip": "Добавляет {count} разрешение | Добавляет разрешений: {count}",
+      "presetInRole": "В роли",
+      "presetInRoleTooltip": "В этой роли уже есть всё из этого пресета",
+      "presetBack": "Все пресеты",
+      "presetModuleCount": "{count} модуль | модулей: {count}",
+      "presetSummaryAdds": "Добавляет {permissions} ({modules}).",
+      "presetSummaryWrite": "Доступ на запись в модулях: {modules}.",
+      "presetSummaryViewOnly": "Только просмотр: ничего нельзя создать, изменить или удалить.",
+      "presetSummaryHasAll": "В этой роли уже есть всё из этого пресета.",
+      "presetSummarySkipped": "{count} разрешение уже есть в этой роли и будет пропущено. | Пропущено разрешений, которые уже есть в этой роли: {count}.",
+      "presetStillMissing": "После добавления по-прежнему не хватает: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "После добавления всё необходимое будет на месте.",
+      "neededBy": "Нужно для {modules}",
+      "stillNeededBy": "По-прежнему нужно для {modules}",
+      "presetReadsEveryStream": "Читает все потоки в этой организации, включая новые.",
+      "presetAddButton": "Добавить {count} разрешение | Добавить разрешения ({count})",
+      "presetNothingToAdd": "Нечего добавлять",
+      "presetApplyNote": "Добавленные разрешения становятся несохранёнными изменениями. Проверьте их перед сохранением.",
+      "presetLoadingStreams": "Загрузка потоков",
+      "presetNoMatchingStreams": "В этой организации пока нет подходящих потоков.",
+      "reviewMissingTooltip": "Для работы этой роли не хватает {count} модуля | Для работы этой роли не хватает модулей: {count}",
+      "notAddedYetTitle": "Ещё не добавлено · {modules}",
+      "companionAdd": "Добавить",
+      "companionAddItem": "Добавить {item}",
+      "companionAddAll": "Добавить все",
+      "companionOpenStreams": "Открыть потоки",
+      "companionOpenStreamsTooltip": "Выберите, какие потоки может читать эта роль",
+      "companionNeeds": "Модулю {module} это нужно, {reason}.",
+      "companionNeedsThis": "Модулю {module} нужно это разрешение, {reason}.",
+      "companionStillNeedsThis": "Модулю {module} по-прежнему нужно это разрешение, {reason}.",
+      "yourChanges": "Ваши изменения",
+      "yourChangesCount": "{changes} ({modules})",
+      "yourChangesNone": "Пока нет",
+      "changeCount": "{count} изменение | изменений: {count}",
+      "changeOtherGroup": "Другое",
+      "saveSuccessCounts": "Сохранено {changes} ({modules}).",
+      "effectCan": "Может {actions} {target}.",
+      "effectCannot": "Больше не может {actions} {target}.",
+      "effectCanLoadDestinations": "Может загружать список получателей.",
+      "effectCannotLoadDestinations": "Больше не может загружать список получателей.",
+      "effectCanLoadTemplates": "Может загружать список шаблонов.",
+      "effectCannotLoadTemplates": "Больше не может загружать список шаблонов.",
+      "verbView": "просматривать",
+      "verbSeeListOf": "видеть в списке",
+      "verbList": "видеть в списке",
+      "verbOpen": "открывать",
+      "verbCreate": "создавать",
+      "verbEdit": "редактировать",
+      "verbDelete": "удалять",
+      "targetEveryStream": "каждый поток (логи, метрики, трейсы и индексы), включая новые",
+      "targetTypeStreams": "все потоки {type}",
+      "targetOneStream": "поток {type} {name}",
+      "targetAlertsEveryFolder": "оповещения во всех папках, включая новые папки",
+      "targetAlertsInFolder": "оповещения в папке {name}",
+      "targetOneAlert": "оповещение {name}",
+      "targetDashboardsEveryFolder": "дашборды во всех папках, включая новые папки",
+      "targetDashboardsInFolder": "дашборды в папке {name}",
+      "targetOneDashboard": "дашборд {name}",
+      "targetReportsEveryFolder": "отчёты во всех папках, включая новые папки",
+      "targetReportsInFolder": "отчёты в папке {name}",
+      "targetOneReport": "отчёт {name}",
+      "targetEveryDestination": "каждого получателя оповещений (Slack, электронная почта, вебхуки), включая новых",
+      "targetOneDestination": "получателя {name}",
+      "targetEveryTemplate": "каждый шаблон уведомлений, включая новые",
+      "targetOneTemplate": "шаблон {name}",
+      "targetAllOf": "все {module}, включая новые",
+      "targetItemIn": "{name} в {module}",
+      "noteDestinationsFiltered": "Они видят только тех получателей, которых также могут открыть. Добавьте «Получить» здесь или для отдельных получателей, чтобы выбрать, каких именно.",
+      "noteTemplatesFiltered": "Они видят только те шаблоны, которые также могут открыть. Добавьте «Получить» здесь или для отдельных шаблонов, чтобы выбрать, какие именно.",
+      "presetStreamsFailed": "Не удалось загрузить список потоков.",
+      "presetRetry": "Повторить",
+      "presetRestored": "{title}: восстановлено {permissions}. Проверьте изменения перед сохранением.",
+      "presetSummaryRestores": "Сохраняет {count} разрешение, отмеченное вами для удаления. | Сохраняет разрешения, отмеченные вами для удаления: {count}.",
+      "presetRestoreButton": "Сохранить {count} разрешение | Сохранить разрешения ({count})",
+      "effectStillAllowed": "Без изменения доступа: более широкое разрешение по-прежнему это позволяет."
     },
     "rolesPage": {
       "subtitle": "Роли объединяют разрешения — назначайте их пользователям, сервисным аккаунтам или группам для предоставления доступа.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Пользователь успешно обновлен.",
       "userDeletedSuccess": "Пользователь успешно удален.",
       "errorDeletingUser": "Ошибка при удалении пользователя.",
+      "userBlockedSuccess": "Пользователь успешно заблокирован.",
+      "errorBlockingUser": "Ошибка при блокировке пользователя.",
+      "blockedButNotRemoved": "Пользователь заблокирован, но его не удалось удалить из этой организации.",
+      "blockedUsersSuccess": "Успешно заблокирован {count} пользователь | Успешно заблокировано {count} пользователей",
+      "blockedUsersPartial": "Заблокирован и удалён {count} пользователь, но {failed} не удалось удалить из этой организации | Заблокировано и удалено {count} пользователей, но {failed} не удалось удалить из этой организации",
+      "blockedUsersNotRemoved": "Заблокирован {count} пользователь, но его не удалось удалить из этой организации | Заблокировано {count} пользователей, но их не удалось удалить из этой организации",
       "pleaseWait": "Пожалуйста, подождите...",
       "invitationRevokedSuccess": "Приглашение успешно отозвано.",
       "errorRevokingInvitation": "Ошибка при отзыве приглашения.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Трейсы собираются с помощью eBPF: не нужны изменения кода или SDK. Контекст трассировки передаётся между сервисами только по HTTP без шифрования (у Go-приложений также по HTTPS, кроме узлов с kernel lockdown). Трассируется процесс, совпадающий по любому из портов, пути к исполняемому файлу или командной строке; глобы не могут содержать `,`, `{'{'}` или `{'}'}`, а порт совпадает с любым процессом, у которого есть сокет на этом порту. Нужны Helm 3.14+ и оператор OpenTelemetry v0.142.0+; если ваш старше, сначала обновите его: `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Если eBPF уже был включён на более старом операторе, перезапустите команду с `--force` (`--force-replace` в Helm 4). Повторный запуск команды установки выше сбрасывает релиз и отключает eBPF, поэтому после этого снова выполните эту команду. Пространство имён `openobserve-collector` должно разрешать привилегированные поды, а узлы должны работать на Linux (amd64 или arm64) с ядром 5.8+ (или 4.18 из семейства RHEL с бэкпортами eBPF) и BTF. Не выбирайте приложения, которые уже отправляют собственные трейсы, и поды с Go-сайдкаром `inject-go`.",
       "k8sEbpfVariant": "eBPF (любой язык, без изменений кода)",
       "k8sLibrariesVariant": "Языковые библиотеки (автоинструментирование)",
+      "k8sNetworkFlowsDesc": "DaemonSet eBPF коллектора записывает **байты, отправленные между рабочими нагрузками по любому протоколу TCP или UDP**, на каждом узле Linux, включая базы данных, кеши и другие сервисы, которые не трассируются. Они поступают в виде метрики `obi_network_flow_bytes` с метками владельца источника и получателя (Deployment, StatefulSet, Node, …) и пространства имён. Работает с трассировкой eBPF и без неё.",
+      "k8sNetworkFlowsNote": "Требуется Helm 3.14+ и OpenTelemetry operator v0.142.0+. Пространство имён `openobserve-collector` должно разрешать привилегированные поды, а узлы должны работать под Linux на amd64 или arm64 с ядром 5.8+ (или 4.18 из семейства RHEL с бэкпортами eBPF) и BTF. Поды eBPF работают в сети хоста, а собственные метрики коллектора прослушивают `127.0.0.1:8888` на каждом узле, поэтому этот порт там должен быть свободен. Уже заданные селекторы трейсов eBPF сохраняются. Повторный запуск команды установки выше сбрасывает релиз и отключает это, поэтому после него снова запустите эту команду. Одни и те же байты могут быть учтены более одного раза: трафик между узлами — обоими узлами, а подключение к Service — и самим Service, и рабочей нагрузкой за ним. Руководство по сетевым потокам eBPF объясняет, как запрашивать их без двойного подсчёта.",
+      "k8sNetworkFlowsTitle": "Смотрите, какие рабочие нагрузки взаимодействуют друг с другом: сетевые потоки eBPF",
       "k8sInstallerNote": "Это автоматически устанавливает cert-manager, оператор OpenTelemetry и коллектор OpenObserve.",
       "k8sInternalEndpointNote": "Используйте это, когда OpenObserve работает в этом же кластере — трафик не выходит за его пределы.",
       "k8sTroubleAnnotationA": "Внедрение происходит при создании пода, поэтому существующие поды не изменяются до перезапуска — выполните `kubectl rollout restart deployment -n my-namespace`. Убедитесь, что аннотация применилась, с помощью `kubectl get ns my-namespace -o yaml`, и проверьте, что значение соответствует `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "Установка завершается ошибкой, связанной с admission webhook",
       "linuxAgentFixBody": "Установщик запускает агента как службу systemd. Если данные не поступают, убедитесь, что он работает, и проверьте его журналы на наличие ошибки аутентификации или подключения:",
       "linuxTracesNote": "Трейсы собираются с помощью eBPF: не нужны изменения кода или SDK. Трассируется процесс, совпадающий по любому из портов, пути к исполняемому файлу или командной строке; глобы не могут содержать `,`, `{'{'}` или `{'}'}`. Для трассировки требуется Linux 5.8+ (или 4.18 из семейства RHEL с бэкпортами eBPF) с BTF; при этом агент работает от имени root. Если на хосте трассировка невозможна, установка останавливается, а работающий агент остаётся без изменений. Если после этого агент не запускается при включённой трассировке, она отключается — вместе со сбором логов и метрик — пока вы не повторите команду **Логи и метрики** или не устраните причину и не запустите агент снова с трассировкой. Трассируемые приложения добавляют заголовок W3C `traceparent` к исходящим незашифрованным HTTP-запросам. Руководство по трассировке eBPF ниже описывает HTTPS и повторяющиеся флаги.",
+      "linuxNetworkFlowsDesc": "Запустите установщик с `--network-flows`, чтобы передавать **байты, которые этот хост отправляет и получает по любому протоколу TCP или UDP**, в виде метрики `obi_network_flow_bytes`. Каждый поток получает метки `src_cidr` и `dst_cidr` с сетями, которые вы указали, поэтому задайте одинаковый список на каждом хосте: одна запись `/32` на хост даёт карту связей между хостами.",
+      "linuxNetworkFlowsNote": "Требуется Linux 5.8+ (или 4.18 из семейства RHEL с бэкпортами eBPF) с BTF; тогда агент работает от имени root. Он работает с трассировкой и без неё, но каждый запуск установщика заменяет конфигурацию агента: чтобы сохранить трассировку, добавьте флаги `--trace-*` и `--service-name` из команды **Логи, метрики и трейсы eBPF**. Если хост не может запускать eBPF, установка останавливается и не трогает работающий агент. Если затем сетевой захват не запускается, агент отключается — вместе с логами и метриками — пока вы не перезапустите команду **Логи и метрики** или не устраните причину и не запустите её снова с `--network-flows`. Трафик между двумя хостами, на которых работает агент, учитывается каждым из них, а loopback-трафик учитывается, если адреса обоих концов не совпадают. Руководство по сетевым потокам eBPF ниже объясняет метки и то, как запрашивать их без двойного подсчёта.",
+      "linuxNetworkFlowsTitle": "Смотрите, какие хосты взаимодействуют друг с другом: сетевые потоки eBPF",
       "linuxTracesVerifyNote": "При включённой трассировке трейсы появятся, как только трассируемое приложение обработает запрос.",
+      "ebpfNetworkFlowsGuideLink": "Руководство по сетевым потокам eBPF",
       "ebpfTracingGuideLink": "Руководство по трассировке eBPF",
       "logsMetricsTracesVariant": "Логи, метрики и eBPF-трейсы",
       "logsMetricsVariant": "Логи и метрики",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Направьте любой экспортер OpenTelemetry на OpenObserve — коллектор или SDK, HTTP или gRPC. Ваша конечная точка и токен заполнены ниже.",
       "taglineWindows": "Установите агент OpenObserve на любой Windows-хост — журнал событий, счетчики производительности и метрики хоста.",
       "testAgain": "Проверить снова",
+      "networkFlowsHelp": "Записи в формате CIDR или CIDR=NAME, разделённые запятыми без пробелов; каждый CIDR должен иметь длину префикса, например 10.0.1.5/32, а имена могут содержать только буквы, цифры, ., _ и -. Адреса, не совпавшие ни с одной записью, остаются без метки; 0.0.0.0/0=other задаёт имя для остального IPv4, ::/0=other6 — для остального IPv6.",
+      "networkFlowsLabel": "Сети для маркировки",
+      "networkFlowsRequired": "Укажите хотя бы одну сеть: потоки помечаются сетями, которые вы указали.",
       "traceCmdHelp": "Для приложений на Python, Node.js и Java.",
       "traceCmdLabel": "Командная строка",
       "traceExeLabel": "Путь к исполняемому файлу",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Скрывать ячейки меньше",
     "heatmapHideBelowTooltip": "Ячейки со значением меньше этого остаются пустыми.",
     "heatmapHideBelowNote": "Ячейки ниже {value} скрыты",
+    "boxplotWhisker": "Усы",
+    "boxplotWhiskerMinMax": "От минимума до максимума",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Поле сообщения",
+    "logsLevelField": "Поле уровня",
+    "logsTimeField": "Поле времени",
+    "htmlPanelFieldTooltip": "Оставьте пустым, чтобы определить столбец по результатам запроса",
+    "logsOrder": "Порядок",
+    "logsOrderNewest": "Сначала новые",
+    "logsOrderOldest": "Сначала старые",
+    "logsOrderTooltip": "Упорядочивает строки, которые возвращает запрос. Неизменённый начальный запрос тоже загружается в этом порядке, поэтому «Сначала старые» показывает самые ранние логи.",
+    "logsShowTime": "Показывать время",
+    "logsWrap": "Переносить строки",
+    "logsPrettifyJson": "Форматировать JSON",
     "distributionBucketCount": "Число интервалов",
     "distributionBucketSize": "Ширина интервала",
     "distributionBucketSizeTooltip": "Ширина каждого интервала в единицах поля. Если задана, заменяет число интервалов.",
@@ -7822,6 +8145,8 @@
       "gauge": "Датчик",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Ящик с усами",
+      "logs": "Логи",
       "barGauge": "Шкала-полоса",
       "distribution": "Распределение",
       "treemap": "Древовидная карта",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: Отсутствует обязательный аргумент на позиции {index}",
       "fieldNotAllowedForMetric": "Поле {label} не разрешено для метрической диаграммы",
       "rawValueSampled": "По первым {count} строкам",
+      "addAtMostOneFieldFor": "Добавьте не более одного поля для {label}",
+      "boxplotMin": "Мин",
+      "boxplotMax": "Макс",
+      "boxplotLowerWhisker": "Нижний ус",
+      "boxplotUpperWhisker": "Верхний ус",
+      "boxplotMedian": "Медиана",
+      "boxplotSamples": "Выборки",
+      "boxplotOutlier": "Выброс",
       "fieldNotAllowedForDistribution": "Поле {label} недопустимо для диаграммы распределения",
       "distributionCount": "Количество",
       "addAtLeastOneFieldFor": "Добавьте как минимум одно поле для {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Нет доступа",
       "urlHiddenHint": "Вы не можете просматривать дашборд этой ссылки, поэтому её публичный URL скрыт.",
       "orgDisabledHint": "Публичные ссылки отключены для этой организации",
+      "orgDisabledBanner": "Публичные ссылки отключены для этой организации, поэтому ссылка не выдаётся. Администратор может включить их снова.",
+      "disabledPaused": "Отключено · Приостановлено",
       "takeOver": "Взять на себя",
       "takeOverTitle": "Взять эту ссылку на себя?",
       "takeOverBody": "Вы станете автором публикации. Публичная страница будет показывать то, что разрешено видеть вам, — это может быть больше или меньше, чем раньше. Все, у кого есть URL, сохранят доступ, а ссылка станет активной сразу.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Группа",
     "wellSubgroup": "Подгруппа",
     "wellSize": "Размер",
+    "wellCategory": "Категория",
     "value": "Значение"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Отодвиньте значение срабатывания от наблюдаемого установившегося состояния.",
       "lengthenEvaluationWindow": "Увеличить окно проверки",
       "lengthenEvaluationWindowDesc": "Расширьте период, чтобы короткий всплеск больше не вызывал срабатывание оповещения.",
-      "enableDeduplication": "Включить дедупликацию",
-      "enableDeduplicationDesc": "Объединяйте повторные срабатывания в пределах окна дедупликации.",
+      "enableDeduplication": "Включить подавление повторов",
+      "enableDeduplicationDesc": "Уведомлять один раз при изменении состояния, а не при каждой проверке.",
       "reviewForDeletion": "Проверить на удаление",
       "reviewForDeletionDesc": "Убедитесь, что запрос всё ещё соответствует реальности, прежде чем выводить оповещение из эксплуатации.",
       "fixAlertQuery": "Исправить запрос оповещения",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "Идентификатор организации",
     "alertCreationTitle": "Создание оповещения",
     "noAlertsFound": "Оповещения не найдены",
-    "suppressedByDeduplication": "Подавлено дедупликацией",
-    "occurrence": "{count} вхождение | Вхождений: {count}",
     "groupedNotification": "Групповое уведомление",
     "alertsBatchedTogether": "оповещения, сгруппированные вместе",
-    "notificationSent": "Уведомление отправлено",
-    "occurrencesDeduplicated": "вхождения дедуплицированы",
     "alertExecutionDetails": "Детали выполнения оповещения",
     "evaluationTime": "Время оценки",
     "queryTime": "Время запроса",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "По: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Временная корреляция",
     "serviceGraphTooltipServiceDependency": "Зависимость служб",
-    "totalAlerts": "Всего оповещений",
-    "usingDeduplication": "Использование дедупликации",
-    "deduplicationConfiguredTooltip": "Оповещения с настроенной дедупликацией",
-    "suppressionRate24h": "Коэффициент подавления (24ч)",
     "suppressed": "подавлено /",
-    "total": "всего",
-    "passedLabel": "Пройдено:",
-    "pendingBatches": "Ожидающие пакеты",
-    "pendingBatchesTooltip": "Оповещения, ожидающие группировки",
     "historyTimeline": {
       "firing": "Сработало",
       "ok": "Ок",
@@ -10089,7 +10413,8 @@
     "endTime": "Время окончания",
     "duration": "Длительность",
     "retries": "Повторы",
-    "dedup": "Дедуп",
+    "suppression": "Подавление",
+    "suppressedAsRepeat": "Подавлено как повтор",
     "validation": {
       "streamTypeRequired": "Тип потока обязателен.",
       "streamNameRequired": "Имя потока обязательно.",
@@ -10281,15 +10606,6 @@
     "all": "Все",
     "history": "История оповещений",
     "searcHistory": "Введите имя оповещения",
-    "deduplication": {
-      "fingerprintFields": "Группировать похожие оповещения по",
-      "fingerprintFieldsHint": "Выберите поля, которые делают оповещения похожими (например, hostname, service). Оставьте пустым для автоматического определения на основе вашего запроса.",
-      "fingerprintFieldsTooltip": "Выберите поля, которые должны совпадать, чтобы оповещения считались дубликатами. Например, выбор 'hostname' означает, что оповещения с одного хоста будут сгруппированы вместе. Разные типы оповещений (например, Высокая загрузка ЦП vs Высокая память) никогда не группируются, даже если они приходят с одного хоста. Оставьте пустым для автоматического определения на основе типа запроса.",
-      "timeWindow": "Считать оповещения идентичными в течение",
-      "timeWindowHint": "Период времени для группировки похожих оповещений. Оставьте пустым, чтобы соответствовать интервалу проверки.",
-      "timeWindowTooltip": "Как долго запоминать последние оповещения для группировки. Если похожее оповещение происходит в течение этого времени, оно не будет отправлено снова. Оставьте пустым, чтобы использовать интервал проверки оповещения.",
-      "fingerprintFieldsHelp": "Оставьте пустым для автоматического определения на основе запроса (SQL: столбцы GROUP BY, PromQL: метки, Custom: поля условий)"
-    },
     "summary": {
       "scrollToBottom": "Прокрутить вниз",
       "title": "Сводка",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Оповещать меня при выполнении настроенных условий"
       }
     },
-    "correlation": {
-      "title": "Корреляция оповещений",
-      "description": "Настройте корреляцию и дедупликацию оповещений в организации. Оповещения с совпадающими значениями отпечатков будут сгруппированы.",
-      "semanticFieldNote": "Примечание. Сопоставления семантических полей настраиваются на вкладке Service Identity.",
-      "enableOrgLevel": "Включить дедупликацию на уровне организации",
-      "enableOrgLevelTooltip": "Включить функции дедупликации и корреляции для всех оповещений в этой организации",
-      "enableCrossAlert": "Включить дедупликацию между оповещениями",
-      "enableCrossAlertTooltip": "Разрешить разным оповещениям дедуплицировать друг друга при наличии общего отпечатка",
-      "fingerprintGroups": "Группы отпечатков между оповещениями",
-      "fingerprintGroupsTooltip": "Выберите семантические группы для создания отпечатков между оповещениями. Оповещения будут дедуплицированы, если они имеют одинаковые значения по этим измерениям.",
-      "fingerprintGroupsHint": "Выберите хотя бы одну семантическую группу для дедупликации между оповещениями",
-      "fingerprintGroupsRequired": "Необходимо выбрать хотя бы одну семантическую группу",
-      "defaultWindow": "Окно корреляции по умолчанию (минуты)",
-      "defaultWindowTooltip": "При отсутствии совпадения семантического поля оповещения и данные за указанный период считаются связанными",
-      "defaultWindowDescription": "При отсутствии совпадения семантического поля оповещения и данные за указанный период считаются связанными",
-      "defaultWindowPlaceholder": "Использовать период оповещения по умолчанию",
-      "cancelButton": "Отмена",
-      "saveButton": "Сохранить",
-      "settingsSaved": "Настройки дедупликации организации успешно сохранены",
-      "settingsSaveError": "Не удалось сохранить настройки"
-    },
     "placeholders": {
       "typeSomething": "Введите что-нибудь",
       "value": "Значение",
       "selectColumn": "Выберите столбец",
       "savedFunctions": "Сохраненные функции",
-      "autoUsesCheckInterval": "Авто (использует интервал проверки)",
       "addTag": "Добавьте тег и нажмите Enter"
     },
     "steps": {
       "compareWithPast": "Сравнение с прошлым",
-      "deduplication": "Дедупликация",
       "advanced": "Дополнительно"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Что должно вызывать оповещение",
       "compareWithPast": "Сравнить текущие результаты с данными из другого периода",
       "alertSettings": "Установите правила оповещения и выберите способ уведомления.",
-      "deduplication": "Избегайте многократной отправки одного и того же оповещения, группируя похожие.",
       "advanced": "Контекстные переменные, описание и шаблон строки"
     },
     "failedToFetchHistory": "Не удалось получить историю оповещений",
@@ -10399,8 +10691,6 @@
         "closeActions": "Закрыть действия",
         "viewAlertHistory": "Просмотреть историю оповещений",
         "actionsFor": "Действия для:",
-        "configureDedup": "Настроить дедупликацию",
-        "configureDedupTooltip": "Настройка дедупликации для этого оповещения",
         "editAlert": "Редактировать оповещение",
         "editAlertTooltip": "Редактировать конфигурацию оповещения",
         "viewHistory": "Просмотреть историю",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "новое сообщение «Восстановлено»",
       "keepFiringFor": "Удерживать срабатывание",
       "keepFiringForTooltip": "Подождать столько времени после исчезновения условия перед восстановлением. 0 — восстановить сразу.",
+      "suppressRepeats": "Подавлять повторы",
+      "suppressRepeatsTooltip": "Уведомлять один раз, когда оповещение начинает срабатывать или меняет уровень, а не при каждой проверке. Если выключено, напоминания будут приходить после каждого периода тишины.",
       "keepFiringForInvalid": "Введите 0 или более секунд",
       "keepFiringForTooLong": "Введите не более 86400 секунд (24 часа)"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Этот адрес электронной почты уже был добавлен",
     "confirmRemoveEmail": "Вы уверены, что хотите удалить адрес электронной почты {email}?",
     "domainNeedsEmails": "Домен '{domain}' должен содержать хотя бы один адрес электронной почты, если не разрешены все пользователи",
+    "noAllowedEmailsDenyAll": "Разрешённых адресов электронной почты пока нет, поэтому всем пользователям из {domain} доступ запрещён.",
     "domainSettingsSaved": "Настройки домена успешно сохранены",
     "errorSavingDomainSettings": "Ошибка при сохранении настроек домена",
     "noDomainMessage": "Домены не настроены. Добавьте домены выше для ограничения доступа.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Настройте хотя бы один набор идентификаторов перед сохранением.",
       "discoveredServicesTab": "Обнаруженные службы",
       "serviceDiscoveryTab": "Правила обнаружения",
-      "alertCorrelationTab": "Группировка оповещений",
       "fieldAliasesTab": "Сопоставления полей",
       "fieldAliasesSaved": "Псевдонимы полей успешно сохранены",
       "fieldAliasesSaveError": "Не удалось сохранить псевдонимы полей",
@@ -14079,27 +14371,144 @@
     "runsIn": "Выполняется в",
     "recommendedByFieldCoverage": "Рекомендуется на основе покрытия полей в ваших потоках.",
     "listConjunctionAndTwo": "{first} и {last}",
-    "domainOrgMappings": {
-      "title": "Сопоставления доменов и организаций",
-      "subtitle": "Новые пользователи, входящие в систему с подходящим доменом электронной почты, автоматически добавляются в организацию.",
+    "orgDomainMapping": {
+      "tabLabel": "Управление доменами",
+      "tabDesc": "Привязывайте свои домены электронной почты, сопоставляйте их пользователей с организациями и контролируйте, кто из них может присоединиться.",
+      "loadFailed": "Не удалось загрузить настройки организации",
       "addMapping": "Добавить сопоставление",
       "editMapping": "Изменить сопоставление",
-      "empty": "Сопоставлений пока нет. Используйте «{addLabel}», чтобы добавить.",
       "domain": "Домен электронной почты",
-      "domainHelp": "Часть после {at_sign} в адресе электронной почты пользователя.",
+      "domainHelp": "Часть адреса электронной почты пользователя после {at_sign}. Домен привязывается к этой организации и должен быть подтверждён через DNS.",
+      "domainHelpRequest": "Часть адреса электронной почты пользователя после {at_sign}. Домен привязывается к этой организации после того, как OpenObserve одобрит запрос.",
       "organization": "Организация",
-      "organizationPlaceholder": "Идентификатор организации",
-      "organizationHelp": "Идентификатор организации, в которую добавляются подходящие пользователи.",
+      "organizationHelp": "Эта организация или один из участников её группы биллинга.",
       "organizationRequired": "Организация обязательна",
       "baseRole": "Базовая роль",
-      "baseRoleHelp": "Роль, которая назначается подходящим пользователям в этой организации.",
+      "baseRoleHelp": "Роль, назначаемая при добавлении пользователя в эту организацию. Существующие участники сохраняют текущую роль.",
       "roleClaimName": "Claim ролей",
-      "roleClaimNamePlaceholder": "Имя claim, например groups",
-      "roleClaimNameHelp": "Необязательно. Claim токена со списком пользовательских ролей; при каждом входе пользовательские роли в этой организации синхронизируются с ним.",
+      "roleClaimNamePlaceholder": "Название claim, например groups",
+      "roleClaimNameHelp": "Необязательно. Claim в токене SSO со списком пользовательских ролей. При каждом входе через SSO пользовательские роли в этой организации заменяются ролями из claim; роли из claim, которых не существует, пропускаются, если только они не будут созданы.",
       "createMissingRoles": "Создавать роли из claim, которых нет в организации",
-      "duplicateDomain": "Сопоставление для этого домена уже существует",
-      "confirmRemove": "Вы уверены, что хотите удалить сопоставление для {name}?",
-      "deleteTitle": "Удалить сопоставление"
+      "verifyNow": "Подтвердить сейчас",
+      "details": "Подробности",
+      "detailsDialogTitle": "Сведения о привязке для {domain}",
+      "approvedLinkInfo": "Привязка выполнена OpenObserve после запроса на привязку. DNS-запись не требуется.",
+      "pendingRequestInfo": "OpenObserve рассматривает этот запрос. До одобрения ничего делать не нужно.",
+      "rejectedRequestInfo": "Запрос отклонён OpenObserve.",
+      "verifyDialogTitle": "Проверить {domain}",
+      "recordDialogTitle": "DNS-запись для {domain}",
+      "lastCheckFailed": "Последняя проверка не удалась: {reason}",
+      "state": {
+        "pending": "Ожидает",
+        "verified": "Подтверждён",
+        "failed": "Ошибка",
+        "requested": "Ожидает одобрения",
+        "approved": "Одобрен",
+        "rejected": "Отклонён"
+      },
+      "saved": "Сопоставление домена сохранено",
+      "saveFailed": "Не удалось сохранить настройки",
+      "linkFailed": "Не удалось привязать домен",
+      "unlinkFailed": "Не удалось отвязать домен",
+      "verifyFailed": "Проверка не удалась",
+      "deleted": "Сопоставление удалено",
+      "deleteTitle": "Удалить сопоставление?",
+      "deleteMappingBody": "Пользователи из {domain} больше не будут добавляться в {org} при входе.",
+      "recordInstructions": "Добавьте эту DNS-запись TXT у вашего DNS-провайдера:",
+      "txtNameLabel": "Имя записи",
+      "txtValueLabel": "Значение записи",
+      "copyTxtName": "Копировать имя записи",
+      "copyTxtValue": "Копировать значение записи",
+      "txtNameCopied": "Имя записи скопировано",
+      "txtValueCopied": "Значение записи скопировано",
+      "verifyHint": "Проверка выполняется автоматически каждые {minutes} мин. Вы также можете проверить сейчас.",
+      "alreadyLinked": "Этот домен уже привязан к этой организации",
+      "failureReason": {
+        "recordMissing": "TXT-запись не найдена",
+        "valueMismatch": "TXT-запись найдена, но значение не совпадает",
+        "dnsFailed": "Ошибка DNS-разрешения"
+      },
+      "pageSubtitle": "Привязывайте домены электронной почты, сопоставляйте их пользователей с организациями и управляйте тем, кто из них может присоединиться.",
+      "linkedTab": "Привязанные домены",
+      "mappingsTab": "Сопоставления",
+      "accessTab": "Заблокированные пользователи",
+      "requestsTab": "Запросы на привязку",
+      "linkDomain": "Привязать домен",
+      "sendRequest": "Отправить запрос",
+      "linkMethod": "Как подтвердить владение",
+      "method": {
+        "dns": "DNS-запись",
+        "approved": "Одобренный запрос",
+        "request": "Запрос на привязку",
+        "dnsTitle": "Добавьте DNS-запись TXT",
+        "dnsDesc": "Проверяется автоматически после публикации записи. Лучший вариант, если вы управляете DNS домена.",
+        "requestTitle": "Запросить привязку у OpenObserve",
+        "requestDesc": "Наша команда рассмотрит запрос и привяжет домен после одобрения."
+      },
+      "searchDomains": "Поиск доменов",
+      "searchMappings": "Поиск по домену или организации",
+      "searchRequests": "Поиск по домену, организации или отправителю запроса",
+      "status": "Статус",
+      "linkedVia": "Связано через",
+      "lastChecked": "Последняя проверка",
+      "linked": "Домен привязан. Добавьте DNS-запись, чтобы подтвердить его.",
+      "verified": "Домен подтверждён",
+      "notVerifiedYet": "DNS-запись пока не найдена. Распространение может занять некоторое время.",
+      "requestSent": "Запрос на привязку отправлен",
+      "requestFailed": "Не удалось отправить запрос на привязку",
+      "keepRecordHint": "Не удаляйте эту запись. Право владения перепроверяется каждые {minutes} минут; если запись отсутствует дольше {grace} минут, домен помечается как нерабочий, и его сопоставления перестают применяться.",
+      "removeDomain": "Удалить домен",
+      "removeTitle": "Удалить домен?",
+      "removeBody": "{domain} будет отвязан от этой организации.",
+      "removeWithMappingsBody": "{domain} будет отвязан от этой организации, и его {count} сопоставление будет удалено. | {domain} будет отвязан от этой организации, и его {count} сопоставления будут удалены.",
+      "removed": "Домен удалён",
+      "domainRequired": "Домен обязателен",
+      "mappingDomainHelp": "Сопоставлять можно только подтверждённые домены.",
+      "createsRoles": "Создаёт роли",
+      "duplicateMapping": "Этот домен уже сопоставлен с указанной организацией",
+      "domainNotVerified": "Не подтверждён",
+      "noVerifiedDomains": "Сопоставления применяются к подтверждённым доменам. Сначала привяжите и подтвердите домен.",
+      "goToLinked": "Привязать домен",
+      "goToLinkedDesc": "Подтвердите домен, которым владеете, прежде чем сопоставлять его пользователей",
+      "enforceTitle": "Удалять пользователей из других организаций",
+      "enforceDesc": "Когда пользователь из сопоставленного домена входит через SSO, он удаляется из всех организаций, кроме этой и входящих в её биллинговую группу.",
+      "enforceConfirmTitle": "Удалять пользователей из других организаций?",
+      "enforceConfirmBody": "Каждый раз, когда пользователь, домен электронной почты которого сопоставлен здесь, входит через SSO, он будет удалён из всех организаций, кроме этой и входящих в её биллинговую группу, включая его личные организации.",
+      "enforceConfirmAction": "Включить",
+      "enforceSaved": "Настройка сохранена",
+      "blockUsers": "Блокировать пользователей",
+      "editBlockedUsers": "Изменить заблокированных пользователей",
+      "block": "Блокировать",
+      "blockedCount": "{count} заблокирован | {count} заблокированы",
+      "blockedEmails": "Заблокированные адреса эл. почты",
+      "blocklistDomainHelp": "Один из подтверждённых доменов этой организации.",
+      "blocklistEmailsHelp": "Эти пользователи не могут присоединиться к этой организации или к организациям её биллинговой группы через SSO и будут удалены из них при следующем входе.",
+      "ruleBlockedRequired": "Добавьте хотя бы один адрес эл. почты для блокировки",
+      "noDomainForBlocklist": "У каждого подтверждённого домена уже есть заблокированные пользователи. Чтобы изменить их, отредактируйте строку этого домена.",
+      "unblockAll": "Разблокировать всех",
+      "unblockAllTitle": "Разблокировать всех пользователей?",
+      "unblockAllBody": "Каждый заблокированный пользователь из {domain} сможет снова присоединиться при следующем входе через SSO.",
+      "blocklistSaved": "Заблокированные пользователи сохранены",
+      "blocklistDeleted": "Пользователи разблокированы",
+      "blocklistSection": "Заблокированные пользователи по доменам",
+      "filterPending": "Ожидающие",
+      "filterAll": "Все",
+      "requestedBy": "Запросил",
+      "requestedAt": "Запрошено",
+      "verifiedAt": "Подтверждено",
+      "answeredBy": "Ответил",
+      "reason": "Причина",
+      "reasonHelp": "Показывается организации, создавшей запрос.",
+      "reasonRequired": "Для отклонения запроса необходимо указать причину",
+      "approve": "Одобрить",
+      "reject": "Отклонить",
+      "approveTitle": "Одобрить запрос на привязку?",
+      "rejectTitle": "Отклонить запрос на привязку?",
+      "approveBody": "{domain} будет привязан к {org} без проверки DNS.",
+      "rejectBody": "{org} не получит {domain}.",
+      "requestApproved": "{domain} привязан",
+      "requestRejected": "Запрос для {domain} отклонён",
+      "decisionFailed": "Не удалось обновить запрос"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Пожалуйста, выберите опцию 'Обнаружить на'"
   },
   "search_history": {
-    "title": "История поиска",
+    "title": "История использования и затрат",
     "get_history": "Получить историю",
     "executed_at": "Выполнено в",
     "sql_query": "SQL-запрос",
-    "delayMessage": "История поиска может быть с задержкой на"
+    "delayMessage": "История использования и затрат может задерживаться на"
   },
   "correlation": {
     "unstableDimensionNote": "Нестабильное измерение - изменения при перезапуске пода. По умолчанию: все значения.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Данные актуальны",
     "dataGettingStale": "Данные устаревают",
     "dataStale": "Данные устарели",
-    "lastRefreshed": "Последнее обновление: {time}"
+    "lastRefreshed": "Последнее обновление: {time}",
+    "refresh": "Обновить",
+    "refreshWithAge": "Обновить, последнее обновление {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Ошибка пробы"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "нажатие",
       "actionType": "ввод",
       "all": "Все",
@@ -19868,6 +20280,13 @@
       "attemptN": "Попытка {n}",
       "detailAction": "Действие",
       "detailSelector": "Селектор",
+      "detailStepId": "ID шага",
+      "detailTargetUrl": "Целевой URL",
+      "detailStatus": "Статус",
+      "detailSkipReason": "Причина пропуска",
+      "stepStatusSkipped": "Пропущен",
+      "stepStatusUnknown": "Неизвестно",
+      "skippedCount": "Пропущено: {n}",
       "downloadTrace": "Скачать {filename}",
       "errorFullscreenTitle": "Шаг {id}: {action} - Ошибка",
       "failedAtStartLoad": "Не удалось открыть начальный URL",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Максимум {max}. Повторные попытки выполняются в рамках одного задания, поэтому вся последовательность должна укладываться в бюджет проверки.",
       "retriesMaxBrowserHint": "Максимум {max} для браузерных проверок. Каждая попытка повторно запускает сценарий на каждом устройстве, поэтому большее количество превысило бы тайм-аут зонда и сообщило бы о сбое, которого на вашем сайте не было.",
       "retryDelay": "Ждать",
-      "retryDelaySuffix": "мс между повторными попытками.",
+      "retryDelaySuffix": "секунд между повторами.",
       "schedule": "Расписание",
       "scheduleLater": "Запланировать позже",
       "scheduleLaterTooltip": "Выберите будущую дату и время для активации проверки.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Перезапуск конфигурации — скопируйте команду настройки этого агента, чтобы повторно запустить установку / перезапуск docker (например, после ротации токена).",
         "noAgents": "Для этого местоположения еще не зарегистрировано ни одного агента.",
         "agentsUnavailable": "Агенты этой локации зарегистрированы в другом кластере и здесь не видны.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Проверки, выполняемые из этого местоположения",
         "checkName": "Имя",
         "noChecks": "Для этого местоположения еще не назначено ни одной проверки.",
@@ -20546,7 +20967,7 @@
       "nodes": "Узлы",
       "modelPricing": "Ценообразование моделей",
       "searchSchedulers": "Планировщики поиска",
-      "searchHistory": "История поиска",
+      "searchHistory": "История использования и затрат",
       "sessions": "Сессии",
       "evalTemplates": "Онлайн-оценки — Шаблоны",
       "scorers": "Онлайн-оценки — Оценщики",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Обновить список",
       "alertTemplatesAdd": "Добавить новый шаблон",
       "alertTemplatesRefresh": "Обновить список",
-      "logsSearchHistory": "Открыть историю поиска",
+      "logsSearchHistory": "Открыть историю использования и затрат",
       "alertsImport": "Импортировать оповещение",
       "panelEditorRun": "Выполнить / применить запрос",
       "panelEditorSave": "Сохранить и продолжить редактирование",
@@ -21131,6 +21552,7 @@
         "system": "система"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Работает",
         "passed": "Пройдено",
         "healthy": "Здоров",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Не удалось перейти к оповещению",
       "alertNotFound": "Оповещение не найдено",
-      "alertNotFoundInAlerts": "Оповещение \"{name}\" не найдено среди оповещений ({count})",
       "failedToLoadAlerts": "Не удалось загрузить оповещения",
       "alertsDeletedSuccessfully": "Успешно удалено {count} оповещение | Успешно удалено оповещений: {count}",
       "failedToDeleteAlerts": "Не удалось удалить {count} оповещение | Не удалось удалить оповещений: {count}",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Подождите, идёт загрузка шаблонов...",
       "alertSavedSuccessfully": "Оповещение успешно сохранено.",
       "alertUpdatedSuccessfully": "Оповещение успешно обновлено.",
-      "openingDedupConfig": "Открытие конфигурации дедупликации для: {name}",
       "editingAlert": "Редактирование оповещения: {name}",
       "ack": {
         "acked": "Оповещение {name} подтверждено",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Редактор цен на модели",
     "storageSettings": "Настройки хранилища",
     "domainManagement": "Управление доменами",
+    "orgDomainMapping": "Управление доменами",
     "slackApp": "Slack",
     "regexPatterns": "Шаблоны регулярных выражений",
     "syntheticsLocations": "Локации синтетики",
@@ -26099,7 +26520,7 @@
       "logged": "Зафиксировано"
     },
     "policy": {
-      "gateHint": "Среди изменений существующих оповещений только дедупликация применяется самостоятельно — со снимком прежнего состояния и окном проверки: сохраняется, если проверки проходят, и откатывается, если они не проходят. Всё остальное ожидает одобрения в один клик.",
+      "gateHint": "Среди изменений существующих оповещений только включение подавления повторов применяется автоматически, со снимком предыдущего состояния и окном проверки: сохраняется, если проверки пройдены, и откатывается, если они не пройдены. Все остальное ожидает одобрения одним щелчком.",
       "off": "Выкл.",
       "suggest": "Предлагать",
       "auto": "Авто",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Удерживать вызов до завершения расследования, не более 2 минут. При сбое срабатывает открыто: если триаж завершается по тайм-ауту или с ошибкой, вызов всё равно отправляется с сообщением, что расследование ещё выполняется или завершилось неудачно, а причина приходит в треде."
       },
       "classes": {
-        "EnableDeduplication": "Включить дедупликацию для оповещения, которое повторяется в течение нескольких минут.",
+        "EnableDeduplication": "Включить подавление повторов для оповещения, которое уведомляет при каждой проверке.",
         "CreateDetector": "Создать детектор аномалий по запросам, ошибкам или задержке сервиса.",
         "RaiseThreshold": "Повысить порог, который срабатывает в обычные дни.",
         "LengthenEvaluationWindow": "Увеличить окно оценки оповещения, которое дребезжит.",
@@ -26667,10 +27088,10 @@
           "on": "оповещение о подключениях"
         },
         "L-302": {
-          "done": "Объединил 3 оповещения о задержке checkout в одно",
-          "why": "Они срабатывали вместе в 94% случаев, поэтому одно замедление вызвало 3 вызова.",
-          "from": "3 оповещения",
-          "to": "1",
+          "done": "Включено подавление повторов для 3 оповещений о задержке при оформлении заказа",
+          "why": "Они уведомляли при каждой проверке, пока оставались в состоянии срабатывания, поэтому одно замедление отправило вам 120 вызовов.",
+          "from": "При каждой проверке",
+          "to": "Один раз при изменении",
           "on": "задержка checkout"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "Я вызвал дежурного из-за сбоев платежей в checkout.",
         "recsHeld": "Я отложил мелкую проблему с recommendations до пятничной сводки.",
         "diskApproved": "Вы одобрили повышение порога оповещения о диске на ingest-1 до {to}%.",
-        "latencyGrouped": "Я объединил три оповещения о замедлении checkout в одно, чтобы одно замедление вызывало дежурного один раз.",
+        "latencyGrouped": "Я включил подавление повторов для трёх оповещений о замедлении оформления заказа, поэтому одно замедление отправляет только один вызов.",
         "queueFixed": "Я добавил обработчиков очереди orders, но очередь продолжала расти, поэтому я вернул всё как было и вызвал дежурного.",
         "loginPaged": "Я вызвал дежурного из-за медленного входа в систему.",
         "queuePermission": "Вы разрешили мне самостоятельно добавлять обработчиков очереди, до 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Статус конвейера",
       "legendToggle": "Показать или скрыть этот статус на карте"
     }
+  },
+  "recentSearches": {
+    "title": "Недавние запросы",
+    "aboutKeptDays": "Только ваши запросы в {org}, видны только вам. Хранятся {days} дн.; избранные запросы остаются, пока вы их не удалите. | Только ваши запросы в {org}, видны только вам. Хранятся {days} дн.; избранные запросы остаются, пока вы их не удалите.",
+    "aboutKeptForever": "Только ваши запросы в {org}, видны только вам. Хранятся до удаления.",
+    "pageTitle": {
+      "logs": "Недавние запросы по логам",
+      "traces": "Недавние запросы по трейсам",
+      "metrics": "Недавние запросы по метрикам",
+      "dbm": "Недавние запросы",
+      "profiles": "Недавние запросы"
+    },
+    "page": {
+      "logs": "Логи",
+      "traces": "Трейсы",
+      "metrics": "Метрики",
+      "dbm": "База данных",
+      "profiles": "Профили"
+    },
+    "allPages": "Все страницы",
+    "viewAll": "Просмотреть все",
+    "failedCount": "{count} с ошибкой",
+    "keyHints": "↑↓ — перемещение · PgUp/PgDn — прокрутка запроса · Enter — выполнить · Shift+Enter — только загрузить · Esc — закрыть",
+    "loadToFix": "Загрузить для исправления",
+    "emptyTitle": "Недавних запросов пока нет",
+    "loadError": "Не удалось загрузить недавние запросы",
+    "retry": "Повторить",
+    "warning": "Завершено с предупреждением: тайм-аут или частичные результаты",
+    "failed": "Ошибка",
+    "ranCount": "запущено {count} раз",
+    "lineCount": "{count} строка | {count} строк",
+    "relativeWindow": "Последние {period}",
+    "rerunNow": "Запустить снова сейчас",
+    "rerunOriginal": "На исходное время",
+    "loadOnly": "Загрузить без запуска",
+    "copyLink": "Копировать ссылку",
+    "copyQuery": "Копировать запрос",
+    "star": "В избранное",
+    "unstar": "Убрать из избранного",
+    "linkCopied": "Ссылка скопирована",
+    "queryCopied": "Запрос скопирован",
+    "copyFunction": "Копировать функцию",
+    "functionCopied": "Функция скопирована",
+    "functionLabel": "Функция (VRL)",
+    "searchPlaceholder": "Поиск по запросам и потокам",
+    "allStreams": "Все потоки",
+    "statusAll": "Любой статус",
+    "statusOk": "Успешно",
+    "statusError": "Ошибка",
+    "starredOnly": "Только избранные",
+    "datePlaceholder": "дд/мм/гггг",
+    "filterByDateRun": "Фильтр по дате запуска",
+    "today": "Сегодня",
+    "yesterday": "Вчера",
+    "noMatch": "Нет поисков, соответствующих этим фильтрам",
+    "reset": "Сбросить всё",
+    "resetFilters": "Сбросить фильтры",
+    "loadMore": "Загрузить ещё",
+    "clear": "Очистить мою историю",
+    "confirmClear": "Очистить историю",
+    "clearBodyPage": "Это удалит ваш {count} недавний поиск в разделе {page} в {org}. Сохранённые представления не затронуты. | Это удалит ваши {count} недавних поисков в разделе {page} в {org}. Сохранённые представления не затронуты.",
+    "clearBodyAll": "Это удалит ваш {count} недавний поиск в {org} по логам, трейсам и метрикам. Сохранённые представления не затронуты. | Это удалит ваши {count} недавних поисков в {org} по логам, трейсам и метрикам. Сохранённые представления не затронуты.",
+    "includeStarred": "Также удалить мой {count} избранный поиск | Также удалить мои {count} избранных поисков",
+    "recentRow": "Недавний поиск",
+    "deletedQuery": "Удалено: {query}",
+    "undo": "Отменить"
   }
 }
diff --git a/web/src/locales/languages/tr-TR.json b/web/src/locales/languages/tr-TR.json
index f5a9c4948e..7c02c56012 100644
--- a/web/src/locales/languages/tr-TR.json
+++ b/web/src/locales/languages/tr-TR.json
@@ -486,7 +486,11 @@
       "monitors": "izleyiciler",
       "modelPricing": "model fiyatlandırma tanımları",
       "variables": "değişkenler",
-      "experiments": "Deneyler"
+      "experiments": "Deneyler",
+      "linkedDomains": "bağlantılı alan adları",
+      "domainMappings": "alan adı eşlemeleri",
+      "domainRequests": "bağlantı istekleri",
+      "blockedUsers": "engellenen kullanıcılar"
     },
     "demo": {
       "pageTitle": "Boş durumlar — inceleme için tam set",
@@ -572,6 +576,30 @@
       "action": "Yeni Görev",
       "actionDesc": "OpenObserve'i uç noktanıza yönlendirin ve bağlantıyı test edin."
     },
+    "noLinkedDomains": {
+      "title": "Henüz bağlantılı alan adı yok",
+      "description": "Sahip olduğunuz bir e-posta alan adını bağlayarak kullanıcılarını organizasyonlarınızla eşleyin ve kimlerin oturum açabileceğini kontrol edin.",
+      "dns": "DNS kaydı ekle",
+      "dnsDesc": "Sahipliği bir TXT kaydıyla doğrulayın",
+      "request": "Bağlantı isteyin",
+      "requestDesc": "Alan adını sizin için bağlamasını OpenObserve'dan isteyin"
+    },
+    "noDomainMappings": {
+      "title": "Henüz alan adı eşlemesi yok",
+      "description": "Doğrulanmış bir alan adıyla oturum açan kullanıcıları otomatik olarak bu organizasyona veya faturalandırma grubu üyelerine ekleyin.",
+      "action": "Eşleme ekle",
+      "actionDesc": "Bir alan adı, organizasyon ve rol seçin"
+    },
+    "noBlockedUsers": {
+      "title": "Engellenen kullanıcı yok",
+      "description": "Doğrulanmış alan adlarınızdaki her kullanıcı katılabilir. Belirli kullanıcıları dışarıda tutmak için onları engelleyin.",
+      "action": "Kullanıcıları engelle",
+      "actionDesc": "Engellenecek bir alan adı ve e-posta adreslerini seçin"
+    },
+    "noDomainRequests": {
+      "title": "Bağlantı isteği yok",
+      "description": "Organizasyonların bir alan adını bağlama istekleri burada görünür."
+    },
     "noDowntimes": {
       "title": "Henüz bakım penceresi yok",
       "description": "Bir bakım penceresi; uyarıların, anomali algılamalarının ve sentetik kontrollerin çalışmaya devam etmesini sağlar ve planladığınız bir zaman aralığı boyunca bildirimlerini durdurur.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Canlı modu kapat",
     "autoRefreshWithValue": "Otomatik Yenileme: {value}",
     "searchHistory": "Arama Geçmişi",
+    "usageCostHistory": "Kullanım ve maliyet geçmişi",
     "createScheduledSearch": "Zamanlanmış Arama Oluştur",
     "listScheduledSearch": "Planlanmış Aramayı Listele",
     "scheduleSearchJob": "Arama İşi Planla",
@@ -1355,6 +1384,8 @@
     "scanSize": "Tarama Boyutu",
     "deltaScanSize": "Delta Tarama Boyutu",
     "scannedSoFar": "Taranan: {size}",
+    "quickModeHiddenFields": "Hızlı mod açık. Bu satır {total} alandan {shown} tanesini gösteriyor.",
+    "turnOffQuickMode": "Hızlı modu kapat",
     "resultsProgressLabel": "Arama ilerlemesi",
     "histogramTitleError": "Histogram başlığı oluşturulurken hata.",
     "selectLogStream": "Günlükler akışını seçin",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Bu görünüm için ağ verisi yok",
     "apiEmptyDescription": "Seçilen akışta bu zaman aralığında hiçbir kaynak veya ağ isteği yok. Uygulama HTTP çağrılarını enstrümante ettiğinde ağ metrikleri görünür.",
     "skipInactivity": "Hareketsizliği Atla",
+    "fullScreen": "Tam ekran",
+    "exitFullScreen": "Tam ekrandan çık",
     "error": "Hata",
     "errorCount": "Hata Sayısı",
     "all": "Hepsi",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Bu huniyi bir gösterge panosuna eklemek için ikinci bir adım ekleyin",
         "snapshot": "Panel bu adımları, filtreleri ve adlandırılmış olay kurallarını şu anki halleriyle korur."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Performans genel bakışı",
+      "filterService": "Hizmet",
+      "filterEnv": "Ortam",
+      "filterVersion": "Sürüm",
+      "filterAll": "Tümü",
+      "verdictPass": "Core Web Vitals başarılı",
+      "verdictFail": "Core Web Vitals dikkat gerektiriyor",
+      "verdictAllPass": "Tümü başarılı",
+      "verdictNeedWork": "{count}/{total} iyileştirme gerektiriyor | {count}/{total} iyileştirme gerektiriyor",
+      "percentileLabel": "Yüzdelik",
+      "bandGood": "İyi",
+      "bandNeeds": "İyileştirme gerekli",
+      "bandPoor": "Kötü",
+      "bandGoodPct": "%{n} iyi",
+      "bandNeedsPct": "%{n} iyileştirme gerekli",
+      "bandPoorPct": "%{n} kötü",
+      "bandAria": "%{good} iyi, %{needs} iyileştirme gerekli, %{poor} kötü",
+      "vitalLcp": "En Büyük İçerik Boyaması",
+      "vitalInp": "Sonraki Boyamaya Etkileşim",
+      "vitalCls": "Kümülatif Düzen Kayması",
+      "deltaFaster": "{v} daha hızlı",
+      "deltaSlower": "{v} daha yavaş",
+      "deltaNone": "değişiklik yok",
+      "deltaNoPrev": "yeterli önceki veri yok",
+      "kpiSessions": "Oturumlar",
+      "kpiErrorFree": "Hatasız oturumlar",
+      "kpiErrors": "Toplam hata",
+      "kpiUnhandled": "İşlenmemiş hatalar",
+      "kpiRegion": "Temel göstergeler",
+      "sparkAria": "Seçilen aralıkta {label} eğilimi",
+      "chartTitle": "Oturumlar ve hatalar",
+      "chartInterval": "kova başına",
+      "legendSessions": "Oturumlar",
+      "legendErrors": "Hatalar",
+      "releaseMarker": "{version} ilk kez {time} görüldü",
+      "chartTableToggle": "Veri tablosunu göster",
+      "chartTableHide": "Veri tablosunu gizle",
+      "chartTime": "Zaman",
+      "pagesTitle": "Önce düzeltilecek sayfalar",
+      "pagesHint": "Etkiye göre sıralanır: trafik, bir web vitalı eşiğini aşan veya hata içeren görüntülemelerin payıyla ağırlıklandırılır. Oturumları için bir sayfaya, Hata İzleme için bir hata sayısına tıklayın.",
+      "pagesColPage": "Sayfa",
+      "pagesColViews": "Görüntülemeler",
+      "pagesColErrors": "Hatalar",
+      "pagesColImpact": "Etki",
+      "pagesLegend": "▲ iyileştirme gerekli · ■ kötü · işaretsiz iyi. {n} görüntülemenin altındaki sayfalar gizlenir.",
+      "pagesOpenSessions": "{path} için oturumları aç",
+      "pagesOpenErrors": "{count} hata, Hata İzleme'yi aç | {count} hata, Hata İzleme'yi aç",
+      "pagesImpactAria": "Etki 100 üzerinden {n}",
+      "markNeeds": "iyileştirme gerekli",
+      "markPoor": "kötü",
+      "diffTitle": "En büyük fark",
+      "diffBody": "INP p75 {inp}, diğer segmentlerin {ratio} katı. Araştırılacak bir ilişki, kanıtlanmış bir neden değil.",
+      "diffNone": "Bu aralıkta diğerlerinden öne çıkan bir segment yok.",
+      "diffLink": "Etkilenen oturumları görüntüle",
+      "segmentLabel": "Segment",
+      "segBrowser": "Tarayıcı",
+      "segDevice": "Cihaz",
+      "segCountry": "Ülke",
+      "segInp": "INP {v}",
+      "segShare": "Görüntülemelerin %{n} kadarı",
+      "segNone": "Bu segment için veri yok.",
+      "releaseTitle": "Sürüm karşılaştırması",
+      "releaseHint": "{cur}, {prev} ile karşılaştırılıyor. Sürüm başlangıcı, bir sürümün ilk kez görüldüğü zamandır.",
+      "releaseMetric": "Metrik",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Hatasız",
+      "releaseSessions": "Oturumlar",
+      "releaseLink": "{version} sürümündeki hatalar",
+      "frustrationTitle": "Kullanıcı hayal kırıklığı",
+      "frustrationHint": "Temel metriklerin yakalayamadığı sıkıntılar",
+      "rageClicks": "Öfke tıklamaları",
+      "deadClicks": "Ölü tıklamalar",
+      "stateLoading": "{panel} yükleniyor…",
+      "stateEmptyTitle": "Bu aralıkta sayfa görüntülemesi yok",
+      "stateEmptyBody": "Zaman aralığını genişletin, bir filtreyi temizleyin veya tarayıcı SDK'sının görüntüleme olayları gönderdiğini kontrol edin.",
+      "stateEmptyAction": "SDK'yı ayarlayın",
+      "stateLowTitle": "Yalnızca {count} sayfa görüntülemesi | Yalnızca {count} sayfa görüntülemesi",
+      "stateLowBody": "{min} görüntülemenin altında yüzdelikler güvenilmez olur, bu nedenle sonuç gizlenir. Değerler referans olarak gösterilir.",
+      "stateErrorTitle": "{panel} yüklenemedi",
+      "stateErrorBody": "Sorgu başarısız oldu veya zaman aşımına uğradı. Diğer paneller etkilenmez.",
+      "retry": "Yeniden dene",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "temel göstergeler",
+      "panelPages": "sayfalar",
+      "panelSegments": "segmentler",
+      "panelRelease": "sürüm karşılaştırması",
+      "panelFrustration": "kullanıcı hayal kırıklığı",
+      "schemaErrorTitle": "RUM şeması yüklenemedi",
+      "schemaErrorBody": "Akış alanları okunamadı, bu nedenle genel bakış hangi panellerin gösterileceğine karar veremiyor.",
+      "pagesShowAll": "Tüm {n} sayfayı göster",
+      "pagesShowFewer": "Daha az sayfa göster",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Yeterli görüntülemeye sahip sayfa yok",
+      "pagesEmptyBody": "Sayfaların sıralanabilmesi için bu aralıkta en az {n} görüntüleme gerekir.",
+      "segEmptyTitle": "Segment verisi yok",
+      "segEmptyBody": "Bu görüntülemeler için tarayıcı, cihaz, işletim sistemi, ülke veya bağlantı değerleri kaydedilmedi.",
+      "releaseEmptyTitle": "İki sürüm gerekli",
+      "releaseEmptyBody": "Sürüm karşılaştırması için bu aralıkta en az iki sürümün görülmesi gerekir.",
+      "releaseBefore": "{version} bu aralıktan önce zaten canlıydı; bu nedenle ilk görülme zamanı gösterilmiyor.",
+      "pageErrorTitle": "Performans genel bakışı yüklenemedi",
+      "pageErrorBody": "Sorgular başarısız oldu veya zaman aşımına uğradı. Tüm panelleri yeniden yüklemek için tekrar deneyin.",
+      "verdictOver": "{vital}, sayfa görüntülemelerinin %{pct} kadarı için {threshold} iyi eşiğinin üzerinde.",
+      "verdictAllThree": "Core Web Vitals'ın üçü de p75'te başarılı.",
+      "verdictAllSome": "Değerlendirilen {n} Core Web Vitals'ın tamamı p75'te başarılı.",
+      "releaseNewErrors": "{count} yeni hata bu sürümde | {count} yeni hata bu sürümde",
+      "verdictNoData": "Core Web Vitals verisi yok",
+      "verdictNoDataLead": "Bu aralıktaki {count} sayfa görüntülemesinin hiçbiri LCP, INP veya CLS bildirmedi. | Bu aralıktaki {count} sayfa görüntülemesinin hiçbiri LCP, INP veya CLS bildirmedi.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Oturumları aç.",
+      "pagesTableLabel": "Etkiye göre sıralanan sayfalar",
+      "verdictSessions": "Bu aralıkta {count} oturum. | Bu aralıkta {count} oturum.",
+      "verdictCompare": "Önceki dönemle karşılaştırıldı.",
+      "deltaLower": "{v} daha düşük",
+      "deltaHigher": "{v} daha yüksek",
+      "forbiddenTitle": "{panel} görüntülemek için izin yok",
+      "forbiddenBody": "RUM veri akışına erişim için bir yöneticiye başvurun.",
+      "pageForbiddenTitle": "Performans genel bakışını görüntülemek için izin yok",
+      "asideLabel": "Nerede ve ne değişti",
+      "pagesAbout": "Bu sıralama hakkında",
+      "chartPerFiveMinutes": "5 dakikada bir",
+      "chartPerThirtyMinutes": "30 dakikada bir",
+      "chartPerHour": "saatte bir",
+      "chartPerSixHours": "6 saatte bir",
+      "chartPerDay": "günde bir",
+      "chartIntervalOther": "kova başına",
+      "chartTableCaption": "Kova başına oturumlar ve hatalar",
+      "deltaChange": "{delta} önceki döneme göre",
+      "deltaChangePts": "{delta} puan önceki döneme göre",
+      "deltaFlat": "Önceki döneme göre değişiklik yok",
+      "deltaNewMsg": "Önceki döneme göre yeni",
+      "verdictP75Note": "Karar her zaman p75 kullanır; p50 ve p95 yalnızca değerleri değiştirir.",
+      "releaseNote": "Sürüm filtresi ne olursa olsun en son iki sürümü karşılaştırır.",
+      "kpiEmptyTitle": "Bu aralıkta oturum yok",
+      "kpiEmptyBody": "Zaman aralığını genişletin veya bir filtreyi temizleyin.",
+      "releaseImproved": "iyileşti",
+      "releaseWorse": "kötüleşti",
+      "segOs": "İşletim Sistemi",
+      "segConnection": "Bağlantı",
+      "pagesAllLink": "Tüm sayfalar",
+      "pagesAllLinkAria": "Ürün Analitiği'ndeki tüm sayfalar",
+      "frustrationReplayLink": "Bir tekrarı izle",
+      "frustrationReplayHint": "Bu aralıkta hayal kırıklığı yaşanan oturumları açar; kaydedilenlerin tekrarı bulunur.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "Bu aralıkta hiçbir şey kaydedilmedi. Zaman aralığını genişletin veya bu uygulama henüz veri göndermediyse tarayıcı SDK'sını kurun.",
+      "stateEmptyFiltered": "Bu aralıkta bu filtrelerle eşleşen hiçbir şey yok. Tüm hizmetleri, ortamları ve sürümleri görmek için filtreleri temizleyin.",
+      "clearFilters": "Filtreleri temizle",
+      "stateRefreshing": "{panel} yenileniyor",
+      "tileOpenSessions": "{label}: {value}. Oturumları Aç",
+      "tileOpenErrors": "{label}: {value}. Hata İzlemeyi Aç",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Bu genel bakış yalnızca tarayıcı oturumlarını sayar. Mobil uygulama metrikleri aşağıdadır.",
+      "mixedMobileNote": "Aşağıdaki filtreler yalnızca mobil uygulama metrikleri için geçerlidir."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Sil",
     "confirmDeleteHead": "Kullanıcıyı Sil",
     "confirmDeleteMsg": "{name} kullanıcısını silmek istediğinizden emin misiniz?",
+    "block": "Engelle",
+    "confirmBlockHead": "Kullanıcıyı Engelle",
+    "confirmBlockMsg": "{email} doğrulanmış alan adınız üzerinden katıldı. Engelleme, kullanıcıyı bu organizasyonun alan adı kısıtlamalarına ekler ve bu organizasyondan kaldırır. Diğer eşlenmiş organizasyonlardan bir sonraki oturum açışında kaldırılır.",
     "cancel": "İptal",
     "save": "Kaydet",
     "ok": "Tamam.",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Davetiyeyi İptal Et",
     "revokeInvitationMsg": "{email} davetini iptal etmek istediğinizden emin misiniz?",
     "deleteUsersTitle": "Kullanıcıları Sil",
-    "deleteUsersMsg": "Bu {count} kullanıcıyı silmek istediğinize emin misiniz? | Bu {count} kullanıcıyı silmek istediğinize emin misiniz?"
+    "deleteUsersMsg": "Bu {count} kullanıcıyı silmek istediğinize emin misiniz? | Bu {count} kullanıcıyı silmek istediğinize emin misiniz?",
+    "deleteUsersBlockNote": "Bunlardan {count} tanesi doğrulanmış alan adınız üzerinden katıldı ve silinmek yerine engellenecek."
   },
   "invitation": {
     "pendingInvitations": "Bekleyen Davetiyeler",
@@ -3403,8 +3597,6 @@
       },
       "show": "Göster",
       "searchPermissions": "İzinleri Ara",
-      "filterModules": "Modülleri Filtrele",
-      "noModuleMatch": "Filtrenizle Eşleşen Modül Yok",
       "moduleScopeAll": "Tümü",
       "moduleScopeGranted": "Seçili",
       "noGrantedModule": "Henüz Hiçbir Modül Seçilmedi",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Yetki | Yetkiler",
       "summaryReachSome": "{count} / {total}",
       "summaryEmptyTitle": "Bu Rol Henüz Hiçbir Yetki Vermiyor",
-      "summaryEmptyDescription": "Soldan bir modül seçin veya bir ön ayardan başlayın.",
+      "summaryEmptyDescription": "Bir ön ayardan başlayın veya listeden modüller seçin.",
       "presetReadonlyTitle": "Salt Okunur",
       "presetReadonlyDescription": "Her modülde listeleme ve getirme",
       "presetDbmTitle": "Veritabanı İzleme Görüntüleyicisi",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "{total} Kubernetes metrik akışının hiçbiri henüz bu kuruluşta yok, bu nedenle hiçbir şey önceden seçilmedi.",
       "rumPresetSeeded": "{total} RUM akışından {matched} tanesinde önceden seçilmiş okuma erişimi, ayrıca kaynak haritaları ve mevcut tüm RUM Ürün Analitiği izinleri. Kaydetmeden önce gözden geçirin.",
       "rumPresetNoMatch": "Bu kuruluşta {total} RUM akışının hiçbiri henüz mevcut değil, bu yüzden bunlarda hiçbir şey önceden seçilmedi; kaynak haritaları ve mevcut tüm RUM Ürün Analitiği izinleri yine de hazırlandı.",
-      "moduleGroupFleet": "Filo"
+      "moduleGroupFleet": "Filo",
+      "filterModulesTasks": "Modülleri Filtrele",
+      "noModuleMatchQuery": "“{query}” İle Eşleşen Modül Yok",
+      "noModuleMatchHint": "Modül, grup veya göreve göre arayın; örneğin slack, panel veya token.",
+      "presetAlertManagerTitle": "Uyarı Yöneticisi",
+      "presetAlertManagerDescription": "Uyarıları, gönderildikleri yerleri ve mesajlarını oluşturun ve yönetin",
+      "presetAlertViewerTitle": "Uyarı Görüntüleyicisi",
+      "presetAlertViewerDescription": "Uyarıları, hedefleri ve şablonları değiştirmeden görün",
+      "presetDashboardEditorTitle": "Gösterge Paneli Düzenleyicisi",
+      "presetDashboardEditorDescription": "Sorguladıkları verilere okuma erişimiyle gösterge panoları oluşturun ve düzenleyin",
+      "presetDashboardViewerTitle": "Gösterge Paneli Görüntüleyicisi",
+      "presetDashboardViewerDescription": "Gösterge panolarını açın ve panellerinin arkasındaki verileri okuyun",
+      "presetPipelineEditorTitle": "İşlem Hattı Düzenleyicisi",
+      "presetPipelineEditorDescription": "Akışlara ve zenginleştirme tablolarına okuma erişimiyle işlem hatları ve fonksiyonlar oluşturun",
+      "presetApplied": "{title}: {permissions} eklendi. Kaydetmeden önce değişiklikleri gözden geçirin.",
+      "presetPermissionCount": "{count} izin | {count} izin",
+      "companionReasonAlertStreams": "uyarıları kaydetmek için; sunucu kaydederken akış erişimini denetler",
+      "companionReasonAlertDestinations": "uyarıların nereye gönderileceğini seçmek için",
+      "companionReasonDestinationTemplates": "her hedefin gerektirdiği mesaj şablonunu seçmek için",
+      "companionReasonDashboardStreams": "panel verilerini yüklemek için",
+      "presetsTitle": "Ön Ayarlar",
+      "presetsClose": "Ön Ayarları Kapat",
+      "presetsShow": "Ön Ayarları Göster",
+      "presetsSubtitle": "Bir ön ayarın yetkilerini bu role ekleyin. Hiçbir şey kaldırılmaz.",
+      "presetsSectionBuiltin": "Yerleşik",
+      "presetsSectionJob": "İşe Göre",
+      "presetAddsTooltip": "{count} İzin Ekler | {count} İzin Ekler",
+      "presetInRole": "Rolde Var",
+      "presetInRoleTooltip": "Bu Rolde Bu Ön Ayardaki Her Şey Zaten Var",
+      "presetBack": "Tüm Ön Ayarlar",
+      "presetModuleCount": "{count} modül | {count} modül",
+      "presetSummaryAdds": "{modules} içinde {permissions} ekler.",
+      "presetSummaryWrite": "{modules} içinde yazma erişimi.",
+      "presetSummaryViewOnly": "Yalnızca görüntüleme: hiçbir şey oluşturulamaz, düzenlenemez veya silinemez.",
+      "presetSummaryHasAll": "Bu rolde bu ön ayardaki her şey zaten var.",
+      "presetSummarySkipped": "Bu rolde zaten bulunan {count} izin atlanır. | Bu rolde zaten bulunan {count} izin atlanır.",
+      "presetStillMissing": "Ekledikten sonra hâlâ eksik: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "Ekledikten sonra hiçbir şey eksik kalmaz.",
+      "neededBy": "{modules} için gerekli",
+      "stillNeededBy": "{modules} için hâlâ gerekli",
+      "presetReadsEveryStream": "Bu kuruluştaki tüm akışları okur, yeni olanlar dahil.",
+      "presetAddButton": "{count} İzin Ekle | {count} İzin Ekle",
+      "presetNothingToAdd": "Eklenecek Bir Şey Yok",
+      "presetApplyNote": "Eklenen yetkiler kaydedilmemiş değişiklik olur. Kaydetmeden önce gözden geçirin.",
+      "presetLoadingStreams": "Akışlar Yükleniyor",
+      "presetNoMatchingStreams": "Bu organizasyonda henüz eşleşen akış yok.",
+      "reviewMissingTooltip": "Bu Rolün Çalışması İçin {count} Modül Eksik | Bu Rolün Çalışması İçin {count} Modül Eksik",
+      "notAddedYetTitle": "Henüz Eklenmedi · {modules}",
+      "companionAdd": "Ekle",
+      "companionAddItem": "{item} Ekle",
+      "companionAddAll": "Tümünü Ekle",
+      "companionOpenStreams": "Akışları Aç",
+      "companionOpenStreamsTooltip": "Bu Rolün Hangi Akışları Okuyabileceğini Seçin",
+      "companionNeeds": "{module} buna ihtiyaç duyar: {reason}.",
+      "companionNeedsThis": "{module} bu izne ihtiyaç duyar: {reason}.",
+      "companionStillNeedsThis": "{module} hâlâ bu izne ihtiyaç duyar: {reason}.",
+      "yourChanges": "Değişiklikleriniz",
+      "yourChangesCount": "{modules} içinde {changes}",
+      "yourChangesNone": "Henüz Yok",
+      "changeCount": "{count} değişiklik | {count} değişiklik",
+      "changeOtherGroup": "Diğer",
+      "saveSuccessCounts": "{modules} içinde {changes} kaydedildi.",
+      "effectCan": "{target} için {actions} izni var.",
+      "effectCannot": "{target} için artık {actions} izni yok.",
+      "effectCanLoadDestinations": "Hedef listesini yükleyebilir.",
+      "effectCannotLoadDestinations": "Hedef listesini artık yükleyemez.",
+      "effectCanLoadTemplates": "Şablon listesini yükleyebilir.",
+      "effectCannotLoadTemplates": "Şablon listesini artık yükleyemez.",
+      "verbView": "görüntüleme",
+      "verbSeeListOf": "listede görme",
+      "verbList": "listeleme",
+      "verbOpen": "açma",
+      "verbCreate": "oluşturma",
+      "verbEdit": "düzenleme",
+      "verbDelete": "silme",
+      "targetEveryStream": "her akış (günlükler, metrikler, izler ve dizinler), yeniler dahil",
+      "targetTypeStreams": "tüm {type} akışları",
+      "targetOneStream": "{name} {type} akışı",
+      "targetAlertsEveryFolder": "her klasördeki uyarılar, yeni klasörler dahil",
+      "targetAlertsInFolder": "{name} klasöründeki uyarılar",
+      "targetOneAlert": "{name} uyarısı",
+      "targetDashboardsEveryFolder": "her klasördeki gösterge panoları, yeni klasörler dahil",
+      "targetDashboardsInFolder": "{name} klasöründeki gösterge panoları",
+      "targetOneDashboard": "{name} gösterge panosu",
+      "targetReportsEveryFolder": "her klasördeki raporlar, yeni klasörler dahil",
+      "targetReportsInFolder": "{name} klasöründeki raporlar",
+      "targetOneReport": "{name} raporu",
+      "targetEveryDestination": "her uyarı hedefi (Slack, e-posta, webhook'lar), yeniler dahil",
+      "targetOneDestination": "{name} hedefi",
+      "targetEveryTemplate": "her bildirim şablonu, yeniler dahil",
+      "targetOneTemplate": "{name} şablonu",
+      "targetAllOf": "tüm {module}, yeniler dahil",
+      "targetItemIn": "{module} içindeki {name}",
+      "noteDestinationsFiltered": "Yalnızca açabildikleri hedefleri görürler. Hangilerini göreceklerini seçmek için buraya veya tek tek hedeflere “Getir” ekleyin.",
+      "noteTemplatesFiltered": "Yalnızca açabildikleri şablonları görürler. Hangilerini göreceklerini seçmek için buraya veya tek tek şablonlara “Getir” ekleyin.",
+      "presetStreamsFailed": "Akış listesi yüklenemedi.",
+      "presetRetry": "Tekrar Dene",
+      "presetRestored": "{title}: {permissions} geri yüklendi. Kaydetmeden önce değişiklikleri gözden geçirin.",
+      "presetSummaryRestores": "Kaldırılmak üzere işaretlediğiniz {count} izni korur. | Kaldırılmak üzere işaretlediğiniz {count} izni korur.",
+      "presetRestoreButton": "{count} İzni Koru | {count} İzni Koru",
+      "effectStillAllowed": "Erişim değişikliği yok: daha geniş bir yetki buna hâlâ izin veriyor."
     },
     "rolesPage": {
       "subtitle": "Rol paketi izinleri — erişim vermek için bunları Kullanıcılara, Hizmet Hesaplarına veya Gruplara atayın.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Kullanıcı başarıyla güncellendi.",
       "userDeletedSuccess": "Kullanıcı başarıyla silindi.",
       "errorDeletingUser": "Kullanıcı silinirken hata oluştu.",
+      "userBlockedSuccess": "Kullanıcı başarıyla engellendi.",
+      "errorBlockingUser": "Kullanıcı engellenirken hata oluştu.",
+      "blockedButNotRemoved": "Kullanıcı engellendi ancak bu organizasyondan kaldırılamadı.",
+      "blockedUsersSuccess": "{count} kullanıcı başarıyla engellendi | {count} kullanıcı başarıyla engellendi",
+      "blockedUsersPartial": "{count} kullanıcı engellendi ve kaldırıldı, ancak {failed} kullanıcı bu organizasyondan kaldırılamadı | {count} kullanıcı engellendi ve kaldırıldı, ancak {failed} kullanıcı bu organizasyondan kaldırılamadı",
+      "blockedUsersNotRemoved": "{count} kullanıcı engellendi, ancak bu organizasyondan kaldırılamadı | {count} kullanıcı engellendi, ancak bu organizasyondan kaldırılamadı",
       "pleaseWait": "Lütfen bekleyin...",
       "invitationRevokedSuccess": "Davet başarıyla iptal edildi.",
       "errorRevokingInvitation": "Davet iptal edilirken hata oluştu.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "İzler eBPF ile yakalanır: kod değişikliği veya SDK gerekmez. İz bağlamı servisler arasında yalnızca düz metin HTTP üzerinden taşınır (Go uygulamalarında, kernel lockdown olan düğümler dışında HTTPS üzerinden de). Bağlantı noktalarından, yürütülebilir dosya yolundan veya komut satırından herhangi biriyle eşleşen bir süreç izlenir; glob'lar `,`, `{'{'}` veya `{'}'}` içeremez ve bir bağlantı noktası, üzerinde soketi olan her süreçle eşleşir. Helm 3.14+ ve OpenTelemetry operatörü v0.142.0+ gerekir; sizinki daha eskiyse önce `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml` ile yükseltin. eBPF daha eski bir operatörle zaten etkinleştirildiyse komutu `--force` ile yeniden çalıştırın (Helm 4'te `--force-replace`). Yukarıdaki kurulum komutunu yeniden çalıştırmak sürümü sıfırlar ve eBPF'yi kapatır; bu yüzden ardından bu komutu tekrar çalıştırın. `openobserve-collector` ad alanı ayrıcalıklı pod'lara izin vermeli ve düğümler amd64 veya arm64 üzerinde, 5.8+ çekirdekli (veya eBPF geri portlarına sahip RHEL ailesi 4.18) ve BTF destekli Linux çalıştırmalıdır. Zaten kendi izlerini gönderen uygulamaları veya Go `inject-go` sidecar'ını kullanan pod'ları seçmeyin.",
       "k8sEbpfVariant": "eBPF (her dil, kod değişikliği yok)",
       "k8sLibrariesVariant": "Dil kütüphaneleri (otomatik enstrümantasyon)",
+      "k8sNetworkFlowsDesc": "Toplayıcının eBPF DaemonSet'i, her Linux düğümünde **herhangi bir TCP veya UDP protokolü üzerinden iş yükleri arasında gönderilen baytları** kaydeder; buna izlenmeyen veritabanları, önbellekler ve diğer hizmetler de dahildir. Bunlar, kaynak ve hedef sahibi (Deployment, StatefulSet, Node, …) ve ad alanı ile etiketlenmiş olarak `obi_network_flow_bytes` metriği halinde gelir. eBPF izleme açık veya kapalıyken çalışır.",
+      "k8sNetworkFlowsNote": "Helm 3.14+ ve OpenTelemetry operator v0.142.0+ gerektirir. `openobserve-collector` namespace'i ayrıcalıklı pod'lara izin vermeli ve düğümler amd64 veya arm64 üzerinde Linux, çekirdek 5.8+ (veya eBPF geri dönüş yamalarıyla RHEL ailesi 4.18) ve BTF ile çalışmalıdır. eBPF pod'ları ana bilgisayar ağında çalışır ve toplayıcının kendi metrikleri her düğümün `127.0.0.1:8888` adresinde dinler; bu nedenle bu bağlantı noktası orada boş olmalıdır. Zaten ayarladığınız eBPF iz seçicileri korunur. Yukarıdaki kurulum komutunu yeniden çalıştırmak sürümü sıfırlar ve bunu kapatır; bu nedenle bundan sonra bu komutu tekrar çalıştırın. Aynı baytlar birden fazla kez bildirilebilir: düğümler arasındaki trafik her iki düğüm tarafından ve bir Service'e yapılan bağlantı hem Service hem de arkasındaki iş yükü tarafından. eBPF ağ akışları kılavuzu, çift saymadan bunları nasıl sorgulayacağınızı açıklar.",
+      "k8sNetworkFlowsTitle": "Hangi iş yüklerinin birbiriyle konuştuğunu görün: eBPF ağ akışları",
       "k8sInstallerNote": "Bu, cert-manager'ı, OpenTelemetry operatörünü ve OpenObserve toplayıcısını otomatik olarak kurar.",
       "k8sInternalEndpointNote": "Bunu, OpenObserve aynı kümede çalışıyorsa kullanın — trafik asla kümeden dışarı çıkmaz.",
       "k8sTroubleAnnotationA": "Enjeksiyon pod oluşturulurken gerçekleşir, bu nedenle mevcut podlar yeniden başlatılana kadar etkilenmez — `kubectl rollout restart deployment -n my-namespace` komutunu çalıştırın. Notun yerleştiğini `kubectl get ns my-namespace -o yaml` ile doğrulayın ve değerin `openobserve-collector/openobserve-<language>` ile eşleştiğini kontrol edin.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "Kurulum, kabul webhook'u ile ilgili bir hatayla başarısız oluyor",
       "linuxAgentFixBody": "Kurucu, aracıyı bir systemd hizmeti olarak başlatır. Hiçbir şey gelmezse çalıştığını doğrulayın ve kimlik doğrulama veya bağlantı hatası için günlüklerini okuyun:",
       "linuxTracesNote": "İzler eBPF ile yakalanır: kod değişikliği veya SDK gerekmez. Bağlantı noktalarından, yürütülebilir dosya yolundan veya komut satırından herhangi biriyle eşleşen bir süreç izlenir; glob'lar `,`, `{'{'}` veya `{'}'}` içeremez. İzleme, BTF ile Linux 5.8+ (veya eBPF geri portlarına sahip RHEL ailesi 4.18) gerektirir; aracı daha sonra root olarak çalışır. Ana bilgisayar izleme yapamıyorsa kurulum durur ve çalışan aracıya dokunmaz. Aracı daha sonra izleme açıkken başlatılamazsa, **Günlükler ve metrikler** komutunu yeniden çalıştırana veya nedeni düzeltip izlemeyle yeniden çalıştırana kadar — günlükler ve metrikler dahil — devre dışı bırakılır. İzlenen uygulamalar, giden düz metin HTTP isteklerine bir W3C `traceparent` başlığı ekler. Aşağıdaki eBPF izleme kılavuzu HTTPS'i ve yinelenen bayrakları kapsar.",
+      "linuxNetworkFlowsDesc": "Kurulum programını `--network-flows` ile çalıştırarak **bu ana bilgisayarın herhangi bir TCP veya UDP protokolü üzerinden gönderdiği ve aldığı baytları** `obi_network_flow_bytes` metriği olarak bildirin. Her akış, listelediğiniz ağlarla `src_cidr` ve `dst_cidr` olarak etiketlenir, bu nedenle her ana bilgisayara aynı listeyi verin: ana bilgisayar başına bir `/32` girdisi, ana bilgisayardan ana bilgisayara bir harita sağlar.",
+      "linuxNetworkFlowsNote": "Linux 5.8+ (veya eBPF geri dönüş yamalarıyla RHEL ailesi 4.18) ve BTF gerektirir; aracı daha sonra root olarak çalışır. İzleme olsun veya olmasın çalışır, ancak yükleyicinin her çalıştırılması aracının yapılandırmasını değiştirir: izlemeyi açık tutmak için **Günlükler, metrikler ve eBPF izleri** komutundaki `--trace-*` ve `--service-name` bayraklarını ekleyin. Ana bilgisayar eBPF çalıştıramıyorsa kurulum durur ve çalışan aracıya dokunmaz. Ağ yakalama daha sonra başlatılamazsa, **Günlükler ve metrikler** komutunu yeniden çalıştırana veya nedeni düzeltip `--network-flows` ile yeniden çalıştırana kadar aracı devre dışı bırakılır — günlükler ve metrikler de. Aracıyı çalıştıran iki ana bilgisayar arasındaki trafik her biri tarafından bildirilir ve geri döngü trafiği, her iki uçta aynı adres olmadıkça sayılır. Aşağıdaki eBPF ağ akışları kılavuzu etiketleri ve çift saymadan bunları nasıl sorgulayacağınızı açıklar.",
+      "linuxNetworkFlowsTitle": "Hangi ana bilgisayarların birbiriyle konuştuğunu görün: eBPF ağ akışları",
       "linuxTracesVerifyNote": "İzleme açıkken, izlenen bir uygulama bir isteği işlediğinde izler görünür.",
+      "ebpfNetworkFlowsGuideLink": "eBPF ağ akışları kılavuzu",
       "ebpfTracingGuideLink": "eBPF izleme kılavuzu",
       "logsMetricsTracesVariant": "Günlükler, metrikler ve eBPF izleri",
       "logsMetricsVariant": "Günlükler ve metrikler",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Herhangi bir OpenTelemetry dışa aktarıcısını OpenObserve'e yönlendirin — toplayıcı veya SDK, HTTP veya gRPC. Uç noktanız ve token'ınız aşağıda doldurulmuştur.",
       "taglineWindows": "OpenObserve aracısını herhangi bir Windows ana makinesine kurun — Olay Günlüğü, performans sayaçları ve ana makine metrikleri.",
       "testAgain": "Tekrar test et",
+      "networkFlowsHelp": "CIDR veya CIDR=AD girdileri, boşluk olmadan virgülle ayrılmış; her CIDR bir önek uzunluğu gerektirir, ör. 10.0.1.5/32, ve adlar yalnızca harf, rakam, ., _ ve - içerebilir. Hiçbir girdiyle eşleşmeyen adresler etiketsiz bırakılır; 0.0.0.0/0=other IPv4'ün kalanını, ::/0=other6 IPv6'nın kalanını adlandırır.",
+      "networkFlowsLabel": "Etiketlenecek ağlar",
+      "networkFlowsRequired": "En az bir ağ listeleyin: akışlar listelediğiniz ağlarla etiketlenir.",
       "traceCmdHelp": "Python, Node.js ve Java uygulamaları için.",
       "traceCmdLabel": "Komut satırı",
       "traceExeLabel": "Yürütülebilir dosya yolu",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Şunun altındaki hücreleri gizle",
     "heatmapHideBelowTooltip": "Değeri bundan küçük olan hücreler boş bırakılır.",
     "heatmapHideBelowNote": "{value} altındaki hücreler gizlendi",
+    "boxplotWhisker": "Bıyıklar",
+    "boxplotWhiskerMinMax": "Minimumdan maksimuma",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Mesaj alanı",
+    "logsLevelField": "Seviye alanı",
+    "logsTimeField": "Zaman alanı",
+    "htmlPanelFieldTooltip": "Sorgu sonuçlarından sütunu algılamak için boş bırakın",
+    "logsOrder": "Sıra",
+    "logsOrderNewest": "Önce en yeni",
+    "logsOrderOldest": "Önce en eski",
+    "logsOrderTooltip": "Sorgunun döndürdüğü satırları sıralar. Değiştirilmemiş başlangıç sorgusu da bu sırayla getirilir; böylece Önce en eski en erken günlükleri gösterir.",
+    "logsShowTime": "Zamanı göster",
+    "logsWrap": "Satırları kaydır",
+    "logsPrettifyJson": "JSON'u biçimlendir",
     "distributionBucketCount": "Aralık sayısı",
     "distributionBucketSize": "Aralık boyutu",
     "distributionBucketSizeTooltip": "Her aralığın alanın birimlerindeki genişliği. Ayarlandığında aralık sayısının yerine geçer.",
@@ -7822,6 +8145,8 @@
       "gauge": "Gösterge",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Kutu grafiği",
+      "logs": "Günlükler",
       "barGauge": "Çubuk gösterge",
       "distribution": "Dağılım",
       "treemap": "Ağaç haritası",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: {index} konumunda zorunlu argüman eksik",
       "fieldNotAllowedForMetric": "Metrik grafiği için {label} alanına izin verilmez",
       "rawValueSampled": "İlk {count} satıra göre",
+      "addAtMostOneFieldFor": "{label} için en fazla bir alan ekleyin",
+      "boxplotMin": "Min",
+      "boxplotMax": "Maks",
+      "boxplotLowerWhisker": "Alt bıyık",
+      "boxplotUpperWhisker": "Üst bıyık",
+      "boxplotMedian": "Medyan",
+      "boxplotSamples": "Örnekler",
+      "boxplotOutlier": "Aykırı değer",
       "fieldNotAllowedForDistribution": "{label} alanına dağılım grafiğinde izin verilmez",
       "distributionCount": "Sayı",
       "addAtLeastOneFieldFor": "{label} için en az bir alan ekleyin",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Erişim yok",
       "urlHiddenHint": "Bu bağlantının gösterge panosunu görüntüleyemediğiniz için genel URL'si gizlendi.",
       "orgDisabledHint": "Bu kuruluş için herkese açık bağlantılar kapatıldı",
+      "orgDisabledBanner": "Bu kuruluş için herkese açık bağlantılar kapalı olduğundan hiçbir bağlantı sunulmuyor. Bir yönetici bunları yeniden açabilir.",
+      "disabledPaused": "Devre dışı · Duraklatıldı",
       "takeOver": "Devral",
       "takeOverTitle": "Bu bağlantı devralınsın mı?",
       "takeOverBody": "Yayınlayan siz olursunuz. Genel sayfa, görmenize izin verilen içeriği gösterir; bu, öncekinden daha fazla ya da daha az olabilir. URL'ye sahip herkes erişimini korur ve bağlantı hemen etkinleşir.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Grup",
     "wellSubgroup": "Alt grup",
     "wellSize": "Boyut",
+    "wellCategory": "Kategori",
     "value": "Değer"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Tetikleme değerini gözlemlenen kararlı durumdan uzaklaştırın.",
       "lengthenEvaluationWindow": "Değerlendirme penceresini uzat",
       "lengthenEvaluationWindowDesc": "Süreyi genişleterek kısa bir ani yükselişin artık uyarıyı tetiklememesini sağlayın.",
-      "enableDeduplication": "Tekilleştirmeyi etkinleştir",
-      "enableDeduplicationDesc": "Tekilleştirme penceresi içindeki tekrarlanan tetiklenmeleri birleştirin.",
+      "enableDeduplication": "Tekrarları bastırmayı aç",
+      "enableDeduplicationDesc": "Her değerlendirmede değil, durum değişikliği başına bir kez bildir.",
       "reviewForDeletion": "Silme için gözden geçir",
       "reviewForDeletionDesc": "Uyarıyı devre dışı bırakmadan önce sorgunun hâlâ gerçeklikle uyuştuğunu doğrulayın.",
       "fixAlertQuery": "Uyarı sorgusunu düzelt",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "Kuruluş Kimliği",
     "alertCreationTitle": "Uyarı Oluşturma",
     "noAlertsFound": "Uyarı bulunamadı",
-    "suppressedByDeduplication": "Yineleme giderme tarafından bastırıldı",
-    "occurrence": "{count} oluşum | {count} oluşum",
     "groupedNotification": "Gruplanmış bildirim",
     "alertsBatchedTogether": "birlikte gruplanan uyarılar",
-    "notificationSent": "Bildirim gönderildi",
-    "occurrencesDeduplicated": "Yinelenen oluşumlar giderildi",
     "alertExecutionDetails": "Uyarı Çalıştırma Ayrıntıları",
     "evaluationTime": "Değerlendirme Zamanı",
     "queryTime": "Sorgu Zamanı",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "Bitiş: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Zamansal korelasyon",
     "serviceGraphTooltipServiceDependency": "Hizmet bağımlılığı",
-    "totalAlerts": "Toplam Uyarılar",
-    "usingDeduplication": "Tekilleştirme Kullanılıyor",
-    "deduplicationConfiguredTooltip": "Tekilleştirme yapılandırılmış uyarılar",
-    "suppressionRate24h": "Bastırma Oranı (24 saat)",
     "suppressed": "bastırılan /",
-    "total": "toplam",
-    "passedLabel": "Geçti:",
-    "pendingBatches": "Bekleyen Toplu İşlemler",
-    "pendingBatchesTooltip": "Birlikte gruplandırılmayı bekleyen uyarılar",
     "historyTimeline": {
       "firing": "Tetiklenen",
       "ok": "Tamam",
@@ -10089,7 +10413,8 @@
     "endTime": "Bitiş Zamanı",
     "duration": "Süre",
     "retries": "Yeniden Denemeler",
-    "dedup": "Tekilleştirme",
+    "suppression": "Bastırma",
+    "suppressedAsRepeat": "Tekrar olduğu için bastırıldı",
     "validation": {
       "streamTypeRequired": "Akış türü gereklidir.",
       "streamNameRequired": "Akış adı gereklidir.",
@@ -10281,15 +10606,6 @@
     "all": "Hepsi",
     "history": "Uyarı Geçmişi",
     "searcHistory": "Uyarı Adını Girin",
-    "deduplication": {
-      "fingerprintFields": "Benzer uyarıları şuna göre grupla",
-      "fingerprintFieldsHint": "Tekilleştirme için kullanılacak alanları seçin. Sorgu türüne göre otomatik algılama için boş bırakın.",
-      "fingerprintFieldsTooltip": "Uyarıların yinelenen sayılması için hangi alanların eşleşmesi gerektiğini seçin. Örneğin 'hostname' seçmek, aynı ana bilgisayardan gelen uyarıların birlikte gruplanacağı anlamına gelir. Farklı uyarı türleri (ör. Yüksek CPU ve Yüksek Bellek), aynı ana bilgisayardan gelseler bile asla gruplanmaz. Sorgu türünüze göre otomatik algılama için boş bırakın.",
-      "timeWindow": "Zaman Penceresi (dakika)",
-      "timeWindowHint": "Uyarı parmak izlerinin izlenmesi ne kadar sürer. Uyarı süresini kullanmak için boş bırakın.",
-      "timeWindowTooltip": "Uyarı parmak izlerini izleme ve kopyalama süresi. Bu pencerede aynı parmak izine sahip bir uyarı oluşursa, bastırılır. Uyarı değerlendirme süresini kullanmak için boş bırakın.",
-      "fingerprintFieldsHelp": "Sorguya göre otomatik algılama için boş bırakın (SQL: GROUP BY sütunları, PromQL: etiketler, Özel: koşul alanları)"
-    },
     "summary": {
       "scrollToBottom": "En alta kaydır",
       "title": "Özet",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Yapılandırılan koşullar yerine getirildiğinde beni uyarın"
       }
     },
-    "correlation": {
-      "title": "Uyarı Korelasyonu",
-      "description": "Uyarıların kuruluş genelinde nasıl ilişkilendirileceğini ve çoğaltılmasının nasıl yapıldığını yapılandırın. Eşleşen parmak izi değerlerine sahip uyarılar birlikte gruplandırılacaktır.",
-      "semanticFieldNote": "Not: Anlamsal alan eşlemeleri Hizmet Kimliği sekmesinde yapılandırılır.",
-      "enableOrgLevel": "Kuruluş Düzeyinde Tekilleştirmeyi Etkinleştir",
-      "enableOrgLevelTooltip": "Bu kuruluştaki tüm uyarılar için tekilleştirme ve korelasyon özelliklerini etkinleştirin",
-      "enableCrossAlert": "Çapraz Uyarı Tekilleştirmeyi Etkinleştir",
-      "enableCrossAlertTooltip": "Farklı uyarıların aynı parmak izini paylaştıklarında birbirlerinin kopyasını kaldırmasına izin verin",
-      "fingerprintGroups": "Çapraz Uyarı Parmak İzi Grupları",
-      "fingerprintGroupsTooltip": "Çapraz uyarı parmak izi için hangi anlamsal grupların kullanılacağını seçin. Bu boyutlar için aynı değerleri paylaşırlarsa uyarılar çoğaltılır.",
-      "fingerprintGroupsHint": "Çapraz uyarı tekilleştirme için en az bir anlamsal grup seçin",
-      "fingerprintGroupsRequired": "En az bir semantik grup seçilmelidir",
-      "defaultWindow": "Varsayılan Korelasyon Penceresi (dakika)",
-      "defaultWindowTooltip": "Anlamsal alan eşleşmesinin yokluğunda, verilen süreden gelen uyarılar ve veriler ilişkili kabul edilir",
-      "defaultWindowDescription": "Anlamsal alan eşleşmesinin yokluğunda, verilen süreden gelen uyarılar ve veriler ilişkili kabul edilir",
-      "defaultWindowPlaceholder": "Varsayılan olarak uyarı süresini kullan",
-      "cancelButton": "İptal",
-      "saveButton": "Ayarları Kaydet",
-      "settingsSaved": "Kuruluş yinelenen silme ayarları başarıyla kaydedildi",
-      "settingsSaveError": "Ayarlar kaydedilemedi"
-    },
     "placeholders": {
       "typeSomething": "Bir şey yazın",
       "value": "Değer",
       "selectColumn": "Sütun seç",
       "savedFunctions": "Kaydedilen fonksiyonlar",
-      "autoUsesCheckInterval": "Otomatik (kontrol aralığını kullanır)",
       "addTag": "Etiket ekleyip Enter'a basın"
     },
     "steps": {
       "compareWithPast": "Geçmişle karşılaştırın",
-      "deduplication": "Tekilleştirme",
       "advanced": "Gelişmiş"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Uyarıyı ne tetiklemeli",
       "compareWithPast": "Mevcut sonuçları başka bir zaman dilimine ait verilerle karşılaştırın",
       "alertSettings": "Uyarı kurallarınızı belirleyin ve nasıl bilgilendirilmek istediğinizi seçin.",
-      "deduplication": "Benzer uyarıları birlikte gruplandırarak aynı uyarıyı birden çok kez göndermekten kaçının.",
       "advanced": "Bağlam değişkenleri, açıklama ve satır şablonu"
     },
     "failedToFetchHistory": "Uyarı geçmişi alınamadı",
@@ -10399,8 +10691,6 @@
         "closeActions": "Eylemleri kapat",
         "viewAlertHistory": "Uyarı Geçmişini Görüntüle",
         "actionsFor": "Aşağıdakiler için eylemler:",
-        "configureDedup": "Dedup'ı Yapılandır",
-        "configureDedupTooltip": "Bu uyarı için tekilleştirmeyi yapılandırın",
         "editAlert": "Uyarıyı Düzenle",
         "editAlertTooltip": "Uyarı yapılandırmasını düzenle",
         "viewHistory": "Geçmişi Görüntüle",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "yeni \"Çözüldü\" mesajı",
       "keepFiringFor": "Tetiklenmiş kalma süresi",
       "keepFiringForTooltip": "Koşul ortadan kalktıktan sonra düzelmiş sayılmadan önce bu kadar bekleyin. 0 hemen düzelmiş sayar.",
+      "suppressRepeats": "Tekrarları bastır",
+      "suppressRepeatsTooltip": "Uyarı tetiklenmeye başladığında veya seviye değiştirdiğinde bir kez bildir; her değerlendirmede değil. Her sessizlik döneminden sonra hatırlatma almaya devam etmek için kapalı bırakın.",
       "keepFiringForInvalid": "0 veya daha fazla saniye girin",
       "keepFiringForTooLong": "En fazla 86400 saniye (24 saat) girin"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Bu e-posta adresi zaten eklendi",
     "confirmRemoveEmail": "{email} e-postasını kaldırmak istediğinizden emin misiniz?",
     "domainNeedsEmails": "Tüm kullanıcılara izin verilmediğinde '{domain}' alan adı en az bir e-posta adresine sahip olmalıdır",
+    "noAllowedEmailsDenyAll": "Henüz hiçbir e-posta adresine izin verilmediği için {domain} alan adındaki tüm kullanıcılar reddedilir.",
     "domainSettingsSaved": "Etki alanı ayarları başarıyla kaydedildi",
     "errorSavingDomainSettings": "Etki alanı ayarlarını kaydederken hata oluştu",
     "noDomainMessage": "Yapılandırılmış etki alanı yok. Erişimi kısıtlamak için yukarıya alan adlarını ekleyin.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Kaydetmeden önce en az bir kimlik kümesi yapılandırın.",
       "discoveredServicesTab": "Keşfedilen Hizmetler",
       "serviceDiscoveryTab": "Tespit Kuralları",
-      "alertCorrelationTab": "Uyarı Korelasyonu",
       "fieldAliasesTab": "Alan Eşlemeleri",
       "fieldAliasesSaved": "Alan takma adları başarıyla kaydedildi",
       "fieldAliasesSaveError": "Alan takma adları kaydedilemedi",
@@ -14079,16 +14371,16 @@
     "runsIn": "Çalışır",
     "recommendedByFieldCoverage": "Akışlarınızdaki alan kapsamına göre önerilir.",
     "listConjunctionAndTwo": "{first} ve {last}",
-    "domainOrgMappings": {
-      "title": "Alan adı - kuruluş eşlemeleri",
-      "subtitle": "Eşleşen e-posta alan adıyla oturum açan yeni kullanıcılar kuruluşa otomatik olarak eklenir.",
+    "orgDomainMapping": {
+      "tabLabel": "Alan adı yönetimi",
+      "tabDesc": "E-posta alan adlarınızı bağlayın, kullanıcılarını organizasyonlarla eşleyin ve hangilerinin katılabileceğini kontrol edin.",
+      "loadFailed": "Organizasyon ayarları yüklenemedi",
       "addMapping": "Eşleme ekle",
       "editMapping": "Eşlemeyi düzenle",
-      "empty": "Henüz eşleme yok. Eklemek için \"{addLabel}\" kullanın.",
       "domain": "E-posta alan adı",
       "domainHelp": "Kullanıcının e-posta adresinde {at_sign} sonrasındaki kısım.",
+      "domainHelpRequest": "Kullanıcının e-posta adresinde {at_sign} sonrasındaki kısım. OpenObserve isteği onayladığında alan adı bu kuruluşa bağlanır.",
       "organization": "Kuruluş",
-      "organizationPlaceholder": "Kuruluş tanımlayıcısı",
       "organizationHelp": "Eşleşen kullanıcıların ekleneceği kuruluşun tanımlayıcısı.",
       "organizationRequired": "Kuruluş gereklidir",
       "baseRole": "Temel rol",
@@ -14097,9 +14389,126 @@
       "roleClaimNamePlaceholder": "Talep adı, ör. groups",
       "roleClaimNameHelp": "İsteğe bağlı. Kullanıcının özel rollerini listeleyen token talebi; her girişte kullanıcının o kuruluştaki özel rolleri buna göre eşitlenir.",
       "createMissingRoles": "Talepteki, kuruluşta bulunmayan rolleri oluştur",
-      "duplicateDomain": "Bu alan adı için bir eşleme zaten mevcut",
-      "confirmRemove": "{name} için eşlemeyi silmek istediğinizden emin misiniz?",
-      "deleteTitle": "Eşlemeyi Sil"
+      "verifyNow": "Şimdi doğrula",
+      "details": "Ayrıntılar",
+      "detailsDialogTitle": "{domain} için bağlantı ayrıntıları",
+      "approvedLinkInfo": "Bağlantı talebinden sonra OpenObserve tarafından bağlandı. DNS kaydı gerekmez.",
+      "pendingRequestInfo": "OpenObserve bu talebi inceliyor. Onaylanana kadar yapılacak bir şey yok.",
+      "rejectedRequestInfo": "OpenObserve bu talebi reddetti.",
+      "verifyDialogTitle": "{domain} doğrula",
+      "recordDialogTitle": "{domain} için DNS kaydı",
+      "lastCheckFailed": "Son kontrol başarısız oldu: {reason}",
+      "state": {
+        "pending": "Beklemede",
+        "verified": "Doğrulandı",
+        "failed": "Başarısız",
+        "requested": "Onay bekleniyor",
+        "approved": "Onaylandı",
+        "rejected": "Reddedildi"
+      },
+      "saved": "Alan adı eşlemesi kaydedildi",
+      "saveFailed": "Ayarlar kaydedilemedi",
+      "linkFailed": "Alan adı bağlanamadı",
+      "unlinkFailed": "Alan adının bağlantısı kaldırılamadı",
+      "verifyFailed": "Doğrulama başarısız oldu",
+      "deleted": "Eşleme kaldırıldı",
+      "deleteTitle": "Eşlemeyi Sil",
+      "deleteMappingBody": "{domain} alan adından gelen kullanıcılar oturum açtıklarında artık {org} kuruluşuna eklenmeyecek.",
+      "recordInstructions": "Bu DNS TXT kaydını DNS sağlayıcınızda ekleyin:",
+      "txtNameLabel": "Kayıt adı",
+      "txtValueLabel": "Kayıt değeri",
+      "copyTxtName": "Kayıt adını kopyala",
+      "copyTxtValue": "Kayıt değerini kopyala",
+      "txtNameCopied": "Kayıt adı kopyalandı",
+      "txtValueCopied": "Kayıt değeri kopyalandı",
+      "verifyHint": "Doğrulama her {minutes} dakikada bir otomatik olarak çalışır. Şimdi de doğrulayabilirsiniz.",
+      "alreadyLinked": "Bu alan adı zaten bu kuruluşa bağlı",
+      "failureReason": {
+        "recordMissing": "TXT kaydı bulunamadı",
+        "valueMismatch": "TXT kaydı bulundu ancak değeri eşleşmiyor",
+        "dnsFailed": "DNS çözümlemesi başarısız oldu"
+      },
+      "pageSubtitle": "E-posta alan adlarınızı bağlayın, kullanıcılarını kuruluşlarla eşleyin ve hangilerinin katılabileceğini kontrol edin.",
+      "linkedTab": "Bağlı alan adları",
+      "mappingsTab": "Eşlemeler",
+      "accessTab": "Engellenen kullanıcılar",
+      "requestsTab": "Bağlantı talepleri",
+      "linkDomain": "Alan adı bağla",
+      "sendRequest": "Talep gönder",
+      "linkMethod": "Sahiplik nasıl kanıtlanır",
+      "method": {
+        "dns": "DNS kaydı",
+        "approved": "Onaylanmış talep",
+        "request": "Bağlantı talebi",
+        "dnsTitle": "DNS TXT kaydı ekleyin",
+        "dnsDesc": "Kayıt yayımlandığında otomatik olarak doğrulanır. Alan adının DNS'ini yönettiğinizde en uygunudur.",
+        "requestTitle": "OpenObserve'dan bağlantı talep edin",
+        "requestDesc": "Ekibimiz talebi inceler ve onaylandığında alan adını bağlar."
+      },
+      "searchDomains": "Alan adı ara",
+      "searchMappings": "Alan adı veya kuruluşa göre ara",
+      "searchRequests": "Alan adı, kuruluş veya talep edene göre ara",
+      "status": "Durum",
+      "linkedVia": "Bağlantı yöntemi",
+      "lastChecked": "Son kontrol",
+      "linked": "Alan adı bağlandı. Doğrulamak için DNS kaydını ekleyin.",
+      "verified": "Alan adı doğrulandı",
+      "notVerifiedYet": "DNS kaydı henüz bulunamadı. Yayılması biraz zaman alabilir.",
+      "requestSent": "Bağlantı isteği gönderildi",
+      "requestFailed": "Bağlantı isteği gönderilemedi",
+      "keepRecordHint": "Bu kaydı yerinde tutun. Sahiplik her {minutes} dakikada bir yeniden kontrol edilir; kayıt {grace} dakikadan uzun süre eksik olursa alan adı başarısız olarak işaretlenir ve eşlemeleri uygulanmayı durdurur.",
+      "removeDomain": "Alan adını kaldır",
+      "removeTitle": "Alan adı kaldırılsın mı?",
+      "removeBody": "{domain} bu kuruluşla bağlantısından çıkarılacak.",
+      "removeWithMappingsBody": "{domain} bu kuruluşla bağlantısından çıkarılacak ve {count} eşlemesi kaldırılacak. | {domain} bu kuruluşla bağlantısından çıkarılacak ve {count} eşlemesi kaldırılacak.",
+      "removed": "Alan adı kaldırıldı",
+      "domainRequired": "Alan adı gerekli",
+      "mappingDomainHelp": "Yalnızca doğrulanmış alan adları eşlenebilir.",
+      "createsRoles": "Roller oluşturur",
+      "duplicateMapping": "Bu alan adı zaten o kuruluşla eşlenmiş",
+      "domainNotVerified": "Doğrulanmadı",
+      "noVerifiedDomains": "Eşlemeler doğrulanmış alan adlarına uygulanır. Önce bir alan adı bağlayıp doğrulayın.",
+      "goToLinked": "Alan adı bağla",
+      "goToLinkedDesc": "Kullanıcılarını eşlemeden önce sahip olduğunuz bir alan adını doğrulayın",
+      "enforceTitle": "Kullanıcıları diğer kuruluşlardan çıkar",
+      "enforceDesc": "Eşlenmiş bir alan adından gelen kullanıcı SSO ile oturum açtığında, bu kuruluş ve faturalandırma grubu dışındaki tüm kuruluşlardan çıkarılır.",
+      "enforceConfirmTitle": "Kullanıcılar diğer kuruluşlardan çıkarılsın mı?",
+      "enforceConfirmBody": "E-posta alan adı burada eşlenmiş olan bir kullanıcı SSO ile her oturum açtığında, bu kuruluş ve faturalandırma grubu dışındaki tüm kuruluşlardan, kişisel kuruluşları dahil, çıkarılır.",
+      "enforceConfirmAction": "Etkinleştir",
+      "enforceSaved": "Ayar kaydedildi",
+      "blockUsers": "Kullanıcıları engelle",
+      "editBlockedUsers": "Engellenen kullanıcıları düzenle",
+      "block": "Engelle",
+      "blockedCount": "{count} engellendi | {count} engellendi",
+      "blockedEmails": "Engellenen e-postalar",
+      "blocklistDomainHelp": "Bu kuruluşun doğrulanmış alan adlarından biri.",
+      "blocklistEmailsHelp": "Bu kullanıcılar SSO üzerinden bu kuruluşa veya faturalandırma grubu üyelerine katılamaz ve bir sonraki oturum açışlarında buradan çıkarılır.",
+      "ruleBlockedRequired": "Engellemek için en az bir e-posta ekleyin",
+      "noDomainForBlocklist": "Doğrulanmış her alan adının zaten engellenen kullanıcıları var. Değiştirmek için satırını düzenleyin.",
+      "unblockAll": "Tümünün engelini kaldır",
+      "unblockAllTitle": "Tüm kullanıcıların engeli kaldırılsın mı?",
+      "unblockAllBody": "{domain} alan adından engellenen tüm kullanıcılar bir sonraki SSO oturum açışlarında yeniden katılabilir.",
+      "blocklistSaved": "Engellenen kullanıcılar kaydedildi",
+      "blocklistDeleted": "Kullanıcıların engeli kaldırıldı",
+      "blocklistSection": "Alan adına göre engellenen kullanıcılar",
+      "filterPending": "Beklemede",
+      "filterAll": "Tümü",
+      "requestedBy": "Talep eden",
+      "requestedAt": "Talep edildi",
+      "verifiedAt": "Doğrulandı",
+      "answeredBy": "Yanıtlayan",
+      "reason": "Neden",
+      "reasonHelp": "Talebi oluşturan kuruluşa gösterilir.",
+      "reasonRequired": "Bir talebi reddetmek için bir neden gereklidir",
+      "approve": "Onayla",
+      "reject": "Reddet",
+      "approveTitle": "Bağlantı talebi onaylansın mı?",
+      "rejectTitle": "Bağlantı talebi reddedilsin mi?",
+      "approveBody": "{domain}, DNS kontrolü yapılmadan {org} ile ilişkilendirilecek.",
+      "rejectBody": "{org}, {domain} adresini almayacak.",
+      "requestApproved": "{domain} bağlantılandırıldı",
+      "requestRejected": "{domain} için talep reddedildi",
+      "decisionFailed": "Talep güncellenemedi"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Lütfen tespit zamanı seçeneğini seçin"
   },
   "search_history": {
-    "title": "Arama Geçmişi",
+    "title": "Kullanım ve maliyet geçmişi",
     "get_history": "Geçmişi Getir",
     "executed_at": "İdam Edildi",
     "sql_query": "SQL Sorgu",
-    "delayMessage": "Arama Geçmişi şu şekilde gecikebilir"
+    "delayMessage": "Kullanım ve maliyet geçmişi gecikebilir:"
   },
   "correlation": {
     "unstableDimensionNote": "Kararsız boyut - pod yeniden başlatıldığında değişir. Varsayılan: Tüm değerler.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Veriler taze",
     "dataGettingStale": "Veriler bayatlanıyor",
     "dataStale": "Veriler bayat",
-    "lastRefreshed": "Son yenileme: {time}"
+    "lastRefreshed": "Son yenileme: {time}",
+    "refresh": "Yenile",
+    "refreshWithAge": "Yenile, son yenileme {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Prob hatası"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "tıklama",
       "actionType": "yazma",
       "all": "Tümü",
@@ -19868,6 +20280,13 @@
       "attemptN": "Deneme {n}",
       "detailAction": "Eylem",
       "detailSelector": "Seçici",
+      "detailStepId": "Adım kimliği",
+      "detailTargetUrl": "Hedef URL",
+      "detailStatus": "Durum",
+      "detailSkipReason": "Atlanma nedeni",
+      "stepStatusSkipped": "Atlandı",
+      "stepStatusUnknown": "Bilinmiyor",
+      "skippedCount": "{n} atlandı",
       "downloadTrace": "{filename} indir",
       "errorFullscreenTitle": "Adım {id}: {action} - Hata",
       "failedAtStartLoad": "Başlangıç URL'si açılamadı",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Maksimum {max}. Yeniden denemeler aynı iş içinde çalışır, bu nedenle tüm sıra kontrol bütçesine sığmalıdır.",
       "retriesMaxBrowserHint": "Tarayıcı kontrolleri için maksimum {max}. Her deneme, her cihazda yolculuğu yeniden çalıştırır; bu nedenle daha fazlası denetim zaman aşımını aşar ve sitenizin hiç yaşamadığı bir hatayı raporlar.",
       "retryDelay": "Bekle",
-      "retryDelaySuffix": "Tekrar denemeler arasında ms.",
+      "retryDelaySuffix": "yeniden denemeler arasındaki saniye.",
       "schedule": "Zamanlama",
       "scheduleLater": "Daha sonra planlayın",
       "scheduleLaterTooltip": "Çeki etkinleştirmek için gelecekteki bir tarih ve saat seçin.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Yeniden başlatma yapılandırması — bu aracının kurulum komutunu kopyalayarak kurulumu / docker yeniden başlatmayı tekrar çalıştırın (ör. bir token yenilemesinden sonra)",
         "noAgents": "Bu konum için henüz hiçbir agent kaydolmadı.",
         "agentsUnavailable": "Bu konumdaki ajanlar başka bir kümeye kayıtlı ve burada görünmüyorlar.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Bu konumdan çalışan kontroller",
         "checkName": "Ad",
         "noChecks": "Bu konuma henüz hiçbir kontrol atanmadı.",
@@ -20546,7 +20967,7 @@
       "nodes": "düğümler",
       "modelPricing": "Model Fiyatlandırması",
       "searchSchedulers": "Arama Zamanlayıcıları",
-      "searchHistory": "Arama Geçmişi",
+      "searchHistory": "Kullanım ve maliyet geçmişi",
       "sessions": "Oturumlar",
       "evalTemplates": "Çevrimiçi Değerlendirmeler - Şablonlar",
       "scorers": "Çevrimiçi Değerlendirmeler — Puanlayıcılar",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Listeyi yenile",
       "alertTemplatesAdd": "Yeni şablon ekle",
       "alertTemplatesRefresh": "Listeyi yenile",
-      "logsSearchHistory": "Arama geçmişini aç",
+      "logsSearchHistory": "Kullanım ve maliyet geçmişini aç",
       "alertsImport": "Uyarıyı içe aktar",
       "panelEditorRun": "Sorguyu çalıştır/uygula",
       "panelEditorSave": "Kaydet ve düzenlemeye devam et",
@@ -21131,6 +21552,7 @@
         "system": "sistem"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Aktif",
         "passed": "Geçti",
         "healthy": "Sağlıklı",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Uyarıya gidilemedi",
       "alertNotFound": "Uyarı bulunamadı",
-      "alertNotFoundInAlerts": "Uyarı \"{name}\" {count} uyarı içinde bulunamadı",
       "failedToLoadAlerts": "Uyarılar yüklenemedi",
       "alertsDeletedSuccessfully": "{count} uyarı başarıyla silindi | {count} uyarı başarıyla silindi",
       "failedToDeleteAlerts": "{count} uyarı silinemedi | {count} uyarı silinemedi",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Şablonlar yüklenirken lütfen bekleyin...",
       "alertSavedSuccessfully": "Uyarı başarıyla kaydedildi.",
       "alertUpdatedSuccessfully": "Uyarı başarıyla güncellendi.",
-      "openingDedupConfig": "{name} için tekilleştirme yapılandırması açılıyor",
       "editingAlert": "Uyarı düzenleniyor: {name}",
       "ack": {
         "acked": "{name} onaylandı",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Model Fiyatlandırma Editörü",
     "storageSettings": "Depolama Ayarları",
     "domainManagement": "Alan Adı Yönetimi",
+    "orgDomainMapping": "Alan adı yönetimi",
     "slackApp": "Slack",
     "regexPatterns": "Regex Desenleri",
     "syntheticsLocations": "Sentetik Konumları",
@@ -26099,7 +26520,7 @@
       "logged": "Kaydedildi"
     },
     "policy": {
-      "gateHint": "Mevcut uyarılara yönelik değişiklikler arasında yalnızca yinelenenleri kaldırma kendi başına uygulanır; önceki durumun bir anlık görüntüsü ve bir inceleme süresiyle birlikte: kontrolleri geçerse korunur, başarısız olursa geri alınır. Diğer her şey tek tıklamalı onay bekler.",
+      "gateHint": "Mevcut uyarılardaki değişiklikler arasında yalnızca tekrarları bastırmayı açma işlemi kendiliğinden uygulanır; önceki durumun anlık görüntüsü ve bir inceleme penceresiyle: kontrolleri geçerse korunur, başarısız olursa geri alınır. Diğer her şey tek tıkla onay bekler.",
       "off": "Kapalı",
       "suggest": "Öner",
       "auto": "Otomatik",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Araştırma tamamlanana kadar çağrıyı en fazla 2 dakika bekletir. Hata durumunda açık davranır: triyaj zaman aşımına uğrar veya başarısız olursa yine de çağrı gönderir; araştırmanın hâlâ sürdüğünü veya başarısız olduğunu söyler ve kök neden aynı ileti dizisinde gelir."
       },
       "classes": {
-        "EnableDeduplication": "Dakikalar içinde tekrarlayan bir uyarı için tekilleştirmeyi aç.",
+        "EnableDeduplication": "Her değerlendirmede bildirim gönderen bir uyarı için tekrarları bastırmayı aç.",
         "CreateDetector": "Bir hizmetin istekleri, hataları veya gecikmesi üzerinde anomali dedektörü oluştur.",
         "RaiseThreshold": "Sağlıklı günlerde tetiklenen bir eşiği yükselt.",
         "LengthenEvaluationWindow": "Sürekli açılıp kapanan bir uyarının penceresini uzat.",
@@ -26667,10 +27088,10 @@
           "on": "bağlantı uyarısı"
         },
         "L-302": {
-          "done": "3 checkout gecikme uyarısını tek bir uyarı halinde grupladım",
-          "why": "Zamanın %94'ünde birlikte tetikleniyorlardı, bu yüzden tek bir yavaşlama size 3 kez bildirim gönderdi.",
-          "from": "3 uyarı",
-          "to": "1",
+          "done": "3 checkout gecikmesi uyarısı için tekrarları bastırmayı açtı",
+          "why": "Tetiklenmiş kaldıkları sürece her değerlendirmede bildirim gönderdiler, bu yüzden tek bir yavaşlama size 120 kez çağrı gönderdi.",
+          "from": "Her değerlendirme",
+          "to": "Değişiklik başına bir kez",
           "on": "checkout gecikmesi"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "checkout ödemeleri başarısız kıldığı için nöbetçiye bildirim gönderdim.",
         "recsHeld": "recommendations ile ilgili küçük bir sorunu Cuma günkü özet için beklettim.",
         "diskApproved": "ingest-1'deki disk uyarısını %{to} değerine yükseltmeyi onayladınız.",
-        "latencyGrouped": "Üç checkout yavaşlama uyarısını tek bir uyarıda birleştirdim, böylece tek bir yavaşlama yalnızca bir kez bildirim gönderir.",
+        "latencyGrouped": "Üç checkout yavaşlaması uyarısı için tekrarları bastırmayı açtım, böylece tek bir yavaşlama bir kez çağrı gönderir.",
         "queueFixed": "orders kuyruğuna çalışan ekledim, ama kuyruk büyümeye devam etti; ben de onları geri aldım ve nöbetçiye bildirim gönderdim.",
         "loginPaged": "Yavaş oturum açma hakkında nöbetçiye bildirim gönderdim.",
         "queuePermission": "Kuyruğa kendi başıma, en fazla 8 çalışan eklememe izin verdiniz.",
@@ -28083,5 +28504,71 @@
       "legend": "İşlem hattı durumu",
       "legendToggle": "Bu durumu haritada göster veya gizle"
     }
+  },
+  "recentSearches": {
+    "title": "Son aramalar",
+    "aboutKeptDays": "Yalnızca {org} içindeki aramalarınız, yalnızca size görünür. {days} gün saklanır; yıldızlı aramalar siz kaldırana kadar kalır. | Yalnızca {org} içindeki aramalarınız, yalnızca size görünür. {days} gün saklanır; yıldızlı aramalar siz kaldırana kadar kalır.",
+    "aboutKeptForever": "Yalnızca {org} içindeki aramalarınız, yalnızca size görünür. Silinene kadar saklanır.",
+    "pageTitle": {
+      "logs": "Son günlük aramaları",
+      "traces": "Son iz aramaları",
+      "metrics": "Son metrik aramaları",
+      "dbm": "Son aramalar",
+      "profiles": "Son aramalar"
+    },
+    "page": {
+      "logs": "Günlükler",
+      "traces": "İzler",
+      "metrics": "Metrikler",
+      "dbm": "Veritabanı",
+      "profiles": "Profiller"
+    },
+    "allPages": "Tüm sayfalar",
+    "viewAll": "Tümünü görüntüle",
+    "failedCount": "{count} başarısız",
+    "keyHints": "↑↓ gezin · PgUp/PgDn sorguda kaydır · Enter çalıştır · Shift+Enter yalnızca yükle · Esc kapat",
+    "loadToFix": "Düzeltmek için yükle",
+    "emptyTitle": "Henüz son arama yok",
+    "loadError": "Son aramalar yüklenemedi",
+    "retry": "Yeniden dene",
+    "warning": "Uyarıyla tamamlandı: zaman aşımı veya kısmi sonuçlar",
+    "failed": "Başarısız",
+    "ranCount": "{count} kez çalıştırıldı",
+    "lineCount": "{count} satır | {count} satır",
+    "relativeWindow": "Son {period}",
+    "rerunNow": "Şimdi yeniden çalıştır",
+    "rerunOriginal": "Orijinal zamanda",
+    "loadOnly": "Çalıştırmadan yükle",
+    "copyLink": "Bağlantıyı kopyala",
+    "copyQuery": "Sorguyu kopyala",
+    "star": "Yıldızla",
+    "unstar": "Yıldızı kaldır",
+    "linkCopied": "Bağlantı kopyalandı",
+    "queryCopied": "Sorgu kopyalandı",
+    "copyFunction": "Fonksiyonu kopyala",
+    "functionCopied": "Fonksiyon kopyalandı",
+    "functionLabel": "Fonksiyon (VRL)",
+    "searchPlaceholder": "Sorgu ve akışlarda ara",
+    "allStreams": "Tüm akışlar",
+    "statusAll": "Tüm durumlar",
+    "statusOk": "Başarılı",
+    "statusError": "Başarısız",
+    "starredOnly": "Yalnızca yıldızlı",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "Çalıştırma tarihine göre filtrele",
+    "today": "Bugün",
+    "yesterday": "Dün",
+    "noMatch": "Bu filtrelerle eşleşen arama yok",
+    "reset": "Tümünü sıfırla",
+    "resetFilters": "Filtreleri sıfırla",
+    "loadMore": "Daha fazla yükle",
+    "clear": "Geçmişimi temizle",
+    "confirmClear": "Geçmişi temizle",
+    "clearBodyPage": "Bu, {org} içindeki {count} son {page} aramasını kaldırır. Kaydedilmiş görünümler etkilenmez. | Bu, {org} içindeki {count} son {page} aramasını kaldırır. Kaydedilmiş görünümler etkilenmez.",
+    "clearBodyAll": "Bu, {org} içinde Günlükler, İzler ve Metrikler genelinde {count} son aramanızı kaldırır. Kaydedilmiş görünümler etkilenmez. | Bu, {org} içinde Günlükler, İzler ve Metrikler genelinde {count} son aramanızı kaldırır. Kaydedilmiş görünümler etkilenmez.",
+    "includeStarred": "Ayrıca {count} yıldızlı aramamı da kaldır | Ayrıca {count} yıldızlı aramamı da kaldır",
+    "recentRow": "Son arama",
+    "deletedQuery": "{query} silindi",
+    "undo": "Geri al"
   }
 }
diff --git a/web/src/locales/languages/vi-VN.json b/web/src/locales/languages/vi-VN.json
index 14fd8d82f0..55a4802847 100644
--- a/web/src/locales/languages/vi-VN.json
+++ b/web/src/locales/languages/vi-VN.json
@@ -486,7 +486,11 @@
       "monitors": "giám sát",
       "modelPricing": "định nghĩa giá mô hình",
       "variables": "biến",
-      "experiments": "Thử nghiệm"
+      "experiments": "Thử nghiệm",
+      "linkedDomains": "tên miền đã liên kết",
+      "domainMappings": "ánh xạ tên miền",
+      "domainRequests": "yêu cầu liên kết",
+      "blockedUsers": "người dùng bị chặn"
     },
     "demo": {
       "pageTitle": "Trạng thái trống — bộ đầy đủ để xem xét",
@@ -572,6 +576,30 @@
       "action": "Tác vụ mới",
       "actionDesc": "Trỏ OpenObserve tới endpoint của bạn và kiểm tra kết nối."
     },
+    "noLinkedDomains": {
+      "title": "Chưa có tên miền liên kết",
+      "description": "Liên kết một tên miền email bạn sở hữu để ánh xạ người dùng của tên miền đó vào các tổ chức của bạn và kiểm soát ai có thể đăng nhập.",
+      "dns": "Thêm bản ghi DNS",
+      "dnsDesc": "Xác minh quyền sở hữu bằng bản ghi TXT",
+      "request": "Yêu cầu liên kết",
+      "requestDesc": "Yêu cầu OpenObserve liên kết tên miền cho bạn"
+    },
+    "noDomainMappings": {
+      "title": "Chưa có ánh xạ tên miền",
+      "description": "Tự động thêm người dùng đăng nhập bằng tên miền đã xác minh vào tổ chức này hoặc các thành viên nhóm thanh toán của tổ chức.",
+      "action": "Thêm ánh xạ",
+      "actionDesc": "Chọn tên miền, tổ chức và vai trò"
+    },
+    "noBlockedUsers": {
+      "title": "Chưa có người dùng bị chặn",
+      "description": "Mọi người dùng từ các tên miền đã xác minh của bạn đều có thể tham gia. Hãy chặn người dùng cụ thể để ngăn họ tham gia.",
+      "action": "Chặn người dùng",
+      "actionDesc": "Chọn tên miền và các email cần chặn"
+    },
+    "noDomainRequests": {
+      "title": "Không có yêu cầu liên kết",
+      "description": "Các yêu cầu từ tổ chức về việc liên kết tên miền sẽ xuất hiện ở đây."
+    },
     "noDowntimes": {
       "title": "Chưa có thời gian bảo trì nào",
       "description": "Thời gian bảo trì giữ cho cảnh báo, phát hiện bất thường và kiểm tra Synthetics tiếp tục chạy, đồng thời dừng thông báo của chúng trong khoảng thời gian bạn lên lịch.",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "Tắt Tự động chạy",
     "autoRefreshWithValue": "Tự động làm mới: {value}",
     "searchHistory": "Lịch sử tìm kiếm",
+    "usageCostHistory": "Lịch sử sử dụng & chi phí",
     "createScheduledSearch": "Tạo tìm kiếm theo lịch",
     "listScheduledSearch": "Danh sách tìm kiếm theo lịch",
     "scheduleSearchJob": "Lên lịch công việc tìm kiếm",
@@ -1355,6 +1384,8 @@
     "scanSize": "Kích thước quét",
     "deltaScanSize": "Kích thước quét Delta",
     "scannedSoFar": "Đã quét {size}",
+    "quickModeHiddenFields": "Chế độ nhanh đang bật. Hàng này hiển thị {shown} trên {total} trường.",
+    "turnOffQuickMode": "Tắt chế độ nhanh",
     "resultsProgressLabel": "Tiến độ tìm kiếm",
     "histogramTitleError": "Lỗi khi tạo tiêu đề biểu đồ histogram.",
     "selectLogStream": "Chọn stream nhật ký",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "Không có dữ liệu mạng cho chế độ xem này",
     "apiEmptyDescription": "Stream đã chọn không có yêu cầu tài nguyên hoặc mạng trong khoảng thời gian này. Các chỉ số mạng sẽ xuất hiện sau khi ứng dụng ghi nhận các lệnh gọi HTTP của nó.",
     "skipInactivity": "Bỏ qua không hoạt động",
+    "fullScreen": "Toàn màn hình",
+    "exitFullScreen": "Thoát toàn màn hình",
     "error": "Lỗi",
     "errorCount": "Số lỗi",
     "all": "Tất cả",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "Thêm bước thứ hai để thêm phễu này vào bảng điều khiển",
         "snapshot": "Panel giữ nguyên các bước, bộ lọc và quy tắc sự kiện có tên như hiện tại."
       }
+    },
+    "overviewPage": {
+      "regionLabel": "Tổng quan hiệu suất",
+      "filterService": "Dịch vụ",
+      "filterEnv": "Môi trường",
+      "filterVersion": "Phiên bản",
+      "filterAll": "Tất cả",
+      "verdictPass": "Core Web Vitals đạt",
+      "verdictFail": "Core Web Vitals cần chú ý",
+      "verdictAllPass": "Tất cả đều đạt",
+      "verdictNeedWork": "{count} trong {total} cần cải thiện | {count} trong {total} cần cải thiện",
+      "percentileLabel": "Phân vị",
+      "bandGood": "Tốt",
+      "bandNeeds": "Cần cải thiện",
+      "bandPoor": "Kém",
+      "bandGoodPct": "{n}% tốt",
+      "bandNeedsPct": "{n}% cần cải thiện",
+      "bandPoorPct": "{n}% kém",
+      "bandAria": "{good}% tốt, {needs}% cần cải thiện, {poor}% kém",
+      "vitalLcp": "Largest Contentful Paint",
+      "vitalInp": "Interaction to Next Paint",
+      "vitalCls": "Cumulative Layout Shift",
+      "deltaFaster": "{v} nhanh hơn",
+      "deltaSlower": "{v} chậm hơn",
+      "deltaNone": "không thay đổi",
+      "deltaNoPrev": "không đủ dữ liệu trước đó",
+      "kpiSessions": "Phiên",
+      "kpiErrorFree": "Phiên không lỗi",
+      "kpiErrors": "Tổng số lỗi",
+      "kpiUnhandled": "Lỗi chưa xử lý",
+      "kpiRegion": "Chỉ số chính",
+      "sparkAria": "Xu hướng {label} trong khoảng đã chọn",
+      "chartTitle": "Phiên và lỗi",
+      "chartInterval": "mỗi khoảng",
+      "legendSessions": "Phiên",
+      "legendErrors": "Lỗi",
+      "releaseMarker": "{version} xuất hiện lần đầu lúc {time}",
+      "chartTableToggle": "Hiển thị bảng dữ liệu",
+      "chartTableHide": "Ẩn bảng dữ liệu",
+      "chartTime": "Thời gian",
+      "pagesTitle": "Các trang cần sửa trước",
+      "pagesHint": "Xếp hạng theo tác động: lưu lượng được gia trọng theo tỷ lệ lượt xem có chỉ số quan trọng vượt ngưỡng hoặc có lỗi. Nhấp vào một trang để xem các phiên, nhấp vào số lỗi để mở Theo dõi lỗi.",
+      "pagesColPage": "Trang",
+      "pagesColViews": "Lượt xem",
+      "pagesColErrors": "Lỗi",
+      "pagesColImpact": "Tác động",
+      "pagesLegend": "▲ cần cải thiện · ■ kém · không đánh dấu là tốt. Các trang có dưới {n} lượt xem sẽ bị ẩn.",
+      "pagesOpenSessions": "Mở các phiên cho {path}",
+      "pagesOpenErrors": "{count} lỗi, mở Theo dõi lỗi | {count} lỗi, mở Theo dõi lỗi",
+      "pagesImpactAria": "Tác động {n} trên 100",
+      "markNeeds": "cần cải thiện",
+      "markPoor": "kém",
+      "diffTitle": "Khác biệt lớn nhất",
+      "diffBody": "INP p75 là {inp}, gấp {ratio} lần các phân đoạn khác. Đây là mối tương quan cần điều tra, chứ không phải nguyên nhân đã được chứng minh.",
+      "diffNone": "Không có phân đoạn nào nổi bật so với các phân đoạn khác trong khoảng này.",
+      "diffLink": "Xem các phiên bị ảnh hưởng",
+      "segmentLabel": "Phân đoạn",
+      "segBrowser": "Trình duyệt",
+      "segDevice": "Thiết bị",
+      "segCountry": "Quốc gia",
+      "segInp": "INP {v}",
+      "segShare": "{n}% lượt xem",
+      "segNone": "Không có dữ liệu cho phân đoạn này.",
+      "releaseTitle": "So sánh bản phát hành",
+      "releaseHint": "{cur} so với {prev}. Thời điểm bắt đầu phát hành là lần đầu tiên một phiên bản được ghi nhận.",
+      "releaseMetric": "Chỉ số",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "Không lỗi",
+      "releaseSessions": "Phiên",
+      "releaseLink": "Lỗi trong {version}",
+      "frustrationTitle": "Sự khó chịu của người dùng",
+      "frustrationHint": "Những khó chịu mà các chỉ số không bắt được",
+      "rageClicks": "Nhấp giận dữ",
+      "deadClicks": "Nhấp vô ích",
+      "stateLoading": "Đang tải {panel}…",
+      "stateEmptyTitle": "Không có lượt xem trang nào trong khoảng này",
+      "stateEmptyBody": "Mở rộng khoảng thời gian, xóa bộ lọc hoặc kiểm tra xem SDK trình duyệt có đang gửi sự kiện xem trang hay không.",
+      "stateEmptyAction": "Thiết lập SDK",
+      "stateLowTitle": "Chỉ có {count} lượt xem trang | Chỉ có {count} lượt xem trang",
+      "stateLowBody": "Phân vị không đáng tin cậy khi dưới {min} lượt xem, nên kết luận bị ẩn. Các giá trị được hiển thị để tham khảo.",
+      "stateErrorTitle": "Không thể tải {panel}",
+      "stateErrorBody": "Truy vấn thất bại hoặc hết thời gian. Các panel khác không bị ảnh hưởng.",
+      "retry": "Thử lại",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "các chỉ số chính",
+      "panelPages": "trang",
+      "panelSegments": "phân đoạn",
+      "panelRelease": "so sánh bản phát hành",
+      "panelFrustration": "sự khó chịu của người dùng",
+      "schemaErrorTitle": "Không thể tải lược đồ RUM",
+      "schemaErrorBody": "Không thể đọc các trường của stream, nên trang tổng quan không thể quyết định hiển thị panel nào.",
+      "pagesShowAll": "Hiển thị tất cả {n} trang",
+      "pagesShowFewer": "Hiển thị ít trang hơn",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "Không có trang nào đủ lượt xem",
+      "pagesEmptyBody": "Trang cần ít nhất {n} lượt xem trong khoảng này để được xếp hạng.",
+      "segEmptyTitle": "Không có dữ liệu phân đoạn",
+      "segEmptyBody": "Không có giá trị trình duyệt, thiết bị, hệ điều hành, quốc gia hay kết nối nào được ghi lại cho các lượt xem này.",
+      "releaseEmptyTitle": "Cần hai phiên bản",
+      "releaseEmptyBody": "So sánh phiên bản cần ít nhất hai phiên bản xuất hiện trong khoảng này.",
+      "releaseBefore": "{version} đã hoạt động trước khoảng này, nên không hiển thị thời điểm xuất hiện đầu tiên của nó.",
+      "pageErrorTitle": "Không thể tải tổng quan hiệu năng",
+      "pageErrorBody": "Các truy vấn bị lỗi hoặc quá thời gian. Thử lại để tải lại mọi panel.",
+      "verdictOver": "{vital} vượt ngưỡng tốt {threshold} đối với {pct}% lượt xem trang.",
+      "verdictAllThree": "Cả ba Core Web Vitals đều đạt ở p75.",
+      "verdictAllSome": "Tất cả {n} Core Web Vitals được đánh giá đều đạt ở p75.",
+      "releaseNewErrors": "{count} lỗi mới trong phiên bản này | {count} lỗi mới trong phiên bản này",
+      "verdictNoData": "Không có dữ liệu Core Web Vitals",
+      "verdictNoDataLead": "Không lượt xem trang nào trong số {count} lượt xem trang trong khoảng này báo cáo LCP, INP hoặc CLS. | Không lượt xem trang nào trong số {count} lượt xem trang trong khoảng này báo cáo LCP, INP hoặc CLS.",
+      "bandAtP75": "p75: {band}",
+      "vitalLinkFull": "{vital} {percentile} {value}, {band}, {delta}. Mở phiên.",
+      "pagesTableLabel": "Các trang được xếp hạng theo mức ảnh hưởng",
+      "verdictSessions": "{count} phiên trong khoảng. | {count} phiên trong khoảng.",
+      "verdictCompare": "So với giai đoạn trước.",
+      "deltaLower": "{v} thấp hơn",
+      "deltaHigher": "{v} cao hơn",
+      "forbiddenTitle": "Không có quyền xem {panel}",
+      "forbiddenBody": "Yêu cầu quản trị viên cấp quyền truy cập stream dữ liệu RUM.",
+      "pageForbiddenTitle": "Không có quyền xem tổng quan hiệu năng",
+      "asideLabel": "Thay đổi ở đâu và những gì",
+      "pagesAbout": "Về xếp hạng này",
+      "chartPerFiveMinutes": "mỗi 5 phút",
+      "chartPerThirtyMinutes": "mỗi 30 phút",
+      "chartPerHour": "mỗi giờ",
+      "chartPerSixHours": "mỗi 6 giờ",
+      "chartPerDay": "mỗi ngày",
+      "chartIntervalOther": "mỗi khoảng",
+      "chartTableCaption": "Phiên và lỗi theo mỗi khoảng",
+      "deltaChange": "{delta} so với giai đoạn trước",
+      "deltaChangePts": "{delta} điểm so với giai đoạn trước",
+      "deltaFlat": "Không thay đổi so với giai đoạn trước",
+      "deltaNewMsg": "Mới so với giai đoạn trước",
+      "verdictP75Note": "Kết luận luôn dùng p75; p50 và p95 chỉ thay đổi giá trị.",
+      "releaseNote": "So sánh hai phiên bản mới nhất, bất kể bộ lọc Phiên bản nói gì.",
+      "kpiEmptyTitle": "Không có phiên trong khoảng này",
+      "kpiEmptyBody": "Mở rộng khoảng thời gian hoặc xóa bộ lọc.",
+      "releaseImproved": "cải thiện",
+      "releaseWorse": "xấu hơn",
+      "segOs": "Hệ điều hành",
+      "segConnection": "Kết nối",
+      "pagesAllLink": "Tất cả các trang",
+      "pagesAllLinkAria": "Tất cả các trang trong Phân tích sản phẩm",
+      "frustrationReplayLink": "Xem bản phát lại",
+      "frustrationReplayHint": "Mở các phiên có tín hiệu khó chịu trong khoảng này; những phiên đã được ghi lại thì có bản phát lại.",
+      "diffSegment": "{dim}: {value}",
+      "stateEmptyQuiet": "Không có gì được ghi lại trong khoảng này. Mở rộng khoảng thời gian, hoặc thiết lập SDK trình duyệt nếu ứng dụng này chưa gửi dữ liệu.",
+      "stateEmptyFiltered": "Không có gì khớp với các bộ lọc này trong khoảng này. Xóa bộ lọc để xem mọi dịch vụ, môi trường và phiên bản.",
+      "clearFilters": "Xóa bộ lọc",
+      "stateRefreshing": "Đang làm mới {panel}",
+      "tileOpenSessions": "{label}: {value}. Mở phiên",
+      "tileOpenErrors": "{label}: {value}. Mở theo dõi lỗi",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "Tổng quan này chỉ tính các phiên trình duyệt. Chỉ số ứng dụng di động ở bên dưới.",
+      "mixedMobileNote": "Các bộ lọc bên dưới chỉ áp dụng cho chỉ số ứng dụng di động."
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "Xóa",
     "confirmDeleteHead": "Xóa Người dùng",
     "confirmDeleteMsg": "Bạn có chắc chắn muốn xóa người dùng {name} không?",
+    "block": "Chặn",
+    "confirmBlockHead": "Chặn người dùng",
+    "confirmBlockMsg": "{email} đã tham gia qua tên miền đã xác minh của bạn. Việc chặn sẽ thêm họ vào các hạn chế tên miền của tổ chức này và xóa họ khỏi tổ chức này. Họ sẽ bị xóa khỏi các tổ chức được ánh xạ khác trong lần đăng nhập tiếp theo.",
     "cancel": "Hủy",
     "save": "Lưu",
     "ok": "OK",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "Thu hồi lời mời",
     "revokeInvitationMsg": "Bạn có chắc muốn thu hồi lời mời cho {email}?",
     "deleteUsersTitle": "Xóa người dùng",
-    "deleteUsersMsg": "Bạn có chắc chắn muốn xóa {count} người dùng? | Bạn có chắc chắn muốn xóa {count} người dùng?"
+    "deleteUsersMsg": "Bạn có chắc chắn muốn xóa {count} người dùng? | Bạn có chắc chắn muốn xóa {count} người dùng?",
+    "deleteUsersBlockNote": "{count} trong số họ đã tham gia qua tên miền đã xác minh của bạn và sẽ bị chặn thay vì bị xóa."
   },
   "invitation": {
     "pendingInvitations": "Lời mời đang chờ",
@@ -3403,8 +3597,6 @@
       },
       "show": "Hiển thị",
       "searchPermissions": "Tìm kiếm quyền",
-      "filterModules": "Lọc mô-đun",
-      "noModuleMatch": "Không có mô-đun nào khớp với bộ lọc của bạn",
       "moduleScopeAll": "Tất cả",
       "moduleScopeGranted": "Đã chọn",
       "noGrantedModule": "Chưa có mô-đun nào được chọn",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "Quyền | Quyền",
       "summaryReachSome": "{count} trong {total}",
       "summaryEmptyTitle": "Vai trò này chưa cấp quyền nào",
-      "summaryEmptyDescription": "Chọn một mô-đun ở bên trái hoặc bắt đầu từ một cấu hình sẵn.",
+      "summaryEmptyDescription": "Bắt đầu từ một cấu hình sẵn hoặc chọn mô-đun từ danh sách.",
       "presetReadonlyTitle": "Chỉ đọc",
       "presetReadonlyDescription": "Liệt kê và xem trên mọi mô-đun",
       "presetDbmTitle": "Trình xem giám sát cơ sở dữ liệu",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "Chưa có stream chỉ số Kubernetes nào trong số {total} stream tồn tại trong tổ chức này, nên không có gì được chọn sẵn.",
       "rumPresetSeeded": "Đã chọn trước quyền đọc trên {matched} trong {total} stream RUM, cùng với source map và mọi quyền RUM Product Analytics. Xem lại trước khi lưu.",
       "rumPresetNoMatch": "Chưa có stream RUM nào trong số {total} stream tồn tại trong tổ chức này, nên không có gì được chọn trước trên chúng; source map và mọi quyền RUM Product Analytics vẫn được đưa vào ở trạng thái chờ.",
-      "moduleGroupFleet": "Fleet"
+      "moduleGroupFleet": "Fleet",
+      "filterModulesTasks": "Lọc mô-đun",
+      "noModuleMatchQuery": "Không có mô-đun nào khớp với “{query}”",
+      "noModuleMatchHint": "Tìm theo mô-đun, nhóm hoặc tác vụ, ví dụ slack, panel hoặc token.",
+      "presetAlertManagerTitle": "Trình quản lý cảnh báo",
+      "presetAlertManagerDescription": "Tạo và quản lý cảnh báo, nơi chúng được gửi đến và nội dung thông báo",
+      "presetAlertViewerTitle": "Trình xem cảnh báo",
+      "presetAlertViewerDescription": "Xem cảnh báo, đích và mẫu mà không thay đổi chúng",
+      "presetDashboardEditorTitle": "Trình chỉnh sửa bảng điều khiển",
+      "presetDashboardEditorDescription": "Tạo và chỉnh sửa bảng điều khiển, với quyền đọc dữ liệu mà chúng truy vấn",
+      "presetDashboardViewerTitle": "Trình xem bảng điều khiển",
+      "presetDashboardViewerDescription": "Mở bảng điều khiển và đọc dữ liệu phía sau các panel của chúng",
+      "presetPipelineEditorTitle": "Trình chỉnh sửa pipeline",
+      "presetPipelineEditorDescription": "Tạo pipeline và hàm, với quyền đọc các stream và bảng làm giàu dữ liệu",
+      "presetApplied": "{title}: đã thêm {permissions}. Hãy xem lại thay đổi trước khi lưu.",
+      "presetPermissionCount": "{count} quyền | {count} quyền",
+      "companionReasonAlertStreams": "để lưu cảnh báo. Máy chủ kiểm tra quyền truy cập stream khi lưu",
+      "companionReasonAlertDestinations": "để chọn nơi gửi cảnh báo",
+      "companionReasonDestinationTemplates": "để chọn mẫu tin nhắn mà mọi đích đều yêu cầu",
+      "companionReasonDashboardStreams": "để tải dữ liệu bảng",
+      "presetsTitle": "Cấu hình sẵn",
+      "presetsClose": "Đóng cấu hình sẵn",
+      "presetsShow": "Hiện cấu hình sẵn",
+      "presetsSubtitle": "Thêm các quyền của một cấu hình sẵn vào vai trò này. Không có gì bị xóa.",
+      "presetsSectionBuiltin": "Tích hợp sẵn",
+      "presetsSectionJob": "Theo công việc",
+      "presetAddsTooltip": "Thêm {count} quyền | Thêm {count} quyền",
+      "presetInRole": "Có trong vai trò",
+      "presetInRoleTooltip": "Vai trò này đã có mọi thứ trong cấu hình sẵn này",
+      "presetBack": "Tất cả cấu hình sẵn",
+      "presetModuleCount": "{count} mô-đun | {count} mô-đun",
+      "presetSummaryAdds": "Thêm {permissions} trong {modules}.",
+      "presetSummaryWrite": "Quyền ghi trong {modules}.",
+      "presetSummaryViewOnly": "Chỉ xem: không thể tạo, chỉnh sửa hay xóa gì.",
+      "presetSummaryHasAll": "Vai trò này đã có mọi thứ trong cấu hình sẵn này.",
+      "presetSummarySkipped": "Bỏ qua {count} quyền đã có trong vai trò này. | Bỏ qua {count} quyền đã có trong vai trò này.",
+      "presetStillMissing": "Vẫn còn thiếu sau khi thêm: {list}",
+      "presetMissingItem": "{module}: {actions}",
+      "presetNothingMissing": "Sẽ không thiếu gì sau khi bạn thêm.",
+      "neededBy": "Cần cho {modules}",
+      "stillNeededBy": "Vẫn cần cho {modules}",
+      "presetReadsEveryStream": "Đọc mọi luồng trong tổ chức này, kể cả luồng mới.",
+      "presetAddButton": "Thêm {count} quyền | Thêm {count} quyền",
+      "presetNothingToAdd": "Không có gì để thêm",
+      "presetApplyNote": "Các quyền đã thêm trở thành thay đổi chưa lưu. Hãy xem lại trước khi lưu.",
+      "presetLoadingStreams": "Đang tải stream",
+      "presetNoMatchingStreams": "Chưa có stream phù hợp nào trong tổ chức này.",
+      "reviewMissingTooltip": "Thiếu {count} mô-đun để vai trò này hoạt động | Thiếu {count} mô-đun để vai trò này hoạt động",
+      "notAddedYetTitle": "Chưa thêm · {modules}",
+      "companionAdd": "Thêm",
+      "companionAddItem": "Thêm {item}",
+      "companionAddAll": "Thêm tất cả",
+      "companionOpenStreams": "Mở stream",
+      "companionOpenStreamsTooltip": "Chọn các stream mà vai trò này có thể đọc",
+      "companionNeeds": "{module} cần quyền đó {reason}.",
+      "companionNeedsThis": "{module} cần quyền này {reason}.",
+      "companionStillNeedsThis": "{module} vẫn cần quyền này {reason}.",
+      "yourChanges": "Thay đổi của bạn",
+      "yourChangesCount": "{changes} trong {modules}",
+      "yourChangesNone": "Chưa có",
+      "changeCount": "{count} thay đổi | {count} thay đổi",
+      "changeOtherGroup": "Khác",
+      "saveSuccessCounts": "Đã lưu {changes} trong {modules}.",
+      "effectCan": "Có thể {actions} {target}.",
+      "effectCannot": "Không còn có thể {actions} {target}.",
+      "effectCanLoadDestinations": "Có thể tải danh sách đích.",
+      "effectCannotLoadDestinations": "Không còn có thể tải danh sách đích.",
+      "effectCanLoadTemplates": "Có thể tải danh sách mẫu.",
+      "effectCannotLoadTemplates": "Không còn có thể tải danh sách mẫu.",
+      "verbView": "xem",
+      "verbSeeListOf": "xem trong danh sách",
+      "verbList": "liệt kê",
+      "verbOpen": "mở",
+      "verbCreate": "tạo",
+      "verbEdit": "chỉnh sửa",
+      "verbDelete": "xóa",
+      "targetEveryStream": "mọi stream (nhật ký, chỉ số, trace và chỉ mục), bao gồm cả stream mới",
+      "targetTypeStreams": "tất cả stream {type}",
+      "targetOneStream": "stream {type} {name}",
+      "targetAlertsEveryFolder": "cảnh báo trong mọi thư mục, bao gồm cả thư mục mới",
+      "targetAlertsInFolder": "cảnh báo trong thư mục {name}",
+      "targetOneAlert": "cảnh báo {name}",
+      "targetDashboardsEveryFolder": "bảng điều khiển trong mọi thư mục, bao gồm cả thư mục mới",
+      "targetDashboardsInFolder": "bảng điều khiển trong thư mục {name}",
+      "targetOneDashboard": "bảng điều khiển {name}",
+      "targetReportsEveryFolder": "báo cáo trong mọi thư mục, bao gồm cả thư mục mới",
+      "targetReportsInFolder": "báo cáo trong thư mục {name}",
+      "targetOneReport": "báo cáo {name}",
+      "targetEveryDestination": "mọi đích cảnh báo (Slack, email, webhook), bao gồm cả đích mới",
+      "targetOneDestination": "đích {name}",
+      "targetEveryTemplate": "mọi mẫu thông báo, bao gồm cả mẫu mới",
+      "targetOneTemplate": "mẫu {name}",
+      "targetAllOf": "tất cả {module}, bao gồm cả mục mới",
+      "targetItemIn": "{name} trong {module}",
+      "noteDestinationsFiltered": "Họ chỉ thấy những đích mà họ cũng có thể mở. Thêm “Lấy” tại đây hoặc trên từng đích để chọn những đích nào.",
+      "noteTemplatesFiltered": "Họ chỉ thấy những mẫu mà họ cũng có thể mở. Thêm “Lấy” tại đây hoặc trên từng mẫu để chọn những mẫu nào.",
+      "presetStreamsFailed": "Không thể tải danh sách stream.",
+      "presetRetry": "Thử lại",
+      "presetRestored": "{title}: đã khôi phục {permissions}. Hãy xem lại thay đổi trước khi lưu.",
+      "presetSummaryRestores": "Giữ lại {count} quyền mà bạn đã đánh dấu để xóa. | Giữ lại {count} quyền mà bạn đã đánh dấu để xóa.",
+      "presetRestoreButton": "Giữ lại {count} quyền | Giữ lại {count} quyền",
+      "effectStillAllowed": "Không thay đổi quyền truy cập: một quyền rộng hơn vẫn cho phép điều này."
     },
     "rolesPage": {
       "subtitle": "Vai trò gói quyền — gán chúng cho Người dùng, Tài khoản dịch vụ hoặc Nhóm để cấp quyền truy cập.",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "Cập nhật người dùng thành công.",
       "userDeletedSuccess": "Xóa người dùng thành công.",
       "errorDeletingUser": "Lỗi khi xóa người dùng.",
+      "userBlockedSuccess": "Chặn người dùng thành công.",
+      "errorBlockingUser": "Lỗi khi chặn người dùng.",
+      "blockedButNotRemoved": "Người dùng đã bị chặn nhưng không thể xóa khỏi tổ chức này.",
+      "blockedUsersSuccess": "Đã chặn thành công {count} người dùng | Đã chặn thành công {count} người dùng",
+      "blockedUsersPartial": "Đã chặn và xóa {count} người dùng, nhưng không thể xóa {failed} người dùng khỏi tổ chức này | Đã chặn và xóa {count} người dùng, nhưng không thể xóa {failed} người dùng khỏi tổ chức này",
+      "blockedUsersNotRemoved": "Đã chặn {count} người dùng, nhưng không thể xóa họ khỏi tổ chức này | Đã chặn {count} người dùng, nhưng không thể xóa họ khỏi tổ chức này",
       "pleaseWait": "Vui lòng chờ...",
       "invitationRevokedSuccess": "Thu hồi lời mời thành công.",
       "errorRevokingInvitation": "Lỗi khi thu hồi lời mời.",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "Trace được ghi lại bằng eBPF: không cần thay đổi mã hay SDK. Ngữ cảnh trace chỉ được truyền giữa các dịch vụ qua HTTP văn bản thuần (ứng dụng Go thì cả qua HTTPS, trừ trên node bật kernel lockdown). Một tiến trình khớp với bất kỳ cổng, đường dẫn tệp thực thi hoặc dòng lệnh nào sẽ được trace; glob không thể chứa `,`, `{'{'}` hoặc `{'}'}`, và một cổng khớp với mọi tiến trình có socket trên cổng đó. Cần Helm 3.14+ và OpenTelemetry Operator v0.142.0+; nếu operator của bạn cũ hơn, hãy nâng cấp trước bằng `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml`. Nếu eBPF đã được bật trên operator cũ hơn, hãy chạy lại lệnh với `--force` (`--force-replace` trên Helm 4). Chạy lại lệnh cài đặt ở trên sẽ đặt lại release và tắt eBPF, vì vậy hãy chạy lại lệnh này sau đó. Namespace `openobserve-collector` phải cho phép pod đặc quyền, và các node phải chạy Linux trên amd64 hoặc arm64 với kernel 5.8+ (hoặc họ RHEL 4.18 có backport eBPF) và BTF. Không chọn các ứng dụng đã tự gửi trace, hoặc các pod dùng sidecar Go `inject-go`.",
       "k8sEbpfVariant": "eBPF (mọi ngôn ngữ, không cần sửa mã)",
       "k8sLibrariesVariant": "Thư viện ngôn ngữ (tự động instrument)",
+      "k8sNetworkFlowsDesc": "DaemonSet eBPF của collector ghi lại **số byte được gửi giữa các workload qua bất kỳ giao thức TCP hoặc UDP nào** trên từng node Linux, bao gồm cơ sở dữ liệu, bộ nhớ đệm và các dịch vụ khác không được trace. Chúng đến dưới dạng chỉ số `obi_network_flow_bytes`, được gắn nhãn với chủ sở hữu nguồn và đích (Deployment, StatefulSet, Node, …) và namespace. Hoạt động có hoặc không có trace eBPF.",
+      "k8sNetworkFlowsNote": "Cần Helm 3.14+ và OpenTelemetry operator v0.142.0+. Namespace `openobserve-collector` phải cho phép các pod privileged, và các node phải chạy Linux trên amd64 hoặc arm64 với kernel 5.8+ (hoặc dòng RHEL 4.18 với bản backport eBPF) và BTF. Các pod eBPF chạy trên mạng của host, và các chỉ số của chính collector lắng nghe trên `127.0.0.1:8888` của từng node, nên cổng đó phải trống ở đó. Các selector trace eBPF bạn đã đặt sẽ được giữ nguyên. Chạy lại lệnh cài đặt ở trên sẽ đặt lại bản release và tắt tính năng này, vì vậy hãy chạy lại lệnh này sau đó. Cùng một lượng byte có thể được báo cáo nhiều lần: lưu lượng giữa các node được cả hai node báo cáo, và một kết nối tới một Service được báo cáo ở cả Service lẫn workload phía sau nó. Hướng dẫn eBPF network flows giải thích cách truy vấn chúng mà không bị đếm trùng.",
+      "k8sNetworkFlowsTitle": "Xem những workload nào giao tiếp với nhau: luồng mạng eBPF",
       "k8sInstallerNote": "Thao tác này tự động cài đặt cert-manager, operator OpenTelemetry và collector OpenObserve.",
       "k8sInternalEndpointNote": "Sử dụng tùy chọn này khi OpenObserve chạy trong chính cụm này — lưu lượng không bao giờ rời khỏi cụm.",
       "k8sTroubleAnnotationA": "Việc tiêm xảy ra khi tạo pod, vì vậy các pod hiện tại không bị ảnh hưởng cho đến khi chúng khởi động lại — chạy `kubectl rollout restart deployment -n my-namespace`. Xác nhận chú thích đã được áp dụng bằng `kubectl get ns my-namespace -o yaml`, và kiểm tra giá trị khớp với `openobserve-collector/openobserve-<language>`.",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "Cài đặt thất bại với lỗi về admission webhook",
       "linuxAgentFixBody": "Trình cài đặt khởi động agent như một dịch vụ systemd. Nếu không có gì đến, hãy xác nhận nó đang chạy và đọc nhật ký của nó để tìm lỗi xác thực hoặc kết nối:",
       "linuxTracesNote": "Trace được ghi lại bằng eBPF: không cần thay đổi mã hay SDK. Một tiến trình khớp với bất kỳ cổng, đường dẫn tệp thực thi hoặc dòng lệnh nào sẽ được trace; glob không thể chứa `,`, `{'{'}` hoặc `{'}'}`. Tính năng trace cần Linux 5.8+ (hoặc họ RHEL 4.18 có backport eBPF) với BTF; sau đó agent chạy dưới quyền root. Nếu máy chủ không thể trace, quá trình cài đặt sẽ dừng lại và giữ nguyên agent đang chạy. Nếu sau đó agent không khởi động được khi bật trace, tính năng này sẽ bị tắt — cả nhật ký và chỉ số cũng vậy — cho đến khi bạn chạy lại lệnh **Nhật ký & chỉ số**, hoặc khắc phục nguyên nhân và chạy lại với trace. Các ứng dụng được trace sẽ thêm header `traceparent` W3C vào các yêu cầu HTTP văn bản thuần gửi đi. Hướng dẫn trace eBPF bên dưới đề cập đến HTTPS và các cờ lặp lại.",
+      "linuxNetworkFlowsDesc": "Chạy trình cài đặt với `--network-flows` để báo cáo **số byte máy chủ này gửi và nhận qua bất kỳ giao thức TCP hoặc UDP nào**, dưới dạng chỉ số `obi_network_flow_bytes`. Mỗi luồng được gắn nhãn `src_cidr` và `dst_cidr` bằng các mạng bạn liệt kê, vì vậy hãy cung cấp cho mọi máy chủ cùng một danh sách: một mục `/32` cho mỗi máy chủ sẽ tạo ánh xạ giữa các máy chủ.",
+      "linuxNetworkFlowsNote": "Cần Linux 5.8+ (hoặc dòng RHEL 4.18 với bản backport eBPF) có BTF; khi đó agent chạy dưới quyền root. Nó hoạt động dù có hay không có trace, nhưng mỗi lần chạy trình cài đặt sẽ thay thế cấu hình của agent: để giữ trace bật, hãy thêm các cờ `--trace-*` và `--service-name` từ lệnh **Logs, metrics & eBPF traces**. Nếu host không chạy được eBPF, quá trình cài đặt sẽ dừng và giữ nguyên agent đang chạy. Nếu sau đó việc bắt gói mạng không khởi động được, agent sẽ bị tắt — cả logs và metrics — cho đến khi bạn chạy lại lệnh **Logs & metrics**, hoặc khắc phục nguyên nhân và chạy lại với `--network-flows`. Lưu lượng giữa hai host đều chạy agent sẽ được mỗi host báo cáo, và lưu lượng loopback được tính trừ khi cả hai đầu có cùng địa chỉ. Hướng dẫn eBPF network flows bên dưới giải thích các nhãn và cách truy vấn chúng mà không bị đếm trùng.",
+      "linuxNetworkFlowsTitle": "Xem những máy chủ nào giao tiếp với nhau: luồng mạng eBPF",
       "linuxTracesVerifyNote": "Khi bật theo dõi, trace sẽ xuất hiện ngay khi một ứng dụng được theo dõi xử lý một yêu cầu.",
+      "ebpfNetworkFlowsGuideLink": "Hướng dẫn luồng mạng eBPF",
       "ebpfTracingGuideLink": "Hướng dẫn theo dõi eBPF",
       "logsMetricsTracesVariant": "Nhật ký, chỉ số & trace eBPF",
       "logsMetricsVariant": "Nhật ký và chỉ số",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "Trỏ bất kỳ exporter OpenTelemetry nào đến OpenObserve — collector hoặc SDK, HTTP hoặc gRPC. Endpoint và token của bạn đã được điền bên dưới.",
       "taglineWindows": "Cài đặt agent OpenObserve trên bất kỳ máy chủ Windows nào — Event Log, bộ đếm hiệu suất và chỉ số máy chủ.",
       "testAgain": "Kiểm tra lại",
+      "networkFlowsHelp": "Các mục CIDR hoặc CIDR=NAME, phân tách bằng dấu phẩy và không có dấu cách; mỗi CIDR cần độ dài tiền tố, ví dụ 10.0.1.5/32, và tên chỉ được chứa chữ cái, chữ số, ., _ và -. Các địa chỉ không khớp với mục nào sẽ không được gắn nhãn; 0.0.0.0/0=other đặt tên cho phần còn lại của IPv4, ::/0=other6 đặt tên cho phần còn lại của IPv6.",
+      "networkFlowsLabel": "Mạng cần gắn nhãn",
+      "networkFlowsRequired": "Hãy liệt kê ít nhất một mạng: các luồng được gắn nhãn bằng các mạng bạn liệt kê.",
       "traceCmdHelp": "Dành cho ứng dụng Python, Node.js và Java.",
       "traceCmdLabel": "Dòng lệnh",
       "traceExeLabel": "Đường dẫn tệp thực thi",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "Ẩn ô dưới",
     "heatmapHideBelowTooltip": "Các ô có giá trị nhỏ hơn mức này được để trống.",
     "heatmapHideBelowNote": "Các ô dưới {value} đã bị ẩn",
+    "boxplotWhisker": "Râu",
+    "boxplotWhiskerMinMax": "Từ nhỏ nhất đến lớn nhất",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "Trường thông điệp",
+    "logsLevelField": "Trường mức độ",
+    "logsTimeField": "Trường thời gian",
+    "htmlPanelFieldTooltip": "Để trống để tự phát hiện cột từ kết quả truy vấn",
+    "logsOrder": "Thứ tự",
+    "logsOrderNewest": "Mới nhất trước",
+    "logsOrderOldest": "Cũ nhất trước",
+    "logsOrderTooltip": "Sắp xếp các hàng mà truy vấn trả về. Truy vấn khởi đầu chưa sửa cũng được lấy theo thứ tự này, nên Cũ nhất trước hiển thị các log sớm nhất.",
+    "logsShowTime": "Hiển thị thời gian",
+    "logsWrap": "Ngắt dòng",
+    "logsPrettifyJson": "Định dạng JSON",
     "distributionBucketCount": "Số khoảng",
     "distributionBucketSize": "Kích thước khoảng",
     "distributionBucketSizeTooltip": "Độ rộng của mỗi khoảng theo đơn vị của trường. Khi được đặt, giá trị này thay cho số khoảng.",
@@ -7822,6 +8145,8 @@
       "gauge": "Đồng hồ đo",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "Biểu đồ hộp",
+      "logs": "Nhật ký",
       "barGauge": "Đồng hồ dạng thanh",
       "distribution": "Phân phối",
       "treemap": "Biểu đồ treemap",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: Thiếu đối số bắt buộc tại vị trí {index}",
       "fieldNotAllowedForMetric": "Trường {label} không được phép cho biểu đồ Metric",
       "rawValueSampled": "Dựa trên {count} hàng đầu tiên",
+      "addAtMostOneFieldFor": "Thêm tối đa một trường cho {label}",
+      "boxplotMin": "Nhỏ nhất",
+      "boxplotMax": "Lớn nhất",
+      "boxplotLowerWhisker": "Râu dưới",
+      "boxplotUpperWhisker": "Râu trên",
+      "boxplotMedian": "Trung vị",
+      "boxplotSamples": "Số mẫu",
+      "boxplotOutlier": "Giá trị ngoại lai",
       "fieldNotAllowedForDistribution": "Không cho phép trường {label} trong biểu đồ phân phối",
       "distributionCount": "Số lượng",
       "addAtLeastOneFieldFor": "Thêm ít nhất một trường cho {label}",
@@ -8525,6 +8858,8 @@
       "urlHidden": "Không có quyền truy cập",
       "urlHiddenHint": "Bạn không thể xem bảng điều khiển của liên kết này nên URL công khai của nó bị ẩn.",
       "orgDisabledHint": "Liên kết công khai đã bị tắt cho tổ chức này",
+      "orgDisabledBanner": "Liên kết công khai đã bị tắt cho tổ chức này, vì vậy không có liên kết nào được phục vụ. Quản trị viên có thể bật lại.",
+      "disabledPaused": "Đã tắt · Tạm dừng",
       "takeOver": "Tiếp quản",
       "takeOverTitle": "Tiếp quản liên kết này?",
       "takeOverBody": "Bạn sẽ trở thành người xuất bản. Trang công khai sẽ hiển thị những gì bạn được phép xem, có thể nhiều hơn hoặc ít hơn trước đây. Ai có URL vẫn giữ quyền truy cập, và liên kết hoạt động ngay bây giờ.",
@@ -8784,6 +9119,7 @@
     "wellGroup": "Nhóm",
     "wellSubgroup": "Nhóm con",
     "wellSize": "Kích thước",
+    "wellCategory": "Danh mục",
     "value": "Giá trị"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "Dịch chuyển giá trị kích hoạt ra xa trạng thái ổn định quan sát được.",
       "lengthenEvaluationWindow": "Kéo dài cửa sổ đánh giá",
       "lengthenEvaluationWindowDesc": "Mở rộng khoảng thời gian để một đỉnh tăng ngắn không còn kích hoạt cảnh báo.",
-      "enableDeduplication": "Bật khử trùng lặp",
-      "enableDeduplicationDesc": "Gộp các lần kích hoạt lặp lại trong một cửa sổ khử trùng lặp.",
+      "enableDeduplication": "Bật chặn thông báo lặp lại",
+      "enableDeduplicationDesc": "Chỉ thông báo một lần mỗi khi trạng thái thay đổi thay vì mỗi lần đánh giá.",
       "reviewForDeletion": "Xem xét để xóa",
       "reviewForDeletionDesc": "Xác nhận truy vấn vẫn đúng với thực tế trước khi loại bỏ cảnh báo.",
       "fixAlertQuery": "Sửa truy vấn cảnh báo",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "Mã tổ chức",
     "alertCreationTitle": "Tạo cảnh báo",
     "noAlertsFound": "Không tìm thấy cảnh báo nào",
-    "suppressedByDeduplication": "Bị ẩn do loại bỏ trùng lặp",
-    "occurrence": "{count} lần xuất hiện | {count} lần xuất hiện",
     "groupedNotification": "Thông báo nhóm",
     "alertsBatchedTogether": "các cảnh báo được gộp cùng nhau",
-    "notificationSent": "Đã gửi thông báo",
-    "occurrencesDeduplicated": "các lần xuất hiện đã loại bỏ trùng lặp",
     "alertExecutionDetails": "Chi tiết thực thi cảnh báo",
     "evaluationTime": "Thời gian đánh giá",
     "queryTime": "Thời gian truy vấn",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "Đến: {time}",
     "serviceGraphTooltipTemporalCorrelation": "Tương quan thời gian",
     "serviceGraphTooltipServiceDependency": "Phụ thuộc dịch vụ",
-    "totalAlerts": "Tổng số cảnh báo",
-    "usingDeduplication": "Sử dụng Deduplication",
-    "deduplicationConfiguredTooltip": "Cảnh báo được cấu hình deduplication",
-    "suppressionRate24h": "Tỷ lệ ức chế (24h)",
     "suppressed": "đã ức chế /",
-    "total": "tổng",
-    "passedLabel": "Đã qua:",
-    "pendingBatches": "Lô đang chờ",
-    "pendingBatchesTooltip": "Cảnh báo đang chờ được nhóm lại",
     "historyTimeline": {
       "firing": "Đang kích hoạt",
       "ok": "OK",
@@ -10089,7 +10413,8 @@
     "endTime": "Thời gian kết thúc",
     "duration": "Thời lượng",
     "retries": "Số lần thử lại",
-    "dedup": "Dedup",
+    "suppression": "Chặn thông báo",
+    "suppressedAsRepeat": "Bị chặn do lặp lại",
     "validation": {
       "streamTypeRequired": "Loại stream là bắt buộc.",
       "streamNameRequired": "Tên stream là bắt buộc.",
@@ -10281,15 +10606,6 @@
     "all": "Tất cả",
     "history": "Lịch sử cảnh báo",
     "searcHistory": "Nhập tên cảnh báo",
-    "deduplication": {
-      "fingerprintFields": "Nhóm các cảnh báo tương tự theo",
-      "fingerprintFieldsHint": "Chọn các trường làm cho cảnh báo trở nên tương tự (ví dụ: hostname, service). Để trống để tự động phát hiện dựa trên truy vấn của bạn.",
-      "fingerprintFieldsTooltip": "Chọn trường nào phải khớp để cảnh báo được coi là trùng lặp. Ví dụ: chọn 'hostname' có nghĩa là các cảnh báo từ cùng một máy chủ sẽ được nhóm lại với nhau. Các loại cảnh báo khác nhau (ví dụ: CPU cao so với Bộ nhớ cao) không bao giờ được nhóm, ngay cả khi chúng đến từ cùng một máy chủ. Để trống để tự động phát hiện dựa trên loại truy vấn của bạn.",
-      "timeWindow": "Coi các cảnh báo là giống hệt nhau trong vòng",
-      "timeWindowHint": "Khoảng thời gian để nhóm các cảnh báo tương tự. Để trống để khớp với khoảng kiểm tra của bạn.",
-      "timeWindowTooltip": "Thời gian nhớ các cảnh báo gần đây để nhóm. Nếu một cảnh báo tương tự xảy ra trong khoảng thời gian này, nó sẽ không được gửi lại. Để trống để sử dụng khoảng kiểm tra cảnh báo của bạn.",
-      "fingerprintFieldsHelp": "Để trống để tự động phát hiện dựa trên truy vấn (SQL: cột GROUP BY, PromQL: nhãn, Tùy chỉnh: trường điều kiện)"
-    },
     "summary": {
       "scrollToBottom": "Cuộn xuống cuối",
       "title": "Tóm tắt",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "Cảnh báo tôi khi các điều kiện đã cấu hình được đáp ứng"
       }
     },
-    "correlation": {
-      "title": "Tương quan cảnh báo",
-      "description": "Cấu hình cách các cảnh báo được tương quan và loại bỏ trùng lặp trong toàn tổ chức. Các cảnh báo có giá trị dấu vân tay khớp nhau sẽ được nhóm lại với nhau.",
-      "semanticFieldNote": "Lưu ý: Ánh xạ trường ngữ nghĩa được cấu hình trong tab Danh tính Dịch vụ.",
-      "enableOrgLevel": "Bật loại bỏ trùng lặp cấp tổ chức",
-      "enableOrgLevelTooltip": "Bật các tính năng loại bỏ trùng lặp và tương quan cho tất cả cảnh báo trong tổ chức này",
-      "enableCrossAlert": "Bật loại bỏ trùng lặp chéo giữa các cảnh báo",
-      "enableCrossAlertTooltip": "Cho phép các cảnh báo khác nhau loại bỏ trùng lặp lẫn nhau khi chúng có cùng dấu vân tay",
-      "fingerprintGroups": "Nhóm dấu vân tay chéo giữa các cảnh báo",
-      "fingerprintGroupsTooltip": "Chọn các nhóm ngữ nghĩa để sử dụng cho việc tạo dấu vân tay chéo giữa các cảnh báo. Các cảnh báo sẽ bị loại bỏ trùng lặp nếu chúng có cùng giá trị cho các chiều này.",
-      "fingerprintGroupsHint": "Chọn ít nhất một nhóm ngữ nghĩa cho việc loại bỏ trùng lặp chéo giữa các cảnh báo",
-      "fingerprintGroupsRequired": "Phải chọn ít nhất một nhóm ngữ nghĩa",
-      "defaultWindow": "Cửa sổ tương quan mặc định (phút)",
-      "defaultWindowTooltip": "Khi không có khớp trường ngữ nghĩa, các cảnh báo và dữ liệu trong khoảng thời gian nhất định được coi là có liên quan",
-      "defaultWindowDescription": "Khi không có khớp trường ngữ nghĩa, các cảnh báo và dữ liệu trong khoảng thời gian nhất định được coi là có liên quan",
-      "defaultWindowPlaceholder": "Sử dụng khoảng thời gian cảnh báo mặc định",
-      "cancelButton": "Hủy",
-      "saveButton": "Lưu",
-      "settingsSaved": "Đã lưu cài đặt loại bỏ trùng lặp tổ chức thành công",
-      "settingsSaveError": "Không thể lưu cài đặt"
-    },
     "placeholders": {
       "typeSomething": "Nhập gì đó",
       "value": "Giá trị",
       "selectColumn": "Chọn cột",
       "savedFunctions": "Các hàm đã lưu",
-      "autoUsesCheckInterval": "Tự động (sử dụng khoảng kiểm tra)",
       "addTag": "Thêm thẻ và nhấn Enter"
     },
     "steps": {
       "compareWithPast": "So sánh với quá khứ",
-      "deduplication": "Loại bỏ trùng lặp",
       "advanced": "Nâng cao"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "Điều gì sẽ kích hoạt cảnh báo",
       "compareWithPast": "So sánh kết quả hiện tại với dữ liệu từ một khoảng thời gian khác",
       "alertSettings": "Đặt quy tắc cảnh báo và chọn cách bạn muốn được thông báo.",
-      "deduplication": "Tránh gửi cùng một cảnh báo nhiều lần bằng cách nhóm các cảnh báo tương tự lại với nhau.",
       "advanced": "Biến ngữ cảnh, mô tả và mẫu hàng"
     },
     "failedToFetchHistory": "Không thể lấy lịch sử cảnh báo",
@@ -10399,8 +10691,6 @@
         "closeActions": "Đóng hành động",
         "viewAlertHistory": "Xem lịch sử cảnh báo",
         "actionsFor": "Hành động cho:",
-        "configureDedup": "Cấu hình loại bỏ trùng lặp",
-        "configureDedupTooltip": "Cấu hình loại bỏ trùng lặp cho cảnh báo này",
         "editAlert": "Chỉnh sửa cảnh báo",
         "editAlertTooltip": "Chỉnh sửa cấu hình cảnh báo",
         "viewHistory": "Xem lịch sử",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "thông báo \"Đã giải quyết\" mới",
       "keepFiringFor": "Tiếp tục kích hoạt trong",
       "keepFiringForTooltip": "Chờ khoảng thời gian này sau khi điều kiện không còn đúng trước khi khôi phục. 0 sẽ khôi phục ngay lập tức.",
+      "suppressRepeats": "Chặn thông báo lặp lại",
+      "suppressRepeatsTooltip": "Chỉ thông báo một lần khi cảnh báo bắt đầu kích hoạt hoặc thay đổi mức độ, không phải ở mỗi lần đánh giá. Giữ tùy chọn này ở trạng thái tắt để tiếp tục nhận nhắc nhở sau mỗi khoảng thời gian im lặng.",
       "keepFiringForInvalid": "Nhập 0 giây hoặc nhiều hơn",
       "keepFiringForTooLong": "Nhập tối đa 86400 giây (24 giờ)"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "Địa chỉ email này đã được thêm",
     "confirmRemoveEmail": "Bạn có chắc chắn muốn xóa email {email} không?",
     "domainNeedsEmails": "Tên miền '{domain}' phải có ít nhất một địa chỉ email khi không cho phép tất cả người dùng",
+    "noAllowedEmailsDenyAll": "Chưa có email nào được phép, vì vậy mọi người dùng từ {domain} đều bị từ chối.",
     "domainSettingsSaved": "Đã lưu cài đặt tên miền thành công",
     "errorSavingDomainSettings": "Lỗi lưu cài đặt tên miền",
     "noDomainMessage": "Chưa có tên miền nào được cấu hình. Thêm tên miền ở trên để hạn chế truy cập.",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "Cấu hình ít nhất một bộ danh tính trước khi lưu.",
       "discoveredServicesTab": "Dịch vụ được phát hiện",
       "serviceDiscoveryTab": "Quy tắc phát hiện",
-      "alertCorrelationTab": "Nhóm cảnh báo",
       "fieldAliasesTab": "Ánh xạ trường",
       "fieldAliasesSaved": "Bí danh trường đã được lưu thành công",
       "fieldAliasesSaveError": "Không thể lưu bí danh trường",
@@ -14079,27 +14371,144 @@
     "runsIn": "Chạy trong",
     "recommendedByFieldCoverage": "Được đề xuất dựa trên mức độ bao phủ trường trong các stream của bạn.",
     "listConjunctionAndTwo": "{first} và {last}",
-    "domainOrgMappings": {
-      "title": "Ánh xạ tên miền đến tổ chức",
-      "subtitle": "Người dùng mới đăng nhập bằng tên miền email khớp sẽ tự động được thêm vào tổ chức.",
+    "orgDomainMapping": {
+      "tabLabel": "Quản lý tên miền",
+      "tabDesc": "Liên kết các tên miền email của bạn, ánh xạ người dùng của chúng vào các tổ chức và kiểm soát người dùng nào có thể tham gia.",
+      "loadFailed": "Không thể tải cài đặt tổ chức",
       "addMapping": "Thêm ánh xạ",
-      "editMapping": "Chỉnh sửa ánh xạ",
-      "empty": "Chưa có ánh xạ nào. Sử dụng “{addLabel}” để thêm.",
+      "editMapping": "Sửa ánh xạ",
       "domain": "Tên miền email",
-      "domainHelp": "Phần sau {at_sign} trong địa chỉ email của người dùng.",
+      "domainHelp": "Phần sau {at_sign} trong địa chỉ email của người dùng. Tên miền được liên kết với tổ chức này và phải được xác minh qua DNS.",
+      "domainHelpRequest": "Phần sau {at_sign} trong địa chỉ email của người dùng. Tên miền sẽ được liên kết với tổ chức này sau khi OpenObserve phê duyệt yêu cầu.",
       "organization": "Tổ chức",
-      "organizationPlaceholder": "Mã định danh tổ chức",
-      "organizationHelp": "Mã định danh của tổ chức mà người dùng khớp được thêm vào.",
-      "organizationRequired": "Tổ chức là bắt buộc",
+      "organizationHelp": "Tổ chức này hoặc một trong các thành viên nhóm thanh toán của tổ chức.",
+      "organizationRequired": "Bắt buộc chọn tổ chức",
       "baseRole": "Vai trò cơ bản",
-      "baseRoleHelp": "Vai trò được gán cho người dùng khớp trong tổ chức đó.",
+      "baseRoleHelp": "Vai trò được cấp khi người dùng được thêm vào tổ chức đó. Các thành viên hiện có giữ nguyên vai trò hiện tại của họ.",
       "roleClaimName": "Claim vai trò",
-      "roleClaimNamePlaceholder": "Tên claim, ví dụ groups",
-      "roleClaimNameHelp": "Tùy chọn. Claim của token liệt kê các vai trò tùy chỉnh của người dùng; mỗi lần đăng nhập, các vai trò tùy chỉnh của họ trong tổ chức đó sẽ được đồng bộ theo claim này.",
-      "createMissingRoles": "Tạo các vai trò trong claim chưa có trong tổ chức",
-      "duplicateDomain": "Đã tồn tại ánh xạ cho tên miền này",
-      "confirmRemove": "Bạn có chắc chắn muốn xóa ánh xạ cho {name} không?",
-      "deleteTitle": "Xóa ánh xạ"
+      "roleClaimNamePlaceholder": "Tên claim, ví dụ: groups",
+      "roleClaimNameHelp": "Tùy chọn. Claim trong token SSO liệt kê các vai trò tùy chỉnh của người dùng. Mỗi lần đăng nhập SSO, các vai trò tùy chỉnh của họ trong tổ chức đó sẽ được thay thế bằng các vai trò trong claim; các vai trò trong claim không tồn tại sẽ bị bỏ qua trừ khi chúng được tạo.",
+      "createMissingRoles": "Tạo các vai trò được claim chưa tồn tại trong tổ chức",
+      "verifyNow": "Xác minh ngay",
+      "details": "Chi tiết",
+      "detailsDialogTitle": "Chi tiết liên kết cho {domain}",
+      "approvedLinkInfo": "Được OpenObserve liên kết sau một yêu cầu liên kết. Không cần bản ghi DNS.",
+      "pendingRequestInfo": "OpenObserve đang xem xét yêu cầu này. Không cần làm gì cho đến khi yêu cầu được phê duyệt.",
+      "rejectedRequestInfo": "OpenObserve đã từ chối yêu cầu này.",
+      "verifyDialogTitle": "Xác minh {domain}",
+      "recordDialogTitle": "Bản ghi DNS cho {domain}",
+      "lastCheckFailed": "Lần kiểm tra gần nhất thất bại: {reason}",
+      "state": {
+        "pending": "Đang chờ",
+        "verified": "Đã xác minh",
+        "failed": "Thất bại",
+        "requested": "Đang chờ phê duyệt",
+        "approved": "Đã phê duyệt",
+        "rejected": "Đã từ chối"
+      },
+      "saved": "Đã lưu ánh xạ miền",
+      "saveFailed": "Không thể lưu cài đặt",
+      "linkFailed": "Không thể liên kết miền",
+      "unlinkFailed": "Không thể bỏ liên kết miền",
+      "verifyFailed": "Xác minh thất bại",
+      "deleted": "Đã xóa ánh xạ",
+      "deleteTitle": "Xóa ánh xạ?",
+      "deleteMappingBody": "Người dùng từ {domain} sẽ không còn được thêm vào {org} khi họ đăng nhập.",
+      "recordInstructions": "Thêm bản ghi TXT DNS này tại nhà cung cấp DNS của bạn:",
+      "txtNameLabel": "Tên bản ghi",
+      "txtValueLabel": "Giá trị bản ghi",
+      "copyTxtName": "Sao chép tên bản ghi",
+      "copyTxtValue": "Sao chép giá trị bản ghi",
+      "txtNameCopied": "Đã sao chép tên bản ghi",
+      "txtValueCopied": "Đã sao chép giá trị bản ghi",
+      "verifyHint": "Quá trình xác minh tự động chạy mỗi {minutes} phút. Bạn cũng có thể xác minh ngay bây giờ.",
+      "alreadyLinked": "Miền này đã được liên kết với tổ chức này",
+      "failureReason": {
+        "recordMissing": "Không tìm thấy bản ghi TXT",
+        "valueMismatch": "Đã tìm thấy bản ghi TXT nhưng giá trị không khớp",
+        "dnsFailed": "Phân giải DNS thất bại"
+      },
+      "pageSubtitle": "Liên kết các miền email của bạn, ánh xạ người dùng của chúng tới tổ chức và kiểm soát những ai có thể tham gia.",
+      "linkedTab": "Miền đã liên kết",
+      "mappingsTab": "Ánh xạ",
+      "accessTab": "Người dùng bị chặn",
+      "requestsTab": "Yêu cầu liên kết",
+      "linkDomain": "Liên kết miền",
+      "sendRequest": "Gửi yêu cầu",
+      "linkMethod": "Cách chứng minh quyền sở hữu",
+      "method": {
+        "dns": "Bản ghi DNS",
+        "approved": "Yêu cầu đã phê duyệt",
+        "request": "Yêu cầu liên kết",
+        "dnsTitle": "Thêm bản ghi TXT DNS",
+        "dnsDesc": "Được xác minh tự động khi bản ghi được công bố. Phù hợp nhất khi bạn quản lý DNS của miền.",
+        "requestTitle": "Yêu cầu liên kết từ OpenObserve",
+        "requestDesc": "Đội ngũ của chúng tôi xem xét yêu cầu và liên kết miền khi được phê duyệt."
+      },
+      "searchDomains": "Tìm kiếm miền",
+      "searchMappings": "Tìm kiếm theo miền hoặc tổ chức",
+      "searchRequests": "Tìm kiếm theo miền, tổ chức hoặc người yêu cầu",
+      "status": "Trạng thái",
+      "linkedVia": "Liên kết qua",
+      "lastChecked": "Lần kiểm tra cuối",
+      "linked": "Đã liên kết tên miền. Thêm bản ghi DNS để xác minh.",
+      "verified": "Đã xác minh tên miền",
+      "notVerifiedYet": "Chưa tìm thấy bản ghi DNS. Quá trình lan truyền có thể mất một lúc.",
+      "requestSent": "Đã gửi yêu cầu liên kết",
+      "requestFailed": "Không gửi được yêu cầu liên kết",
+      "keepRecordHint": "Giữ nguyên bản ghi này. Quyền sở hữu được kiểm tra lại mỗi {minutes} phút; nếu bản ghi bị thiếu quá {grace} phút, tên miền sẽ bị đánh dấu là thất bại và các ánh xạ của nó sẽ ngừng áp dụng.",
+      "removeDomain": "Xóa tên miền",
+      "removeTitle": "Xóa tên miền?",
+      "removeBody": "{domain} sẽ được hủy liên kết khỏi tổ chức này.",
+      "removeWithMappingsBody": "{domain} sẽ được hủy liên kết khỏi tổ chức này và {count} ánh xạ của nó sẽ bị xóa. | {domain} sẽ được hủy liên kết khỏi tổ chức này và {count} ánh xạ của nó sẽ bị xóa.",
+      "removed": "Đã xóa tên miền",
+      "domainRequired": "Bắt buộc nhập tên miền",
+      "mappingDomainHelp": "Chỉ có thể ánh xạ các tên miền đã xác minh.",
+      "createsRoles": "Tạo vai trò",
+      "duplicateMapping": "Tên miền này đã được ánh xạ tới tổ chức đó",
+      "domainNotVerified": "Chưa xác minh",
+      "noVerifiedDomains": "Ánh xạ chỉ áp dụng cho tên miền đã xác minh. Hãy liên kết và xác minh tên miền trước.",
+      "goToLinked": "Liên kết tên miền",
+      "goToLinkedDesc": "Xác minh tên miền bạn sở hữu trước khi ánh xạ người dùng của tên miền đó",
+      "enforceTitle": "Xóa người dùng khỏi các tổ chức khác",
+      "enforceDesc": "Khi người dùng thuộc tên miền đã ánh xạ đăng nhập qua SSO, họ sẽ bị xóa khỏi mọi tổ chức không phải tổ chức này hoặc không thuộc nhóm thanh toán của tổ chức này.",
+      "enforceConfirmTitle": "Xóa người dùng khỏi các tổ chức khác?",
+      "enforceConfirmBody": "Mỗi khi người dùng có tên miền email được ánh xạ tại đây đăng nhập qua SSO, họ sẽ bị xóa khỏi mọi tổ chức không phải tổ chức này hoặc không thuộc nhóm thanh toán của tổ chức này, bao gồm cả tổ chức cá nhân của họ.",
+      "enforceConfirmAction": "Bật",
+      "enforceSaved": "Đã lưu cài đặt",
+      "blockUsers": "Chặn người dùng",
+      "editBlockedUsers": "Chỉnh sửa người dùng bị chặn",
+      "block": "Chặn",
+      "blockedCount": "{count} bị chặn | {count} bị chặn",
+      "blockedEmails": "Email bị chặn",
+      "blocklistDomainHelp": "Một trong các tên miền đã xác minh của tổ chức này.",
+      "blocklistEmailsHelp": "Những người dùng này không thể tham gia tổ chức này hoặc nhóm thanh toán của tổ chức này qua SSO, và sẽ bị xóa khỏi các nhóm đó ở lần đăng nhập tiếp theo.",
+      "ruleBlockedRequired": "Thêm ít nhất một email để chặn",
+      "noDomainForBlocklist": "Mọi tên miền đã xác minh đều đã có người dùng bị chặn. Chỉnh sửa hàng của tên miền đó để thay đổi.",
+      "unblockAll": "Bỏ chặn tất cả",
+      "unblockAllTitle": "Bỏ chặn tất cả người dùng?",
+      "unblockAllBody": "Mọi người dùng bị chặn từ {domain} có thể tham gia lại ở lần đăng nhập SSO tiếp theo.",
+      "blocklistSaved": "Đã lưu người dùng bị chặn",
+      "blocklistDeleted": "Đã bỏ chặn người dùng",
+      "blocklistSection": "Người dùng bị chặn theo tên miền",
+      "filterPending": "Đang chờ",
+      "filterAll": "Tất cả",
+      "requestedBy": "Người yêu cầu",
+      "requestedAt": "Thời gian yêu cầu",
+      "verifiedAt": "Đã xác minh",
+      "answeredBy": "Người trả lời",
+      "reason": "Lý do",
+      "reasonHelp": "Được hiển thị cho tổ chức đã gửi yêu cầu.",
+      "reasonRequired": "Cần có lý do để từ chối yêu cầu",
+      "approve": "Phê duyệt",
+      "reject": "Từ chối",
+      "approveTitle": "Phê duyệt yêu cầu liên kết?",
+      "rejectTitle": "Từ chối yêu cầu liên kết?",
+      "approveBody": "{domain} sẽ được liên kết với {org} mà không cần kiểm tra DNS.",
+      "rejectBody": "{org} sẽ không nhận được {domain}.",
+      "requestApproved": "{domain} đã được liên kết",
+      "requestRejected": "Yêu cầu cho {domain} đã bị từ chối",
+      "decisionFailed": "Không thể cập nhật yêu cầu"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "Vui lòng chọn tùy chọn phát hiện tại"
   },
   "search_history": {
-    "title": "Lịch sử tìm kiếm",
+    "title": "Lịch sử sử dụng & chi phí",
     "get_history": "Lấy lịch sử",
     "executed_at": "Thực thi lúc",
     "sql_query": "Truy vấn SQL",
-    "delayMessage": "Lịch sử tìm kiếm có thể bị trễ trong"
+    "delayMessage": "Lịch sử sử dụng & chi phí có thể bị trễ"
   },
   "correlation": {
     "unstableDimensionNote": "Thứ nguyên không ổn định - thay đổi khi pod khởi động lại. Mặc định: Tất cả giá trị.",
@@ -18784,7 +19193,9 @@
     "dataFresh": "Dữ liệu mới",
     "dataGettingStale": "Dữ liệu đang trở nên cũ",
     "dataStale": "Dữ liệu đã cũ",
-    "lastRefreshed": "Cập nhật lần cuối: {time}"
+    "lastRefreshed": "Cập nhật lần cuối: {time}",
+    "refresh": "Làm mới",
+    "refreshWithAge": "Làm mới, lần làm mới cuối {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "Lỗi đầu dò"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "nhấp",
       "actionType": "gõ",
       "all": "Tất cả",
@@ -19868,6 +20280,13 @@
       "attemptN": "Lần thử {n}",
       "detailAction": "Hành động",
       "detailSelector": "Bộ chọn",
+      "detailStepId": "ID bước",
+      "detailTargetUrl": "URL đích",
+      "detailStatus": "Trạng thái",
+      "detailSkipReason": "Lý do bỏ qua",
+      "stepStatusSkipped": "Đã bỏ qua",
+      "stepStatusUnknown": "Không xác định",
+      "skippedCount": "Đã bỏ qua {n}",
       "downloadTrace": "Tải xuống {filename}",
       "errorFullscreenTitle": "Bước {id}: {action} - Lỗi",
       "failedAtStartLoad": "Không mở được URL bắt đầu",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "Tối đa {max}. Các lần thử lại chạy trong cùng một công việc, vì vậy toàn bộ chuỗi phải nằm trong ngân sách kiểm tra.",
       "retriesMaxBrowserHint": "Tối đa {max} cho kiểm tra trình duyệt. Mỗi lần thử sẽ chạy lại hành trình trên mọi thiết bị, nên nếu tăng thêm sẽ vượt quá thời gian chờ của probe và báo lỗi mà trang web của bạn không hề gặp phải.",
       "retryDelay": "Chờ",
-      "retryDelaySuffix": "ms giữa các lần thử lại.",
+      "retryDelaySuffix": "giây giữa các lần thử lại.",
       "schedule": "Lịch trình",
       "scheduleLater": "Lên lịch sau",
       "scheduleLaterTooltip": "Chọn ngày và giờ trong tương lai để kích hoạt kiểm tra.",
@@ -20241,6 +20660,8 @@
         "restartConfig": "Cấu hình khởi động lại — sao chép lệnh thiết lập của agent này để chạy lại cài đặt / khởi động lại docker (ví dụ sau khi xoay vòng token)",
         "noAgents": "Chưa có agent nào đăng ký cho vị trí này.",
         "agentsUnavailable": "Các agent của vị trí này đã đăng ký với một cụm khác và không hiển thị ở đây.",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "Các kiểm tra đang chạy từ vị trí này",
         "checkName": "Tên",
         "noChecks": "Chưa có kiểm tra nào được gán cho vị trí này.",
@@ -20546,7 +20967,7 @@
       "nodes": "Nút",
       "modelPricing": "Định giá mô hình",
       "searchSchedulers": "Bộ lập lịch tìm kiếm",
-      "searchHistory": "Lịch sử tìm kiếm",
+      "searchHistory": "Lịch sử sử dụng & chi phí",
       "sessions": "Phiên",
       "evalTemplates": "Đánh giá trực tuyến — Mẫu",
       "scorers": "Đánh giá trực tuyến — Bộ chấm điểm",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "Làm mới danh sách",
       "alertTemplatesAdd": "Thêm mẫu mới",
       "alertTemplatesRefresh": "Làm mới danh sách",
-      "logsSearchHistory": "Mở lịch sử tìm kiếm",
+      "logsSearchHistory": "Mở lịch sử sử dụng & chi phí",
       "alertsImport": "Nhập cảnh báo",
       "panelEditorRun": "Chạy / áp dụng truy vấn",
       "panelEditorSave": "Lưu và tiếp tục chỉnh sửa",
@@ -21131,6 +21552,7 @@
         "system": "hệ thống"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "Hoạt động",
         "passed": "Đạt",
         "healthy": "Khỏe mạnh",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "Không thể điều hướng đến cảnh báo",
       "alertNotFound": "Không tìm thấy cảnh báo",
-      "alertNotFoundInAlerts": "Không tìm thấy cảnh báo \"{name}\" trong số {count} cảnh báo",
       "failedToLoadAlerts": "Không thể tải danh sách cảnh báo",
       "alertsDeletedSuccessfully": "Đã xóa thành công {count} cảnh báo | Đã xóa thành công {count} cảnh báo",
       "failedToDeleteAlerts": "Không thể xóa {count} cảnh báo | Không thể xóa {count} cảnh báo",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "Vui lòng đợi trong khi tải các mẫu...",
       "alertSavedSuccessfully": "Đã lưu cảnh báo thành công.",
       "alertUpdatedSuccessfully": "Đã cập nhật cảnh báo thành công.",
-      "openingDedupConfig": "Đang mở cấu hình khử trùng lặp cho: {name}",
       "editingAlert": "Đang chỉnh sửa cảnh báo: {name}",
       "ack": {
         "acked": "Đã xác nhận {name}",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "Trình chỉnh sửa giá mô hình",
     "storageSettings": "Cài đặt lưu trữ",
     "domainManagement": "Quản lý tên miền",
+    "orgDomainMapping": "Quản lý tên miền",
     "slackApp": "Slack",
     "regexPatterns": "Các mẫu regex",
     "syntheticsLocations": "Các vị trí Synthetics",
@@ -26099,7 +26520,7 @@
       "logged": "Đã ghi nhận"
     },
     "policy": {
-      "gateHint": "Trong số các thay đổi đối với cảnh báo hiện có, chỉ khử trùng lặp tự áp dụng, kèm ảnh chụp trạng thái trước và thời hạn xem xét: giữ lại nếu các kiểm tra đạt, hoàn nguyên nếu không đạt. Mọi thứ khác đều chờ phê duyệt bằng một cú nhấp.",
+      "gateHint": "Trong số các thay đổi đối với cảnh báo hiện có, chỉ việc bật chặn thông báo lặp lại được tự động áp dụng, kèm ảnh chụp trạng thái trước đó và một khoảng thời gian xem xét: được giữ nếu các kiểm tra đạt, hoặc hoàn tác nếu chúng thất bại. Mọi thay đổi khác đều chờ phê duyệt bằng một cú nhấp.",
       "off": "Tắt",
       "suggest": "Đề xuất",
       "auto": "Tự động",
@@ -26118,7 +26539,7 @@
         "gateDesc": "Giữ thông báo gọi trực cho đến khi có kết quả điều tra, tối đa 2 phút. Mở khi lỗi: nếu triage hết thời gian hoặc thất bại, hệ thống vẫn gọi trực, báo rằng quá trình điều tra vẫn đang chạy hoặc đã thất bại, và nguyên nhân được gửi tiếp trong luồng."
       },
       "classes": {
-        "EnableDeduplication": "Bật khử trùng lặp cho cảnh báo lặp lại trong vài phút.",
+        "EnableDeduplication": "Bật chặn thông báo lặp lại cho cảnh báo đang thông báo ở mỗi lần đánh giá.",
         "CreateDetector": "Tạo bộ phát hiện bất thường trên yêu cầu, lỗi hoặc độ trễ của một dịch vụ.",
         "RaiseThreshold": "Nâng ngưỡng đang kích hoạt cả vào những ngày bình thường.",
         "LengthenEvaluationWindow": "Kéo dài cửa sổ của một cảnh báo hay dao động.",
@@ -26667,10 +27088,10 @@
           "on": "cảnh báo kết nối"
         },
         "L-302": {
-          "done": "Đã gộp 3 cảnh báo độ trễ checkout thành một",
-          "why": "Chúng cùng kích hoạt 94% thời gian, nên một lần chậm đã gọi bạn 3 lần.",
-          "from": "3 cảnh báo",
-          "to": "1",
+          "done": "Đã bật chặn thông báo lặp lại cho 3 cảnh báo độ trễ thanh toán",
+          "why": "Chúng thông báo ở mỗi lần đánh giá khi vẫn ở trạng thái kích hoạt, nên chỉ một lần chậm đã gọi trực bạn 120 lần.",
+          "from": "Mỗi lần đánh giá",
+          "to": "Một lần cho mỗi thay đổi",
           "on": "độ trễ checkout"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "Tôi đã gọi trực về việc checkout lỗi thanh toán.",
         "recsHeld": "Tôi đã giữ lại một vấn đề nhỏ với recommendations cho bản tổng kết thứ Sáu.",
         "diskApproved": "Bạn đã phê duyệt việc nâng cảnh báo dung lượng đĩa trên ingest-1 lên {to}%.",
-        "latencyGrouped": "Tôi đã gộp ba cảnh báo chậm của checkout thành một, để một lần chậm chỉ gọi trực một lần.",
+        "latencyGrouped": "Tôi đã bật chặn thông báo lặp lại cho ba cảnh báo chậm thanh toán, vì vậy một lần chậm sẽ chỉ gọi trực một lần.",
         "queueFixed": "Tôi đã thêm worker cho hàng đợi orders, nhưng hàng đợi vẫn tiếp tục tăng, nên tôi đã hoàn nguyên và gọi trực.",
         "loginPaged": "Tôi đã gọi trực về việc đăng nhập chậm.",
         "queuePermission": "Bạn đã cho phép tôi tự thêm worker cho hàng đợi, tối đa 8.",
@@ -28083,5 +28504,71 @@
       "legend": "Trạng thái pipeline",
       "legendToggle": "Hiện hoặc ẩn trạng thái này trên bản đồ"
     }
+  },
+  "recentSearches": {
+    "title": "Tìm kiếm gần đây",
+    "aboutKeptDays": "Chỉ các tìm kiếm của bạn trong {org}, chỉ bạn nhìn thấy. Lưu giữ {days} ngày; các tìm kiếm có gắn dấu sao sẽ được giữ cho đến khi bạn xóa. | Chỉ các tìm kiếm của bạn trong {org}, chỉ bạn nhìn thấy. Lưu giữ {days} ngày; các tìm kiếm có gắn dấu sao sẽ được giữ cho đến khi bạn xóa.",
+    "aboutKeptForever": "Chỉ các tìm kiếm của bạn trong {org}, chỉ bạn nhìn thấy. Lưu giữ cho đến khi bị xóa.",
+    "pageTitle": {
+      "logs": "Tìm kiếm nhật ký gần đây",
+      "traces": "Tìm kiếm trace gần đây",
+      "metrics": "Tìm kiếm chỉ số gần đây",
+      "dbm": "Tìm kiếm gần đây",
+      "profiles": "Tìm kiếm gần đây"
+    },
+    "page": {
+      "logs": "Nhật ký",
+      "traces": "Trace",
+      "metrics": "Chỉ số",
+      "dbm": "Cơ sở dữ liệu",
+      "profiles": "Profiles"
+    },
+    "allPages": "Tất cả các trang",
+    "viewAll": "Xem tất cả",
+    "failedCount": "{count} thất bại",
+    "keyHints": "↑↓ di chuyển · PgUp/PgDn cuộn truy vấn · Enter chạy · Shift+Enter chỉ tải · Esc đóng",
+    "loadToFix": "Tải để sửa",
+    "emptyTitle": "Chưa có tìm kiếm gần đây",
+    "loadError": "Không thể tải tìm kiếm gần đây",
+    "retry": "Thử lại",
+    "warning": "Kết thúc với cảnh báo: hết thời gian chờ hoặc kết quả không đầy đủ",
+    "failed": "Thất bại",
+    "ranCount": "đã chạy {count} lần",
+    "lineCount": "{count} dòng | {count} dòng",
+    "relativeWindow": "{period} gần nhất",
+    "rerunNow": "Chạy lại ngay",
+    "rerunOriginal": "Theo thời điểm gốc",
+    "loadOnly": "Tải mà không chạy",
+    "copyLink": "Sao chép liên kết",
+    "copyQuery": "Sao chép truy vấn",
+    "star": "Gắn dấu sao",
+    "unstar": "Bỏ dấu sao",
+    "linkCopied": "Đã sao chép liên kết",
+    "queryCopied": "Đã sao chép truy vấn",
+    "copyFunction": "Sao chép hàm",
+    "functionCopied": "Đã sao chép hàm",
+    "functionLabel": "Hàm (VRL)",
+    "searchPlaceholder": "Tìm kiếm truy vấn và stream",
+    "allStreams": "Tất cả stream",
+    "statusAll": "Mọi trạng thái",
+    "statusOk": "Thành công",
+    "statusError": "Thất bại",
+    "starredOnly": "Chỉ có dấu sao",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "Lọc theo ngày thực hiện",
+    "today": "Hôm nay",
+    "yesterday": "Hôm qua",
+    "noMatch": "Không có tìm kiếm nào khớp với các bộ lọc này",
+    "reset": "Đặt lại tất cả",
+    "resetFilters": "Đặt lại bộ lọc",
+    "loadMore": "Tải thêm",
+    "clear": "Xóa lịch sử của tôi",
+    "confirmClear": "Xóa lịch sử",
+    "clearBodyPage": "Thao tác này sẽ xóa {count} tìm kiếm {page} gần đây của bạn trong {org}. Các chế độ xem đã lưu không bị ảnh hưởng. | Thao tác này sẽ xóa {count} tìm kiếm {page} gần đây của bạn trong {org}. Các chế độ xem đã lưu không bị ảnh hưởng.",
+    "clearBodyAll": "Thao tác này sẽ xóa {count} tìm kiếm gần đây của bạn trong {org} trên Nhật ký, Trace và Chỉ số. Các chế độ xem đã lưu không bị ảnh hưởng. | Thao tác này sẽ xóa {count} tìm kiếm gần đây của bạn trong {org} trên Nhật ký, Trace và Chỉ số. Các chế độ xem đã lưu không bị ảnh hưởng.",
+    "includeStarred": "Cũng xóa {count} tìm kiếm đã gắn sao của tôi | Cũng xóa {count} tìm kiếm đã gắn sao của tôi",
+    "recentRow": "Tìm kiếm gần đây",
+    "deletedQuery": "Đã xóa {query}",
+    "undo": "Hoàn tác"
   }
 }
diff --git a/web/src/locales/languages/zh-CN.json b/web/src/locales/languages/zh-CN.json
index fdd6526fce..83856cd425 100644
--- a/web/src/locales/languages/zh-CN.json
+++ b/web/src/locales/languages/zh-CN.json
@@ -486,7 +486,11 @@
       "monitors": "监控器",
       "modelPricing": "模型定价定义",
       "variables": "变量",
-      "experiments": "实验"
+      "experiments": "实验",
+      "linkedDomains": "已关联域名",
+      "domainMappings": "域名映射",
+      "domainRequests": "关联请求",
+      "blockedUsers": "已阻止用户"
     },
     "demo": {
       "pageTitle": "空状态 — 完整集合供审查",
@@ -572,6 +576,30 @@
       "action": "新建任务",
       "actionDesc": "将 OpenObserve 指向您的端点并测试连接。"
     },
+    "noLinkedDomains": {
+      "title": "尚未关联任何域名",
+      "description": "关联您拥有的电子邮件域名，将其用户映射到您的组织，并控制谁可以登录。",
+      "dns": "添加 DNS 记录",
+      "dnsDesc": "使用 TXT 记录验证所有权",
+      "request": "请求关联",
+      "requestDesc": "让 OpenObserve 为您关联该域名"
+    },
+    "noDomainMappings": {
+      "title": "尚无域名映射",
+      "description": "自动将通过已验证域名登录的用户添加到该组织或其账单组成员。",
+      "action": "添加映射",
+      "actionDesc": "选择域名、组织和角色"
+    },
+    "noBlockedUsers": {
+      "title": "暂无已阻止用户",
+      "description": "来自已验证域名的所有用户都可以加入。阻止特定用户即可将其排除在外。",
+      "action": "阻止用户",
+      "actionDesc": "选择域名以及要阻止的电子邮件地址"
+    },
+    "noDomainRequests": {
+      "title": "暂无关联请求",
+      "description": "组织发出的域名关联请求会显示在这里。"
+    },
     "noDowntimes": {
       "title": "暂无静默期",
       "description": "静默期会让告警、异常检测和合成监控检查继续运行，并在您设定的时间窗口内停止发送通知。",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "关闭数据流模式",
     "autoRefreshWithValue": "自动刷新：{value}",
     "searchHistory": "搜索历史",
+    "usageCostHistory": "用量与成本历史",
     "createScheduledSearch": "创建预设搜索",
     "listScheduledSearch": "列出预设搜索",
     "scheduleSearchJob": "安排搜索作业",
@@ -1355,6 +1384,8 @@
     "scanSize": "扫描大小",
     "deltaScanSize": "增量扫描大小",
     "scannedSoFar": "已扫描 {size}",
+    "quickModeHiddenFields": "快速模式已开启。此行显示 {total} 个字段中的 {shown} 个。",
+    "turnOffQuickMode": "关闭快速模式",
     "resultsProgressLabel": "搜索进度",
     "histogramTitleError": "生成直方图标题时出错。",
     "selectLogStream": "选择日志流",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "此视图没有网络数据",
     "apiEmptyDescription": "所选数据流在此时间范围内没有资源或网络请求。一旦应用对其 HTTP 调用进行埋点，网络指标就会显示。",
     "skipInactivity": "跳过不活动状态",
+    "fullScreen": "全屏",
+    "exitFullScreen": "退出全屏",
     "error": "错误",
     "errorCount": "错误数",
     "all": "全部",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "添加第二个步骤以将此漏斗添加到仪表盘",
         "snapshot": "该面板将保留这些步骤、过滤器和命名事件规则的当前状态。"
       }
+    },
+    "overviewPage": {
+      "regionLabel": "性能概览",
+      "filterService": "服务",
+      "filterEnv": "环境",
+      "filterVersion": "版本",
+      "filterAll": "全部",
+      "verdictPass": "核心 Web 指标通过",
+      "verdictFail": "核心 Web 指标需关注",
+      "verdictAllPass": "全部通过",
+      "verdictNeedWork": "{count} / {total} 项需改进 | {count} / {total} 项需改进",
+      "percentileLabel": "百分位",
+      "bandGood": "良好",
+      "bandNeeds": "需改进",
+      "bandPoor": "较差",
+      "bandGoodPct": "{n}% 良好",
+      "bandNeedsPct": "{n}% 需改进",
+      "bandPoorPct": "{n}% 较差",
+      "bandAria": "{good}% 良好，{needs}% 需改进，{poor}% 较差",
+      "vitalLcp": "最大内容绘制",
+      "vitalInp": "交互到下一次绘制",
+      "vitalCls": "累计布局偏移",
+      "deltaFaster": "快 {v}",
+      "deltaSlower": "慢 {v}",
+      "deltaNone": "无变化",
+      "deltaNoPrev": "之前的数据不足",
+      "kpiSessions": "会话",
+      "kpiErrorFree": "无错误会话",
+      "kpiErrors": "错误总数",
+      "kpiUnhandled": "未处理错误",
+      "kpiRegion": "关键指标",
+      "sparkAria": "所选范围内 {label} 的趋势",
+      "chartTitle": "会话与错误",
+      "chartInterval": "每个时间桶",
+      "legendSessions": "会话",
+      "legendErrors": "错误",
+      "releaseMarker": "{version} 首次出现于 {time}",
+      "chartTableToggle": "显示数据表格",
+      "chartTableHide": "隐藏数据表格",
+      "chartTime": "时间",
+      "pagesTitle": "优先修复的页面",
+      "pagesHint": "按影响排序：流量按存在超过阈值的指标或错误的浏览量占比加权。点击页面查看其会话，点击错误数进入错误追踪。",
+      "pagesColPage": "页面",
+      "pagesColViews": "浏览量",
+      "pagesColErrors": "错误",
+      "pagesColImpact": "影响",
+      "pagesLegend": "▲ 需改进 · ■ 较差 · 无标记为良好。浏览量低于 {n} 的页面已隐藏。",
+      "pagesOpenSessions": "打开 {path} 的会话",
+      "pagesOpenErrors": "{count} 个错误，打开错误追踪 | {count} 个错误，打开错误追踪",
+      "pagesImpactAria": "影响 {n}（满分 100）",
+      "markNeeds": "需改进",
+      "markPoor": "较差",
+      "diffTitle": "最大差异",
+      "diffBody": "INP p75 为 {inp}，是其他分段的 {ratio} 倍。这是值得排查的相关性，而非已证实的原因。",
+      "diffNone": "在此时间范围内，没有分段明显区别于其他分段。",
+      "diffLink": "查看受影响的会话",
+      "segmentLabel": "分段",
+      "segBrowser": "浏览器",
+      "segDevice": "设备",
+      "segCountry": "国家/地区",
+      "segInp": "INP {v}",
+      "segShare": "占浏览量的 {n}%",
+      "segNone": "此分段没有数据。",
+      "releaseTitle": "版本对比",
+      "releaseHint": "{cur} 对比 {prev}。版本起始时间是首次看到该版本的时间。",
+      "releaseMetric": "指标",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "无错误",
+      "releaseSessions": "会话",
+      "releaseLink": "{version} 中的错误",
+      "frustrationTitle": "用户挫败感",
+      "frustrationHint": "核心指标未能捕捉的痛点",
+      "rageClicks": "愤怒点击",
+      "deadClicks": "无效点击",
+      "stateLoading": "正在加载{panel}…",
+      "stateEmptyTitle": "此时间范围内没有页面浏览量",
+      "stateEmptyBody": "扩大时间范围、清除过滤器，或检查浏览器 SDK 是否在发送浏览事件。",
+      "stateEmptyAction": "设置 SDK",
+      "stateLowTitle": "仅 {count} 次页面浏览 | 仅 {count} 次页面浏览",
+      "stateLowBody": "低于 {min} 次浏览时分位数不可靠，因此隐藏结论。数值仅供参考。",
+      "stateErrorTitle": "无法加载{panel}",
+      "stateErrorBody": "查询失败或超时。其他面板不受影响。",
+      "retry": "重试",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "关键指标",
+      "panelPages": "页面",
+      "panelSegments": "分段",
+      "panelRelease": "版本对比",
+      "panelFrustration": "用户挫败感",
+      "schemaErrorTitle": "无法加载 RUM 模式",
+      "schemaErrorBody": "无法读取数据流字段，因此概览无法确定要显示哪些面板。",
+      "pagesShowAll": "显示全部 {n} 个页面",
+      "pagesShowFewer": "显示更少页面",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "没有浏览量足够的页面",
+      "pagesEmptyBody": "页面在此时间范围内需要至少 {n} 次浏览才能参与排名。",
+      "segEmptyTitle": "没有分段数据",
+      "segEmptyBody": "这些浏览未记录浏览器、设备、操作系统、国家/地区或网络连接的值。",
+      "releaseEmptyTitle": "需要两个版本",
+      "releaseEmptyBody": "版本对比需要此时间范围内至少出现两个版本。",
+      "releaseBefore": "{version} 在此时间范围之前已上线，因此不显示其首次出现时间。",
+      "pageErrorTitle": "无法加载性能概览",
+      "pageErrorBody": "查询失败或超时。请重试以重新加载每个面板。",
+      "verdictOver": "{vital} 在 {pct}% 的页面浏览量中超过了 {threshold} 这一良好阈值。",
+      "verdictAllThree": "三项 Core Web Vitals 在 p75 下全部通过。",
+      "verdictAllSome": "已评估的 {n} 项 Core Web Vitals 在 p75 下全部通过。",
+      "releaseNewErrors": "此版本新增 {count} 个错误 | 此版本新增 {count} 个错误",
+      "verdictNoData": "无 Core Web Vitals 数据",
+      "verdictNoDataLead": "此时间范围内的 {count} 次页面浏览量均未上报 LCP、INP 或 CLS。 | 此时间范围内的 {count} 次页面浏览量均未上报 LCP、INP 或 CLS。",
+      "bandAtP75": "p75：{band}",
+      "vitalLinkFull": "{vital} {percentile} {value}，{band}，{delta}。打开会话。",
+      "pagesTableLabel": "按影响程度排序的页面",
+      "verdictSessions": "此时间范围内有 {count} 个会话。 | 此时间范围内有 {count} 个会话。",
+      "verdictCompare": "与上一周期相比。",
+      "deltaLower": "{v} 更低",
+      "deltaHigher": "{v} 更高",
+      "forbiddenTitle": "无权查看 {panel}",
+      "forbiddenBody": "请联系管理员获取 RUM 数据流的访问权限。",
+      "pageForbiddenTitle": "无权查看性能概览",
+      "asideLabel": "变化位置与内容",
+      "pagesAbout": "关于此排名",
+      "chartPerFiveMinutes": "每 5 分钟",
+      "chartPerThirtyMinutes": "每 30 分钟",
+      "chartPerHour": "每小时",
+      "chartPerSixHours": "每 6 小时",
+      "chartPerDay": "每天",
+      "chartIntervalOther": "每个时间桶",
+      "chartTableCaption": "每个时间桶的会话数和错误数",
+      "deltaChange": "{delta}（与上一周期相比）",
+      "deltaChangePts": "{delta} 个百分点（较上一周期）",
+      "deltaFlat": "与上一周期相比无变化",
+      "deltaNewMsg": "较上一周期新增",
+      "verdictP75Note": "判定始终使用 p75；p50 和 p95 仅改变数值。",
+      "releaseNote": "无论版本过滤器如何设置，都比较两个最新版本。",
+      "kpiEmptyTitle": "此时间范围内无会话",
+      "kpiEmptyBody": "请扩大时间范围或清除过滤器。",
+      "releaseImproved": "改善",
+      "releaseWorse": "变差",
+      "segOs": "操作系统",
+      "segConnection": "连接",
+      "pagesAllLink": "所有页面",
+      "pagesAllLinkAria": "产品分析中的所有页面",
+      "frustrationReplayLink": "观看回放",
+      "frustrationReplayHint": "打开此时间范围内的受挫会话；其中已录制的会话可观看回放。",
+      "diffSegment": "{dim}：{value}",
+      "stateEmptyQuiet": "此时间范围内未记录任何内容。请扩大时间范围；如果此应用尚未发送数据，请配置浏览器 SDK。",
+      "stateEmptyFiltered": "此时间范围内没有符合这些过滤器的内容。请清除过滤器，以查看所有服务、环境和版本。",
+      "clearFilters": "清除过滤器",
+      "stateRefreshing": "正在刷新 {panel}",
+      "tileOpenSessions": "{label}：{value}。打开会话",
+      "tileOpenErrors": "{label}：{value}。打开错误追踪",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "此概览仅统计浏览器会话。移动应用指标如下。",
+      "mixedMobileNote": "以下过滤器仅适用于移动应用指标。"
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "删除",
     "confirmDeleteHead": "删除用户",
     "confirmDeleteMsg": "您确定要删除用户 {name} 吗？",
+    "block": "阻止",
+    "confirmBlockHead": "阻止用户",
+    "confirmBlockMsg": "{email} 通过您的已验证域名加入。阻止后，该用户会被添加到该组织的域名限制中，并从该组织中移除。该用户下次登录时，将从其他已映射的组织中移除。",
     "cancel": "取消",
     "save": "保存",
     "ok": "确定",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "撤销邀请",
     "revokeInvitationMsg": "你确定要撤销 {email} 的邀请吗？",
     "deleteUsersTitle": "删除用户",
-    "deleteUsersMsg": "您确定要删除 {count} 个用户吗？ | 您确定要删除 {count} 个用户吗？"
+    "deleteUsersMsg": "您确定要删除 {count} 个用户吗？ | 您确定要删除 {count} 个用户吗？",
+    "deleteUsersBlockNote": "其中 {count} 名用户通过您的已验证域名加入，将被阻止而不是删除。"
   },
   "invitation": {
     "pendingInvitations": "待处理的邀请",
@@ -3403,8 +3597,6 @@
       },
       "show": "显示",
       "searchPermissions": "搜索权限",
-      "filterModules": "筛选模块",
-      "noModuleMatch": "没有模块与您的过滤器匹配",
       "moduleScopeAll": "全部",
       "moduleScopeGranted": "已选择",
       "noGrantedModule": "尚未选择任何模块",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "授权 | 授权",
       "summaryReachSome": "{total} 中的 {count}",
       "summaryEmptyTitle": "此角色尚未授予任何权限",
-      "summaryEmptyDescription": "请在左侧选择一个模块，或从预设开始。",
+      "summaryEmptyDescription": "从预设开始，或从列表中选择模块。",
       "presetReadonlyTitle": "只读",
       "presetReadonlyDescription": "在每个模块上拥有 list 和 get 权限",
       "presetDbmTitle": "数据库监控查看者",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "此组织中尚不存在这 {total} 个 Kubernetes 指标数据流,因此未预先选中任何内容。",
       "rumPresetSeeded": "已为 {total} 个 RUM 数据流中的 {matched} 个预选读取权限，外加源映射和任何 RUM 产品分析授权。保存前请检查。",
       "rumPresetNoMatch": "此组织中尚不存在 {total} 个 RUM 数据流中的任何一个，因此未对它们预选任何权限；源映射和任何 RUM 产品分析授权仍然已暂存。",
-      "moduleGroupFleet": "Fleet"
+      "moduleGroupFleet": "Fleet",
+      "filterModulesTasks": "筛选模块",
+      "noModuleMatchQuery": "没有与“{query}”匹配的模块",
+      "noModuleMatchHint": "可按模块、分组或任务搜索，例如 slack、panel 或 token。",
+      "presetAlertManagerTitle": "告警管理者",
+      "presetAlertManagerDescription": "创建和管理告警、告警的发送目标及其消息",
+      "presetAlertViewerTitle": "告警查看者",
+      "presetAlertViewerDescription": "查看告警、目标和模板，但不能更改",
+      "presetDashboardEditorTitle": "仪表盘编辑者",
+      "presetDashboardEditorDescription": "创建和编辑仪表盘，并拥有其所查询数据的读取权限",
+      "presetDashboardViewerTitle": "仪表盘查看者",
+      "presetDashboardViewerDescription": "打开仪表盘并读取其面板背后的数据",
+      "presetPipelineEditorTitle": "流水线编辑者",
+      "presetPipelineEditorDescription": "创建流水线和函数，并拥有数据流和富化表的读取权限",
+      "presetApplied": "{title}：已添加 {permissions}。保存前请查看更改。",
+      "presetPermissionCount": "{count} 项权限 | {count} 项权限",
+      "companionReasonAlertStreams": "保存告警。服务器会在保存时检查数据流访问权限",
+      "companionReasonAlertDestinations": "选择告警的发送目标",
+      "companionReasonDestinationTemplates": "选择消息模板，每个目标都需要模板",
+      "companionReasonDashboardStreams": "加载面板数据",
+      "presetsTitle": "预设",
+      "presetsClose": "关闭预设",
+      "presetsShow": "显示预设",
+      "presetsSubtitle": "将预设中的授权添加到此角色。不会移除任何内容。",
+      "presetsSectionBuiltin": "内置",
+      "presetsSectionJob": "按职责",
+      "presetAddsTooltip": "添加 {count} 项权限 | 添加 {count} 项权限",
+      "presetInRole": "已在角色中",
+      "presetInRoleTooltip": "此角色已拥有此预设中的全部内容",
+      "presetBack": "所有预设",
+      "presetModuleCount": "{count} 个模块 | {count} 个模块",
+      "presetSummaryAdds": "在 {modules} 中添加 {permissions}。",
+      "presetSummaryWrite": "在 {modules} 中拥有写入权限。",
+      "presetSummaryViewOnly": "仅查看：无法创建、编辑或删除任何内容。",
+      "presetSummaryHasAll": "此角色已拥有此预设中的全部内容。",
+      "presetSummarySkipped": "已跳过此角色中已有的 {count} 项权限。 | 已跳过此角色中已有的 {count} 项权限。",
+      "presetStillMissing": "添加后仍缺少：{list}",
+      "presetMissingItem": "{module}：{actions}",
+      "presetNothingMissing": "添加后将不会缺少任何内容。",
+      "neededBy": "{modules} 需要",
+      "stillNeededBy": "{modules} 仍需要",
+      "presetReadsEveryStream": "可读取此组织中的所有流，包括新建的流。",
+      "presetAddButton": "添加 {count} 项权限 | 添加 {count} 项权限",
+      "presetNothingToAdd": "无可添加内容",
+      "presetApplyNote": "添加的授权会成为未保存的更改。保存前请查看。",
+      "presetLoadingStreams": "正在加载数据流",
+      "presetNoMatchingStreams": "此组织中还没有匹配的数据流。",
+      "reviewMissingTooltip": "此角色缺少 {count} 个必需模块 | 此角色缺少 {count} 个必需模块",
+      "notAddedYetTitle": "尚未添加 · {modules}",
+      "companionAdd": "添加",
+      "companionAddItem": "添加 {item}",
+      "companionAddAll": "全部添加",
+      "companionOpenStreams": "打开数据流",
+      "companionOpenStreamsTooltip": "选择此角色可以读取哪些数据流",
+      "companionNeeds": "{module} 需要它来{reason}。",
+      "companionNeedsThis": "{module} 需要此权限来{reason}。",
+      "companionStillNeedsThis": "{module} 仍需要此权限来{reason}。",
+      "yourChanges": "您的更改",
+      "yourChangesCount": "{modules} 中的 {changes}",
+      "yourChangesNone": "暂无",
+      "changeCount": "{count} 项更改 | {count} 项更改",
+      "changeOtherGroup": "其他",
+      "saveSuccessCounts": "已保存 {modules} 中的 {changes}。",
+      "effectCan": "可以{actions}{target}。",
+      "effectCannot": "无法再{actions}{target}。",
+      "effectCanLoadDestinations": "可以加载目标列表。",
+      "effectCannotLoadDestinations": "无法再加载目标列表。",
+      "effectCanLoadTemplates": "可以加载模板列表。",
+      "effectCannotLoadTemplates": "无法再加载模板列表。",
+      "verbView": "查看",
+      "verbSeeListOf": "在列表中查看",
+      "verbList": "列出",
+      "verbOpen": "打开",
+      "verbCreate": "创建",
+      "verbEdit": "编辑",
+      "verbDelete": "删除",
+      "targetEveryStream": "所有数据流（日志、指标、追踪和索引），包括新建的",
+      "targetTypeStreams": "所有 {type} 数据流",
+      "targetOneStream": "{type} 数据流 {name}",
+      "targetAlertsEveryFolder": "所有文件夹中的告警，包括新文件夹",
+      "targetAlertsInFolder": "文件夹 {name} 中的告警",
+      "targetOneAlert": "告警 {name}",
+      "targetDashboardsEveryFolder": "所有文件夹中的仪表盘，包括新文件夹",
+      "targetDashboardsInFolder": "文件夹 {name} 中的仪表盘",
+      "targetOneDashboard": "仪表盘 {name}",
+      "targetReportsEveryFolder": "所有文件夹中的报表，包括新文件夹",
+      "targetReportsInFolder": "文件夹 {name} 中的报表",
+      "targetOneReport": "报表 {name}",
+      "targetEveryDestination": "所有告警目标（Slack、邮件、Webhook），包括新建的",
+      "targetOneDestination": "目标 {name}",
+      "targetEveryTemplate": "所有通知模板，包括新建的",
+      "targetOneTemplate": "模板 {name}",
+      "targetAllOf": "所有{module}，包括新建的",
+      "targetItemIn": "{module}中的 {name}",
+      "noteDestinationsFiltered": "他们只能看到自己也能打开的目标。在此处或在单个目标上添加“获取”，以选择可以看到哪些目标。",
+      "noteTemplatesFiltered": "他们只能看到自己也能打开的模板。在此处或在单个模板上添加“获取”，以选择可以看到哪些模板。",
+      "presetStreamsFailed": "无法加载数据流列表。",
+      "presetRetry": "重试",
+      "presetRestored": "{title}：已恢复 {permissions}。保存前请查看更改。",
+      "presetSummaryRestores": "保留您标记为移除的 {count} 项权限。 | 保留您标记为移除的 {count} 项权限。",
+      "presetRestoreButton": "保留 {count} 项权限 | 保留 {count} 项权限",
+      "effectStillAllowed": "访问权限无变化：更大范围的授权仍允许此操作。"
     },
     "rolesPage": {
       "subtitle": "角色捆绑权限 — 将其分配给用户、服务帐号或群组以授予访问权限。",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "用户更新成功。",
       "userDeletedSuccess": "用户删除成功。",
       "errorDeletingUser": "删除用户时出错。",
+      "userBlockedSuccess": "已成功阻止用户。",
+      "errorBlockingUser": "阻止用户时出错。",
+      "blockedButNotRemoved": "用户已被阻止，但无法从该组织中移除。",
+      "blockedUsersSuccess": "已成功阻止 {count} 名用户 | 已成功阻止 {count} 名用户",
+      "blockedUsersPartial": "已阻止并移除 {count} 名用户，但 {failed} 名用户无法从该组织中移除 | 已阻止并移除 {count} 名用户，但 {failed} 名用户无法从该组织中移除",
+      "blockedUsersNotRemoved": "已阻止 {count} 名用户，但无法将其从该组织中移除 | 已阻止 {count} 名用户，但无法将其从该组织中移除",
       "pleaseWait": "请稍候...",
       "invitationRevokedSuccess": "邀请已成功撤销。",
       "errorRevokingInvitation": "撤销邀请时出错。",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "追踪通过 eBPF 采集：无需修改代码，也无需 SDK。追踪上下文仅通过明文 HTTP 在服务间传递（Go 应用在未启用内核 lockdown 的节点上也可通过 HTTPS）。只要进程匹配端口、可执行文件路径或命令行中的任意一项，就会被追踪；glob 中不能包含 `,`、`{'{'}` 或 `{'}'}`，且端口会匹配在该端口上持有套接字的任何进程。需要 Helm 3.14+ 和 OpenTelemetry Operator v0.142.0+；如果你的版本更旧，请先使用 `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml` 升级 Operator。如果已在旧版 Operator 上启用过 eBPF，请使用 `--force`（Helm 4 上为 `--force-replace`）重新运行命令。重新运行上方的安装命令会重置该 release 并关闭 eBPF，因此之后请再次运行此命令。`openobserve-collector` 命名空间必须允许特权 Pod，节点必须运行 amd64 或 arm64 架构的 Linux，内核 5.8+（或带 eBPF 回溯移植的 RHEL 系列 4.18）并支持 BTF。不要选择已自行发送追踪数据的应用，也不要选择使用 Go `inject-go` sidecar 的 Pod。",
       "k8sEbpfVariant": "eBPF（任意语言，无需改代码）",
       "k8sLibrariesVariant": "语言库（自动插桩）",
+      "k8sNetworkFlowsDesc": "采集器的 eBPF DaemonSet 会在每个 Linux 节点上记录 **工作负载之间通过任意 TCP 或 UDP 协议发送的字节数**，包括数据库、缓存以及其他未被追踪的服务。这些数据以 `obi_network_flow_bytes` 指标的形式上报，并带有源和目标所有者（Deployment、StatefulSet、Node 等）以及命名空间的标签。无论是否启用 eBPF 追踪都可使用。",
+      "k8sNetworkFlowsNote": "需要 Helm 3.14+ 和 OpenTelemetry operator v0.142.0+。`openobserve-collector` 命名空间必须允许特权 Pod，节点必须运行 Linux amd64 或 arm64，内核为 5.8+（或带 eBPF 向后移植的 RHEL 系列 4.18）并支持 BTF。eBPF Pod 运行在主机网络上，收集器自身的指标监听每个节点的 `127.0.0.1:8888`，因此每个节点上的该端口必须空闲。已设置的 eBPF 追踪选择器会保留。重新运行上方的安装命令会重置发布版本并关闭此功能，因此之后请再次运行此命令。相同的字节可能会被多次上报：节点之间的流量会被两个节点分别上报，而到某个 Service 的连接会同时按该 Service 和其后的工作负载上报。eBPF 网络流指南说明了如何查询它们而不重复计数。",
+      "k8sNetworkFlowsTitle": "查看哪些工作负载在相互通信：eBPF 网络流",
       "k8sInstallerNote": "这会自动安装 cert-manager、OpenTelemetry operator 和 OpenObserve collector。",
       "k8sInternalEndpointNote": "当 OpenObserve 运行在同一集群中使用此项 — 流量永远不会离开它。",
       "k8sTroubleAnnotationA": "注入发生在 pod 创建时，因此现有 pod 在重启前不受影响 — 运行 `kubectl rollout restart deployment -n my-namespace`。使用 `kubectl get ns my-namespace -o yaml` 确认注解已生效，并检查值是否与 `openobserve-collector/openobserve-<language>` 匹配。",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "安装失败，出现有关准入 webhook 的错误",
       "linuxAgentFixBody": "安装程序将代理作为 systemd 服务启动。如果没有内容到达，请确认它正在运行并阅读其日志以查找认证或连接错误：",
       "linuxTracesNote": "追踪通过 eBPF 采集：无需修改代码，也无需 SDK。只要进程匹配端口、可执行文件路径或命令行中的任意一项，就会被追踪；glob 中不能包含 `,`、`{'{'}` 或 `{'}'}`。追踪需要 Linux 5.8+（或带 eBPF 回溯移植的 RHEL 系列 4.18）且支持 BTF；此时 agent 会以 root 身份运行。如果主机无法进行追踪，安装会停止，且不会影响正在运行的 agent。如果之后 agent 在开启追踪时启动失败，追踪就会被禁用——日志和指标也会一并禁用——直到您重新运行 **日志与指标** 命令，或修复原因后带追踪重新运行。被追踪的应用会在发出的明文 HTTP 请求中添加 W3C `traceparent` 头。下方的 eBPF 追踪指南涵盖了 HTTPS 以及重复指定标志的情况。",
+      "linuxNetworkFlowsDesc": "使用 `--network-flows` 运行安装程序，即可将 **此主机通过任意 TCP 或 UDP 协议发送和接收的字节数** 上报为 `obi_network_flow_bytes` 指标。每条流都会用你列出的网络打上 `src_cidr` 和 `dst_cidr` 标签，因此请为每台主机提供相同的列表：每台主机一个 `/32` 条目即可得到主机到主机的映射图。",
+      "linuxNetworkFlowsNote": "需要 Linux 5.8+（或带 eBPF 向后移植的 RHEL 系列 4.18）并支持 BTF；随后代理会以 root 身份运行。无论是否启用追踪，它都能工作，但每次运行安装程序都会替换代理配置：如需保持追踪开启，请添加 **日志、指标和 eBPF 追踪** 命令中的 `--trace-*` 和 `--service-name` 标志。如果主机无法运行 eBPF，安装会停止，且不会改动正在运行的代理。如果随后网络捕获启动失败，代理会被禁用——日志和指标也会被禁用——直到你重新运行 **日志和指标** 命令，或修复原因后使用 `--network-flows` 重新运行。两台都运行代理的主机之间的流量会由双方分别上报，除非两端地址相同，否则回环流量会被计入。下方的 eBPF 网络流指南说明了标签以及如何查询它们而不重复计数。",
+      "linuxNetworkFlowsTitle": "查看哪些主机在相互通信：eBPF 网络流",
       "linuxTracesVerifyNote": "启用追踪后，被追踪的应用处理请求后即会出现追踪数据。",
+      "ebpfNetworkFlowsGuideLink": "eBPF 网络流指南",
       "ebpfTracingGuideLink": "eBPF 追踪指南",
       "logsMetricsTracesVariant": "日志、指标与 eBPF 追踪",
       "logsMetricsVariant": "日志和指标",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "将任何 OpenTelemetry exporter 指向 OpenObserve — 无论是 collector 还是 SDK，HTTP 或 gRPC。您的端点和令牌已填写在下方。",
       "taglineWindows": "在任何 Windows 主机上安装 OpenObserve agent — 事件日志、性能计数器和主机指标。",
       "testAgain": "再次测试",
+      "networkFlowsHelp": "填写 CIDR 或 CIDR=NAME 条目，以逗号分隔且不含空格；每个 CIDR 必须带前缀长度，例如 10.0.1.5/32，名称只能包含字母、数字、.、_ 和 -。未被任何条目匹配的地址不加标签；0.0.0.0/0=other 为其余 IPv4 地址命名，::/0=other6 为其余 IPv6 地址命名。",
+      "networkFlowsLabel": "要标记的网络",
+      "networkFlowsRequired": "请至少列出一个网络：网络流会用你列出的网络打标签。",
       "traceCmdHelp": "适用于 Python、Node.js 和 Java 应用。",
       "traceCmdLabel": "命令行",
       "traceExeLabel": "可执行文件路径",
@@ -7518,6 +7827,20 @@
     "heatmapHideBelow": "隐藏低于此值的单元格",
     "heatmapHideBelowTooltip": "值低于此值的单元格保持空白。",
     "heatmapHideBelowNote": "低于 {value} 的单元格已隐藏",
+    "boxplotWhisker": "须线",
+    "boxplotWhiskerMinMax": "最小值到最大值",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "消息字段",
+    "logsLevelField": "级别字段",
+    "logsTimeField": "时间字段",
+    "htmlPanelFieldTooltip": "留空则从查询结果中检测该列",
+    "logsOrder": "顺序",
+    "logsOrderNewest": "最新优先",
+    "logsOrderOldest": "最早优先",
+    "logsOrderTooltip": "对查询返回的行排序。未修改的初始查询也会按此顺序获取，因此“最早优先”会显示最早的日志。",
+    "logsShowTime": "显示时间",
+    "logsWrap": "自动换行",
+    "logsPrettifyJson": "格式化 JSON",
     "distributionBucketCount": "分桶数量",
     "distributionBucketSize": "分桶大小",
     "distributionBucketSizeTooltip": "每个分桶的宽度，单位与字段相同。设置后将取代分桶数量。",
@@ -7822,6 +8145,8 @@
       "gauge": "仪表",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "箱线图",
+      "logs": "日志",
       "barGauge": "条形仪表",
       "distribution": "分布",
       "treemap": "矩形树图",
@@ -8321,6 +8646,14 @@
       "missingRequiredArgument": "{field}: 在位置 {index} 缺少必需参数",
       "fieldNotAllowedForMetric": "Metric 图表不允许使用 {label} 字段",
       "rawValueSampled": "基于前 {count} 行",
+      "addAtMostOneFieldFor": "{label} 最多添加一个字段",
+      "boxplotMin": "最小值",
+      "boxplotMax": "最大值",
+      "boxplotLowerWhisker": "下须线",
+      "boxplotUpperWhisker": "上须线",
+      "boxplotMedian": "中位数",
+      "boxplotSamples": "样本数",
+      "boxplotOutlier": "离群值",
       "fieldNotAllowedForDistribution": "分布图不允许使用 {label} 字段",
       "distributionCount": "计数",
       "addAtLeastOneFieldFor": "为 {label} 至少添加一个字段",
@@ -8525,6 +8858,8 @@
       "urlHidden": "无访问权限",
       "urlHiddenHint": "您无法查看此链接的仪表盘，因此其公开 URL 已隐藏。",
       "orgDisabledHint": "此组织已关闭公开链接",
+      "orgDisabledBanner": "此组织已关闭公开链接，因此不会提供链接。管理员可将其重新开启。",
+      "disabledPaused": "已禁用 · 已暂停",
       "takeOver": "接管",
       "takeOverTitle": "接管此链接？",
       "takeOverBody": "您将成为发布者。公开页面将显示您有权查看的内容，可能比之前多或少。拥有该 URL 的任何人仍可访问，链接将立即生效。",
@@ -8784,6 +9119,7 @@
     "wellGroup": "分组",
     "wellSubgroup": "子分组",
     "wellSize": "大小",
+    "wellCategory": "类别",
     "value": "值"
   },
   "home": {
@@ -9687,8 +10023,8 @@
       "raiseThresholdDesc": "将触发值调整到远离观测到的稳定状态的位置。",
       "lengthenEvaluationWindow": "延长评估窗口",
       "lengthenEvaluationWindowDesc": "扩大时间范围，使短暂尖峰不再触发告警。",
-      "enableDeduplication": "启用去重",
-      "enableDeduplicationDesc": "在去重窗口内合并重复触发。",
+      "enableDeduplication": "开启重复通知抑制",
+      "enableDeduplicationDesc": "每次状态变化时通知一次，而不是每次评估都通知。",
       "reviewForDeletion": "评估是否删除",
       "reviewForDeletionDesc": "在停用告警前，确认查询仍然符合实际情况。",
       "fixAlertQuery": "修复告警查询",
@@ -10005,12 +10341,8 @@
     "organizationIdLabel": "组织 ID",
     "alertCreationTitle": "创建告警",
     "noAlertsFound": "未找到告警",
-    "suppressedByDeduplication": "被去重抑制",
-    "occurrence": "{count} 次 | {count} 次",
     "groupedNotification": "分组通知",
     "alertsBatchedTogether": "告警批量合并",
-    "notificationSent": "通知已发送",
-    "occurrencesDeduplicated": "已去重的发生次数",
     "alertExecutionDetails": "告警执行详情",
     "evaluationTime": "评估时间",
     "queryTime": "查询时间",
@@ -10060,15 +10392,7 @@
     "serviceGraphTooltipTo": "到：{time}",
     "serviceGraphTooltipTemporalCorrelation": "时间相关性",
     "serviceGraphTooltipServiceDependency": "服务依赖",
-    "totalAlerts": "告警总数",
-    "usingDeduplication": "使用去重",
-    "deduplicationConfiguredTooltip": "已配置去重的告警",
-    "suppressionRate24h": "抑制率（24小时）",
     "suppressed": "已抑制 /",
-    "total": "总数",
-    "passedLabel": "已通过：",
-    "pendingBatches": "待处理批次",
-    "pendingBatchesTooltip": "等待分组的告警",
     "historyTimeline": {
       "firing": "触发中",
       "ok": "正常",
@@ -10089,7 +10413,8 @@
     "endTime": "结束时间",
     "duration": "持续时间",
     "retries": "重试次数",
-    "dedup": "去重",
+    "suppression": "抑制",
+    "suppressedAsRepeat": "作为重复通知被抑制",
     "validation": {
       "streamTypeRequired": "Stream 类型为必填项。",
       "streamNameRequired": "Stream 名称为必填项。",
@@ -10281,15 +10606,6 @@
     "all": "全部",
     "history": "告警历史",
     "searcHistory": "输入告警名称",
-    "deduplication": {
-      "fingerprintFields": "指纹字段",
-      "fingerprintFieldsHint": "选择用于重复数据删除的字段。留空以便根据查询类型自动检测。",
-      "fingerprintFieldsTooltip": "用于创建用于告警重复数据删除的唯一指纹的字段。指纹包括告警名称 + 指标/条件 + 选定字段，可确保不同的告警类型（例如 CPU 高压与高内存）不会同时消除重复数据，即使它们监控的是相同的实体。留空以便自动检测：SQL 查询使用 WHERE 子句列 + 分组按列，PromQL 使用指标名称 + 标签维度，自定义查询使用条件字段。",
-      "timeWindow": "时间窗口（分钟）",
-      "timeWindowHint": "追踪告警指纹需要多长时间。留空以使用告警周期。",
-      "timeWindowTooltip": "跟踪和删除重复告警指纹的持续时间。如果在此窗口内出现具有相同指纹的告警，则该告警将被抑制。留空以使用告警评估期。",
-      "fingerprintFieldsHelp": "留空以根据查询自动检测（SQL：GROUP BY 列，PromQL：标签，自定义：条件字段）"
-    },
     "summary": {
       "scrollToBottom": "滚动到底部",
       "title": "摘要",
@@ -10337,38 +10653,15 @@
         "defaultConditions": "满足配置条件时提醒我"
       }
     },
-    "correlation": {
-      "title": "告警关联",
-      "description": "配置组织内告警的关联和重复数据删除方式。指纹值匹配的告警将分组在一起。",
-      "semanticFieldNote": "注意：语义字段映射在 “服务标识” 选项卡中配置。",
-      "enableOrgLevel": "启用组织级重复数据删除",
-      "enableOrgLevelTooltip": "为该组织中的所有告警启用重复数据删除和关联功能",
-      "enableCrossAlert": "启用跨告警重复数据删除",
-      "enableCrossAlertTooltip": "允许不同的告警在共享相同指纹时相互删除重复数据",
-      "fingerprintGroups": "交叉告警指纹组",
-      "fingerprintGroupsTooltip": "选择使用哪些语义组进行交叉告警指纹识别。如果告警在这些维度上共享相同的值，则会删除重复数据。",
-      "fingerprintGroupsHint": "为跨告警重复数据删除选择至少一个语义组",
-      "fingerprintGroupsRequired": "必须至少选择一个语义组",
-      "defaultWindow": "默认关联窗口（分钟）",
-      "defaultWindowTooltip": "在没有语义字段匹配的情况下，给定持续时间的告警和数据被认为是相关的",
-      "defaultWindowDescription": "在没有语义字段匹配的情况下，给定持续时间的告警和数据被认为是相关的",
-      "defaultWindowPlaceholder": "默认使用告警周期",
-      "cancelButton": "取消",
-      "saveButton": "保存设置",
-      "settingsSaved": "组织去重设置保存成功",
-      "settingsSaveError": "保存设置失败"
-    },
     "placeholders": {
       "typeSomething": "输入一些东西",
       "value": "值",
       "selectColumn": "选择列",
       "savedFunctions": "保存的函数",
-      "autoUsesCheckInterval": "自动（使用检查间隔）",
       "addTag": "添加标签并按回车"
     },
     "steps": {
       "compareWithPast": "与过去比较",
-      "deduplication": "重复数据删除",
       "advanced": "高级"
     },
     "stepCaptions": {
@@ -10376,7 +10669,6 @@
       "conditions": "什么条件触发告警",
       "compareWithPast": "将当前结果与其他时间段的数据进行比较",
       "alertSettings": "设置您的告警规则，并选择您希望如何收到通知。",
-      "deduplication": "通过将相似告警分组，避免重复发送相同告警。",
       "advanced": "上下文变量、描述和行模板"
     },
     "failedToFetchHistory": "无法获取告警历史记录",
@@ -10399,8 +10691,6 @@
         "closeActions": "关闭操作",
         "viewAlertHistory": "查看告警历史",
         "actionsFor": "针对以下各项的操作：",
-        "configureDedup": "配置重复数据删除",
-        "configureDedupTooltip": "为此告警配置重复数据删除",
         "editAlert": "编辑告警",
         "editAlertTooltip": "编辑告警配置",
         "viewHistory": "查看历史",
@@ -11180,6 +11470,8 @@
       "recoveryChatMessage": "新的“已恢复”消息",
       "keepFiringFor": "持续触发时长",
       "keepFiringForTooltip": "条件清除后等待此时长再恢复。0 表示立即恢复。",
+      "suppressRepeats": "抑制重复通知",
+      "suppressRepeatsTooltip": "告警开始触发或级别发生变化时通知一次，而不是每次评估都通知。保持关闭可在每个静默期后继续收到提醒。",
       "keepFiringForInvalid": "请输入 0 或更大的秒数",
       "keepFiringForTooLong": "最多输入 86400 秒（24 小时）"
     },
@@ -13585,6 +13877,7 @@
     "emailAlreadyExists": "此电子邮件地址已被添加",
     "confirmRemoveEmail": "您确定要移除邮箱 {email} 吗？",
     "domainNeedsEmails": "不允许所有用户时，域 “{domain}” 必须至少有一个电子邮件地址",
+    "noAllowedEmailsDenyAll": "尚未允许任何电子邮件地址，因此来自 {domain} 的所有用户都将被拒绝访问。",
     "domainSettingsSaved": "域名设置已成功保存",
     "errorSavingDomainSettings": "保存域名设置时出错",
     "noDomainMessage": "未配置任何域。在上方添加域名以限制访问权限。",
@@ -13681,7 +13974,6 @@
       "identityConfigNoSets": "保存前至少配置一个身份集。",
       "discoveredServicesTab": "已发现的服务",
       "serviceDiscoveryTab": "检测规则",
-      "alertCorrelationTab": "告警关联",
       "fieldAliasesTab": "字段映射",
       "fieldAliasesSaved": "字段别名保存成功",
       "fieldAliasesSaveError": "保存字段别名失败",
@@ -14079,27 +14371,144 @@
     "runsIn": "运行于",
     "recommendedByFieldCoverage": "根据您的数据流中的字段覆盖率推荐。",
     "listConjunctionAndTwo": "{first} 和 {last}",
-    "domainOrgMappings": {
-      "title": "域名到组织映射",
-      "subtitle": "使用匹配邮箱域名登录的新用户将自动加入该组织。",
+    "orgDomainMapping": {
+      "tabLabel": "域名管理",
+      "tabDesc": "关联您的电子邮件域名，将其用户映射到组织，并控制其中哪些用户可以加入。",
+      "loadFailed": "加载组织设置失败",
       "addMapping": "添加映射",
       "editMapping": "编辑映射",
-      "empty": "暂无映射。使用“{addLabel}”添加一个。",
-      "domain": "邮箱域名",
-      "domainHelp": "用户邮箱地址中 {at_sign} 之后的部分。",
+      "domain": "电子邮件域名",
+      "domainHelp": "用户电子邮件地址中 {at_sign} 之后的部分。该域名会关联到此组织，并且必须通过 DNS 验证。",
+      "domainHelpRequest": "用户电子邮件地址中 {at_sign} 之后的部分。OpenObserve 批准该请求后，该域名将关联到此组织。",
       "organization": "组织",
-      "organizationPlaceholder": "组织标识符",
-      "organizationHelp": "匹配用户所加入组织的标识符。",
+      "organizationHelp": "此组织或其某个账单组成员。",
       "organizationRequired": "组织为必填项",
       "baseRole": "基础角色",
-      "baseRoleHelp": "匹配用户在该组织中被赋予的角色。",
+      "baseRoleHelp": "将用户添加到该组织时授予的角色。现有成员会保留其当前角色。",
       "roleClaimName": "角色声明",
       "roleClaimNamePlaceholder": "声明名称，例如 groups",
-      "roleClaimNameHelp": "可选。列出用户自定义角色的令牌声明；每次登录时，用户在该组织中的自定义角色都会与其同步。",
-      "createMissingRoles": "创建声明中组织内不存在的角色",
-      "duplicateDomain": "该域名的映射已存在",
-      "confirmRemove": "您确定要删除 {name} 的映射吗？",
-      "deleteTitle": "删除映射"
+      "roleClaimNameHelp": "可选。列出用户自定义角色的 SSO 令牌声明。每次 SSO 登录时，该用户在该组织中的自定义角色将被替换为声明中的角色；不存在的声明角色会被跳过，除非已创建这些角色。",
+      "createMissingRoles": "创建组织中不存在的声明角色",
+      "verifyNow": "立即验证",
+      "details": "详情",
+      "detailsDialogTitle": "{domain} 的关联详情",
+      "approvedLinkInfo": "由 OpenObserve 在链接请求完成后关联。无需 DNS 记录。",
+      "pendingRequestInfo": "OpenObserve 正在审核此请求。在获批前无需执行任何操作。",
+      "rejectedRequestInfo": "OpenObserve 已拒绝此请求。",
+      "verifyDialogTitle": "验证 {domain}",
+      "recordDialogTitle": "{domain} 的 DNS 记录",
+      "lastCheckFailed": "上次检查失败：{reason}",
+      "state": {
+        "pending": "待处理",
+        "verified": "已验证",
+        "failed": "失败",
+        "requested": "等待批准",
+        "approved": "已批准",
+        "rejected": "已拒绝"
+      },
+      "saved": "域名映射已保存",
+      "saveFailed": "保存设置失败",
+      "linkFailed": "关联域名失败",
+      "unlinkFailed": "取消关联域名失败",
+      "verifyFailed": "验证失败",
+      "deleted": "映射已移除",
+      "deleteTitle": "移除映射？",
+      "deleteMappingBody": "来自 {domain} 的用户在登录时将不再被添加到 {org}。",
+      "recordInstructions": "请在你的 DNS 服务商处添加此 DNS TXT 记录：",
+      "txtNameLabel": "记录名称",
+      "txtValueLabel": "记录值",
+      "copyTxtName": "复制记录名称",
+      "copyTxtValue": "复制记录值",
+      "txtNameCopied": "记录名称已复制",
+      "txtValueCopied": "记录值已复制",
+      "verifyHint": "验证每 {minutes} 分钟自动运行一次。你也可以立即验证。",
+      "alreadyLinked": "此域名已关联到此组织",
+      "failureReason": {
+        "recordMissing": "未找到 TXT 记录",
+        "valueMismatch": "已找到 TXT 记录，但值不匹配",
+        "dnsFailed": "DNS 解析失败"
+      },
+      "pageSubtitle": "关联你的邮箱域名，将其用户映射到组织，并控制其中哪些用户可以加入。",
+      "linkedTab": "已关联域名",
+      "mappingsTab": "映射",
+      "accessTab": "被阻止的用户",
+      "requestsTab": "链接请求",
+      "linkDomain": "关联域名",
+      "sendRequest": "发送请求",
+      "linkMethod": "如何证明所有权",
+      "method": {
+        "dns": "DNS 记录",
+        "approved": "已批准的请求",
+        "request": "链接请求",
+        "dnsTitle": "添加 DNS TXT 记录",
+        "dnsDesc": "记录发布后自动验证。适合你管理域名 DNS 的情况。",
+        "requestTitle": "向 OpenObserve 请求关联",
+        "requestDesc": "我们的团队会审核该请求，并在批准后关联域名。"
+      },
+      "searchDomains": "搜索域名",
+      "searchMappings": "按域名或组织搜索",
+      "searchRequests": "按域名、组织或请求人搜索",
+      "status": "状态",
+      "linkedVia": "关联方式",
+      "lastChecked": "最后检查",
+      "linked": "域名已关联。添加 DNS 记录以完成验证。",
+      "verified": "域名已验证",
+      "notVerifiedYet": "尚未找到 DNS 记录。生效可能需要一段时间。",
+      "requestSent": "关联请求已发送",
+      "requestFailed": "发送关联请求失败",
+      "keepRecordHint": "请保留此记录。所有权每 {minutes} 分钟重新检查一次；如果该记录缺失超过 {grace} 分钟，域名将被标记为失败，其映射将停止生效。",
+      "removeDomain": "移除域名",
+      "removeTitle": "移除域名？",
+      "removeBody": "{domain} 将与此组织解除关联。",
+      "removeWithMappingsBody": "{domain} 将与此组织解除关联，其 {count} 个映射将被移除。 | {domain} 将与此组织解除关联，其 {count} 个映射将被移除。",
+      "removed": "域名已移除",
+      "domainRequired": "域名为必填项",
+      "mappingDomainHelp": "仅已验证的域名可以映射。",
+      "createsRoles": "创建角色",
+      "duplicateMapping": "该域名已映射到该组织",
+      "domainNotVerified": "未验证",
+      "noVerifiedDomains": "映射仅适用于已验证的域名。请先关联并验证域名。",
+      "goToLinked": "关联域名",
+      "goToLinkedDesc": "在映射其用户之前，请先验证您拥有的域名",
+      "enforceTitle": "从其他组织中移除用户",
+      "enforceDesc": "当来自已映射域名的用户通过 SSO 登录时，他们将被从本组织及其账单组之外的所有组织中移除。",
+      "enforceConfirmTitle": "从其他组织中移除用户？",
+      "enforceConfirmBody": "每当电子邮件域名在此处有映射的用户通过 SSO 登录时，他们将被从除本组织或其账单组之外的所有组织中移除，包括其个人组织。",
+      "enforceConfirmAction": "开启",
+      "enforceSaved": "设置已保存",
+      "blockUsers": "屏蔽用户",
+      "editBlockedUsers": "编辑被屏蔽用户",
+      "block": "屏蔽",
+      "blockedCount": "{count} 个已屏蔽 | {count} 个已屏蔽",
+      "blockedEmails": "已屏蔽邮箱",
+      "blocklistDomainHelp": "本组织的已验证域名之一。",
+      "blocklistEmailsHelp": "这些用户无法通过 SSO 加入本组织或其账单组成员，并将在下次登录时被从中移除。",
+      "ruleBlockedRequired": "至少添加一个要屏蔽的邮箱",
+      "noDomainForBlocklist": "每个已验证的域名都已有被屏蔽用户。编辑其所在行以进行更改。",
+      "unblockAll": "全部解除屏蔽",
+      "unblockAllTitle": "解除所有用户的屏蔽？",
+      "unblockAllBody": "{domain} 的所有被屏蔽用户将可在下次 SSO 登录时重新加入。",
+      "blocklistSaved": "被屏蔽用户已保存",
+      "blocklistDeleted": "用户已解除屏蔽",
+      "blocklistSection": "按域名查看被屏蔽用户",
+      "filterPending": "待处理",
+      "filterAll": "全部",
+      "requestedBy": "请求者",
+      "requestedAt": "请求时间",
+      "verifiedAt": "已验证",
+      "answeredBy": "应答者",
+      "reason": "原因",
+      "reasonHelp": "向发起请求的组织显示。",
+      "reasonRequired": "拒绝请求时必须提供原因",
+      "approve": "批准",
+      "reject": "拒绝",
+      "approveTitle": "批准关联请求？",
+      "rejectTitle": "拒绝关联请求？",
+      "approveBody": "{domain} 将在不进行 DNS 校验的情况下关联到 {org}。",
+      "rejectBody": "{org} 将无法获取 {domain}。",
+      "requestApproved": "{domain} 已关联",
+      "requestRejected": "{domain} 的请求已被拒绝",
+      "decisionFailed": "更新请求失败"
     }
   },
   "reports": {
@@ -15356,11 +15765,11 @@
     "select_detect_at_option": "请选择检测位置选项"
   },
   "search_history": {
-    "title": "搜索历史",
+    "title": "用量与成本历史",
     "get_history": "获取历史记录",
     "executed_at": "执行于",
     "sql_query": "SQL 查询",
-    "delayMessage": "搜索历史记录可能会延迟"
+    "delayMessage": "用量与成本历史可能会延迟"
   },
   "correlation": {
     "unstableDimensionNote": "不稳定的维度 - 在 Pod 重启时变化。默认：所有值。",
@@ -18784,7 +19193,9 @@
     "dataFresh": "数据很新",
     "dataGettingStale": "数据变得陈旧了",
     "dataStale": "数据已过时",
-    "lastRefreshed": "上次刷新时间：{time}"
+    "lastRefreshed": "上次刷新时间：{time}",
+    "refresh": "刷新",
+    "refreshWithAge": "刷新，上次刷新 {age}"
   },
   "synthetics": {
     "variables": {
@@ -19153,6 +19564,7 @@
       "probeError": "探针错误"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "点击",
       "actionType": "输入",
       "all": "全部",
@@ -19868,6 +20280,13 @@
       "attemptN": "Attempt {n}",
       "detailAction": "操作",
       "detailSelector": "选择器",
+      "detailStepId": "步骤 ID",
+      "detailTargetUrl": "目标 URL",
+      "detailStatus": "状态",
+      "detailSkipReason": "跳过原因",
+      "stepStatusSkipped": "已跳过",
+      "stepStatusUnknown": "未知",
+      "skippedCount": "已跳过 {n} 个",
       "downloadTrace": "下载 {filename}",
       "errorFullscreenTitle": "步骤 {id}: {action} - 错误",
       "failedAtStartLoad": "打开起始 URL 失败",
@@ -20017,7 +20436,7 @@
       "retriesMaxHint": "最大值为 {max}。重试在同一作业内运行，因此整个序列必须符合检查预算。",
       "retriesMaxBrowserHint": "浏览器检查的最大值为 {max}。每次尝试都会在每个设备上重新运行测试流程，因此更多尝试会超出探测超时，并报告您的网站从未发生过的故障。",
       "retryDelay": "等待",
-      "retryDelaySuffix": "ms 在两次重试之间。",
+      "retryDelaySuffix": "重试之间的秒数。",
       "schedule": "计划",
       "scheduleLater": "稍后安排",
       "scheduleLaterTooltip": "选择未来的日期和时间来激活支票。",
@@ -20241,6 +20660,8 @@
         "restartConfig": "重启配置 — 复制此代理的设置命令以重新运行安装 / docker 重启（例如在令牌轮换后）",
         "noAgents": "尚无代理为此位置注册。",
         "agentsUnavailable": "此位置的代理已注册到另一个集群，因此在此处不可见。",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "从此位置运行的检查",
         "checkName": "名称",
         "noChecks": "尚未为此位置分配任何检查。",
@@ -20546,7 +20967,7 @@
       "nodes": "节点",
       "modelPricing": "模型定价",
       "searchSchedulers": "搜索调度器",
-      "searchHistory": "搜索历史",
+      "searchHistory": "用量与成本历史",
       "sessions": "会话",
       "evalTemplates": "在线评估—模板",
       "scorers": "在线评估 — 评分器",
@@ -20634,7 +21055,7 @@
       "alertSourcesRefresh": "刷新列表",
       "alertTemplatesAdd": "添加新模板",
       "alertTemplatesRefresh": "刷新清单",
-      "logsSearchHistory": "打开搜索记录",
+      "logsSearchHistory": "打开用量与成本历史",
       "alertsImport": "导入告警",
       "panelEditorRun": "运行/应用查询",
       "panelEditorSave": "保存并继续编辑",
@@ -21131,6 +21552,7 @@
         "system": "系统"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "正常",
         "passed": "通过",
         "healthy": "健康",
@@ -21218,7 +21640,6 @@
     "alerts": {
       "failedToNavigateToAlert": "导航到告警失败",
       "alertNotFound": "未找到告警",
-      "alertNotFoundInAlerts": "在 {count} 个告警中未找到告警 \"{name}\"",
       "failedToLoadAlerts": "加载告警失败",
       "alertsDeletedSuccessfully": "{count} 个告警已成功删除 | {count} 个告警已成功删除",
       "failedToDeleteAlerts": "删除 {count} 个告警失败 | 删除 {count} 个告警失败",
@@ -21287,7 +21708,6 @@
       "pleaseWaitWhileLoadingTemplates": "正在加载模板，请稍候...",
       "alertSavedSuccessfully": "告警保存成功。",
       "alertUpdatedSuccessfully": "告警更新成功。",
-      "openingDedupConfig": "正在为 {name} 打开去重配置",
       "editingAlert": "正在编辑告警：{name}",
       "ack": {
         "acked": "已确认 {name}",
@@ -22170,6 +22590,7 @@
     "modelPricingEditor": "模型定价编辑器",
     "storageSettings": "存储设置",
     "domainManagement": "域名管理",
+    "orgDomainMapping": "域名管理",
     "slackApp": "Slack",
     "regexPatterns": "正则表达式模式",
     "syntheticsLocations": "合成监测位置",
@@ -26099,7 +26520,7 @@
       "logged": "已记录"
     },
     "policy": {
-      "gateHint": "在对现有告警的更改中，只有去重可单独应用，并带有先前状态快照和审核窗口：检查通过则保留，失败则回滚。其他所有更改都需一键批准。",
+      "gateHint": "在对现有告警的更改中，只有开启重复通知抑制会自动应用，并附带变更前状态快照和审查窗口：检查通过则保留，失败则回滚。其他所有更改都需要等待一键批准。",
       "off": "关闭",
       "suggest": "建议",
       "auto": "自动",
@@ -26118,7 +26539,7 @@
         "gateDesc": "将告警暂缓到调查完成，最长 2 分钟。失败时放行：如果分诊超时或失败，仍会发出告警，并说明调查仍在进行或已失败，原因会在同一线程中跟进。"
       },
       "classes": {
-        "EnableDeduplication": "为在几分钟内重复出现的告警开启去重。",
+        "EnableDeduplication": "为每次评估都通知的告警开启重复通知抑制。",
         "CreateDetector": "针对服务的请求、错误或延迟创建异常检测器。",
         "RaiseThreshold": "提高在健康日也会触发的阈值。",
         "LengthenEvaluationWindow": "延长反复抖动告警的评估窗口。",
@@ -26667,10 +27088,10 @@
           "on": "连接告警"
         },
         "L-302": {
-          "done": "将 3 个 checkout 延迟告警合并为一个",
-          "why": "它们有 94% 的时间同时触发，因此一次变慢就向您呼叫了 3 次。",
-          "from": "3 个告警",
-          "to": "1",
+          "done": "为 3 个结账延迟告警开启了重复通知抑制",
+          "why": "这些告警持续处于触发中时，每次评估都会通知，因此一次变慢就让您收到了 120 次通知。",
+          "from": "每次评估",
+          "to": "每次变更时通知一次",
           "on": "checkout 延迟"
         },
         "L-303": {
@@ -26727,7 +27148,7 @@
         "checkoutPaged": "我就 checkout 支付失败问题呼叫了值班。",
         "recsHeld": "我把 recommendations 的一个小问题留到了周五的摘要。",
         "diskApproved": "您批准将 ingest-1 上的磁盘告警阈值提高到 {to}%。",
-        "latencyGrouped": "我把 checkout 的三个变慢告警合并为一个，这样单个变慢只会呼叫一次。",
+        "latencyGrouped": "我为三个结账缓慢告警开启了重复通知抑制，因此单次变慢只会通知一次。",
         "queueFixed": "我为 orders 增加了队列 worker，但队列仍在增长，所以我把它们改了回来，并呼叫了值班。",
         "loginPaged": "我就登录变慢问题呼叫了值班。",
         "queuePermission": "您允许我自行增加队列 worker，最多 8 个。",
@@ -28083,5 +28504,71 @@
       "legend": "流水线状态",
       "legendToggle": "在地图上显示或隐藏此状态"
     }
+  },
+  "recentSearches": {
+    "title": "最近搜索",
+    "aboutKeptDays": "仅显示您在 {org} 中的搜索，且仅您可见。保留 {days} 天；星标搜索会一直保留，直到您将其移除。 | 仅显示您在 {org} 中的搜索，且仅您可见。保留 {days} 天；星标搜索会一直保留，直到您将其移除。",
+    "aboutKeptForever": "仅显示您在 {org} 中的搜索，且仅您可见。保留至删除。",
+    "pageTitle": {
+      "logs": "最近的日志搜索",
+      "traces": "最近的追踪搜索",
+      "metrics": "最近的指标搜索",
+      "dbm": "最近搜索",
+      "profiles": "最近搜索"
+    },
+    "page": {
+      "logs": "日志",
+      "traces": "追踪",
+      "metrics": "指标",
+      "dbm": "数据库",
+      "profiles": "性能分析"
+    },
+    "allPages": "所有页面",
+    "viewAll": "查看全部",
+    "failedCount": "失败 {count} 个",
+    "keyHints": "↑↓ 移动 · PgUp/PgDn 滚动查询 · Enter 运行 · Shift+Enter 仅加载 · Esc 关闭",
+    "loadToFix": "加载以修复",
+    "emptyTitle": "暂无最近搜索",
+    "loadError": "无法加载最近搜索",
+    "retry": "重试",
+    "warning": "已完成但出现警告：超时或结果不完整",
+    "failed": "失败",
+    "ranCount": "已运行 {count} 次",
+    "lineCount": "{count} 行 | {count} 行",
+    "relativeWindow": "最近 {period}",
+    "rerunNow": "立即重新运行",
+    "rerunOriginal": "按原始时间",
+    "loadOnly": "仅加载不运行",
+    "copyLink": "复制链接",
+    "copyQuery": "复制查询",
+    "star": "星标",
+    "unstar": "取消星标",
+    "linkCopied": "链接已复制",
+    "queryCopied": "查询已复制",
+    "copyFunction": "复制函数",
+    "functionCopied": "函数已复制",
+    "functionLabel": "函数 (VRL)",
+    "searchPlaceholder": "搜索查询和数据流",
+    "allStreams": "所有数据流",
+    "statusAll": "任意状态",
+    "statusOk": "成功",
+    "statusError": "失败",
+    "starredOnly": "仅星标",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "按运行日期过滤",
+    "today": "今天",
+    "yesterday": "昨天",
+    "noMatch": "没有搜索匹配这些过滤器",
+    "reset": "全部重置",
+    "resetFilters": "重置过滤器",
+    "loadMore": "加载更多",
+    "clear": "清除我的历史记录",
+    "confirmClear": "清除历史记录",
+    "clearBodyPage": "这将删除您在 {org} 中的 {count} 条最近 {page} 搜索。已保存的视图不受影响。 | 这将删除您在 {org} 中的 {count} 条最近 {page} 搜索。已保存的视图不受影响。",
+    "clearBodyAll": "这将删除您在 {org} 中跨日志、追踪和指标的 {count} 条最近搜索。已保存的视图不受影响。 | 这将删除您在 {org} 中跨日志、追踪和指标的 {count} 条最近搜索。已保存的视图不受影响。",
+    "includeStarred": "同时删除我的 {count} 条已收藏搜索 | 同时删除我的 {count} 条已收藏搜索",
+    "recentRow": "最近搜索",
+    "deletedQuery": "已删除 {query}",
+    "undo": "撤销"
   }
 }
diff --git a/web/src/locales/languages/zh-TW.json b/web/src/locales/languages/zh-TW.json
index d7ca53feab..885a4ec1c6 100644
--- a/web/src/locales/languages/zh-TW.json
+++ b/web/src/locales/languages/zh-TW.json
@@ -486,7 +486,11 @@
       "monitors": "監控器",
       "modelPricing": "模型定價定義",
       "variables": "變數",
-      "experiments": "實驗"
+      "experiments": "實驗",
+      "linkedDomains": "已連結網域",
+      "domainMappings": "網域對應",
+      "domainRequests": "連結請求",
+      "blockedUsers": "已封鎖使用者"
     },
     "demo": {
       "pageTitle": "空狀態 — 完整組合供檢視",
@@ -572,6 +576,30 @@
       "action": "新增任務",
       "actionDesc": "將 OpenObserve 指向您的端點並測試連線。"
     },
+    "noLinkedDomains": {
+      "title": "尚無已連結的網域",
+      "description": "連結您擁有的電子郵件網域，將其使用者對應到您的組織，並控制誰可以登入。",
+      "dns": "新增 DNS 記錄",
+      "dnsDesc": "使用 TXT 記錄驗證所有權",
+      "request": "請求連結",
+      "requestDesc": "請 OpenObserve 為您連結網域"
+    },
+    "noDomainMappings": {
+      "title": "尚無網域對應",
+      "description": "自動將使用已驗證網域登入的使用者新增至此組織或其帳務群組成員。",
+      "action": "新增對應",
+      "actionDesc": "選擇網域、組織與角色"
+    },
+    "noBlockedUsers": {
+      "title": "沒有已封鎖的使用者",
+      "description": "來自您已驗證網域的所有使用者都可以加入。封鎖特定使用者以阻止他們加入。",
+      "action": "封鎖使用者",
+      "actionDesc": "選擇網域及要封鎖的電子郵件"
+    },
+    "noDomainRequests": {
+      "title": "沒有連結請求",
+      "description": "組織提出連結網域的請求會顯示在此處。"
+    },
     "noDowntimes": {
       "title": "尚無停機時段",
       "description": "停機時段會讓警示、異常偵測與合成監控檢查持續運作，並在您排定的時間範圍內停止發送通知。",
@@ -1180,6 +1208,7 @@
     "turnOffLiveMode": "關閉自動執行",
     "autoRefreshWithValue": "自動重新整理：{value}",
     "searchHistory": "搜尋歷史紀錄",
+    "usageCostHistory": "使用量與成本歷程",
     "createScheduledSearch": "建立排程搜尋",
     "listScheduledSearch": "排程搜尋列表",
     "scheduleSearchJob": "排程搜尋工作",
@@ -1355,6 +1384,8 @@
     "scanSize": "掃描大小",
     "deltaScanSize": "掃描大小差異",
     "scannedSoFar": "已掃描 {size}",
+    "quickModeHiddenFields": "快速模式已開啟。此列顯示 {total} 個欄位中的 {shown} 個。",
+    "turnOffQuickMode": "關閉快速模式",
     "resultsProgressLabel": "搜尋進度",
     "histogramTitleError": "產生直方圖標題時發生錯誤。",
     "selectLogStream": "選擇日誌串流",
@@ -1817,6 +1848,8 @@
     "apiEmptyTitle": "此檢視沒有網路資料",
     "apiEmptyDescription": "所選的資料流在此時間範圍內沒有資源或網路請求。一旦應用程式對其 HTTP 呼叫進行檢測，就會出現網路指標。",
     "skipInactivity": "跳過閒置時間",
+    "fullScreen": "全螢幕",
+    "exitFullScreen": "退出全螢幕",
     "error": "錯誤",
     "errorCount": "錯誤數",
     "all": "全部",
@@ -2741,6 +2774,163 @@
         "needsTwoSteps": "新增第二個步驟,才能將此漏斗加入儀表板",
         "snapshot": "此面板會保留目前的這些步驟、篩選條件與具名事件規則。"
       }
+    },
+    "overviewPage": {
+      "regionLabel": "效能總覽",
+      "filterService": "服務",
+      "filterEnv": "環境",
+      "filterVersion": "版本",
+      "filterAll": "全部",
+      "verdictPass": "Core Web Vitals 通過",
+      "verdictFail": "Core Web Vitals 需要關注",
+      "verdictAllPass": "全部通過",
+      "verdictNeedWork": "{count} 個（共 {total} 個）需要改善 | {count} 個（共 {total} 個）需要改善",
+      "percentileLabel": "百分位",
+      "bandGood": "良好",
+      "bandNeeds": "需要改善",
+      "bandPoor": "不佳",
+      "bandGoodPct": "{n}% 良好",
+      "bandNeedsPct": "{n}% 需要改善",
+      "bandPoorPct": "{n}% 不佳",
+      "bandAria": "{good}% 良好，{needs}% 需要改善，{poor}% 不佳",
+      "vitalLcp": "最大內容繪製",
+      "vitalInp": "互動至下一次繪製",
+      "vitalCls": "累計版面配置位移",
+      "deltaFaster": "{v} 更快",
+      "deltaSlower": "{v} 更慢",
+      "deltaNone": "無變化",
+      "deltaNoPrev": "先前資料不足",
+      "kpiSessions": "工作階段",
+      "kpiErrorFree": "無錯誤工作階段",
+      "kpiErrors": "錯誤總數",
+      "kpiUnhandled": "未處理錯誤",
+      "kpiRegion": "關鍵指標",
+      "sparkAria": "{label} 在所選範圍內的趨勢",
+      "chartTitle": "工作階段與錯誤",
+      "chartInterval": "每個分桶",
+      "legendSessions": "工作階段",
+      "legendErrors": "錯誤",
+      "releaseMarker": "{version} 首次出現於 {time}",
+      "chartTableToggle": "顯示資料表",
+      "chartTableHide": "隱藏資料表",
+      "chartTime": "時間",
+      "pagesTitle": "優先修復的頁面",
+      "pagesHint": "依影響程度排序：以流量加權，權重為檢視次數中，有核心指標超過閾值或發生錯誤的比例。點擊頁面可查看其工作階段；點擊錯誤數可前往錯誤追蹤。",
+      "pagesColPage": "頁面",
+      "pagesColViews": "檢視次數",
+      "pagesColErrors": "錯誤",
+      "pagesColImpact": "影響程度",
+      "pagesLegend": "▲ 需要改善 · ■ 不佳 · 未標記表示良好。檢視次數低於 {n} 的頁面會隱藏。",
+      "pagesOpenSessions": "開啟 {path} 的工作階段",
+      "pagesOpenErrors": "{count} 個錯誤，開啟錯誤追蹤 | {count} 個錯誤，開啟錯誤追蹤",
+      "pagesImpactAria": "影響程度 {n}，滿分 100",
+      "markNeeds": "需要改善",
+      "markPoor": "不佳",
+      "diffTitle": "最大差異",
+      "diffBody": "INP p75 為 {inp}，是其他區隔的 {ratio} 倍。這是值得調查的關聯，並非已證實的原因。",
+      "diffNone": "在此範圍內沒有任何區隔特別突出。",
+      "diffLink": "檢視受影響的工作階段",
+      "segmentLabel": "區隔",
+      "segBrowser": "瀏覽器",
+      "segDevice": "裝置",
+      "segCountry": "國家",
+      "segInp": "INP {v}",
+      "segShare": "{n}% 的瀏覽",
+      "segNone": "此區隔沒有資料。",
+      "releaseTitle": "版本比較",
+      "releaseHint": "{cur} 對比 {prev}。版本起點是首次看到該版本的時間。",
+      "releaseMetric": "指標",
+      "releaseLcp": "LCP p75",
+      "releaseInp": "INP p75",
+      "releaseErrorFree": "無錯誤",
+      "releaseSessions": "工作階段",
+      "releaseLink": "{version} 的錯誤",
+      "frustrationTitle": "使用者挫折感",
+      "frustrationHint": "核心指標未能捕捉的痛點",
+      "rageClicks": "暴怒點擊",
+      "deadClicks": "無效點擊",
+      "stateLoading": "正在載入 {panel}…",
+      "stateEmptyTitle": "此範圍內沒有頁面瀏覽",
+      "stateEmptyBody": "擴大時間範圍、清除篩選條件，或確認瀏覽器 SDK 是否正在傳送瀏覽事件。",
+      "stateEmptyAction": "設定 SDK",
+      "stateLowTitle": "僅 {count} 次頁面瀏覽 | 僅 {count} 次頁面瀏覽",
+      "stateLowBody": "瀏覽次數低於 {min} 時百分位數不可靠，因此隱藏判定結果。數值僅供參考。",
+      "stateErrorTitle": "無法載入 {panel}",
+      "stateErrorBody": "查詢失敗或逾時。其他面板不受影響。",
+      "retry": "重試",
+      "panelVitals": "Core Web Vitals",
+      "panelKpis": "關鍵指標",
+      "panelPages": "頁面",
+      "panelSegments": "區隔",
+      "panelRelease": "版本比較",
+      "panelFrustration": "使用者挫折感",
+      "schemaErrorTitle": "無法載入 RUM 結構描述",
+      "schemaErrorBody": "無法讀取串流欄位，因此總覽無法決定要顯示哪些面板。",
+      "pagesShowAll": "顯示全部 {n} 個頁面",
+      "pagesShowFewer": "顯示較少頁面",
+      "pagesColLcp": "LCP p75",
+      "pagesColInp": "INP p75",
+      "verdictNeutral": "Core Web Vitals",
+      "pagesEmptyTitle": "沒有瀏覽次數足夠的頁面",
+      "pagesEmptyBody": "頁面在此範圍內至少需要 {n} 次瀏覽才能參與排名。",
+      "segEmptyTitle": "沒有區隔資料",
+      "segEmptyBody": "這些瀏覽未記錄任何瀏覽器、裝置、作業系統、國家或連線類型值。",
+      "releaseEmptyTitle": "需要兩個版本",
+      "releaseEmptyBody": "版本比較需要此範圍內至少出現兩個版本。",
+      "releaseBefore": "{version} 在此範圍之前已經上線，因此不顯示其首次出現時間。",
+      "pageErrorTitle": "無法載入效能總覽",
+      "pageErrorBody": "查詢失敗或逾時。請重試以重新載入所有面板。",
+      "verdictOver": "{vital} 在 {pct}% 的頁面瀏覽中超過 {threshold} 的良好門檻。",
+      "verdictAllThree": "三項 Core Web Vitals 在 p75 均通過。",
+      "verdictAllSome": "所有 {n} 項受評估的 Core Web Vitals 在 p75 均通過。",
+      "releaseNewErrors": "{count} 個此版本的新錯誤 | {count} 個此版本的新錯誤",
+      "verdictNoData": "沒有 Core Web Vitals 資料",
+      "verdictNoDataLead": "此範圍內的 {count} 次頁面瀏覽皆未回報 LCP、INP 或 CLS。 | 此範圍內的 {count} 次頁面瀏覽皆未回報 LCP、INP 或 CLS。",
+      "bandAtP75": "p75：{band}",
+      "vitalLinkFull": "{vital} {percentile} {value}，{band}，{delta}。開啟工作階段。",
+      "pagesTableLabel": "依影響程度排序的頁面",
+      "verdictSessions": "範圍內有 {count} 個工作階段。 | 範圍內有 {count} 個工作階段。",
+      "verdictCompare": "與前一期間相比。",
+      "deltaLower": "低 {v}",
+      "deltaHigher": "高 {v}",
+      "forbiddenTitle": "無權限檢視 {panel}",
+      "forbiddenBody": "請洽管理員以取得 RUM 資料串流的存取權。",
+      "pageForbiddenTitle": "無權限檢視效能總覽",
+      "asideLabel": "何處及何項有所變化",
+      "pagesAbout": "關於此排名",
+      "chartPerFiveMinutes": "每 5 分鐘",
+      "chartPerThirtyMinutes": "每 30 分鐘",
+      "chartPerHour": "每小時",
+      "chartPerSixHours": "每 6 小時",
+      "chartPerDay": "每日",
+      "chartIntervalOther": "每個分桶",
+      "chartTableCaption": "每個分桶的工作階段與錯誤",
+      "deltaChange": "{delta}（相較前一期間）",
+      "deltaChangePts": "{delta} 點（相較前一期間）",
+      "deltaFlat": "與前一期間相比無變化",
+      "deltaNewMsg": "相較前一期間為新增",
+      "verdictP75Note": "判定一律採用 p75；p50 與 p95 僅會改變數值。",
+      "releaseNote": "比較最新的兩個版本，無論「版本」篩選條件為何。",
+      "kpiEmptyTitle": "此範圍內沒有工作階段",
+      "kpiEmptyBody": "請擴大時間範圍或清除篩選條件。",
+      "releaseImproved": "改善",
+      "releaseWorse": "變差",
+      "segOs": "作業系統",
+      "segConnection": "連線",
+      "pagesAllLink": "所有頁面",
+      "pagesAllLinkAria": "產品分析中的所有頁面",
+      "frustrationReplayLink": "觀看重播",
+      "frustrationReplayHint": "開啟此範圍內受挫的工作階段；已錄製者才有重播。",
+      "diffSegment": "{dim}：{value}",
+      "stateEmptyQuiet": "此範圍內沒有錄製任何資料。請擴大時間範圍，或在此應用程式尚未傳送資料時設定瀏覽器 SDK。",
+      "stateEmptyFiltered": "此範圍內沒有符合這些篩選條件的項目。清除篩選條件即可查看所有服務、環境與版本。",
+      "clearFilters": "清除篩選條件",
+      "stateRefreshing": "正在重新整理 {panel}",
+      "tileOpenSessions": "{label}: {value}。開啟的工作階段",
+      "tileOpenErrors": "{label}: {value}。開啟錯誤追蹤",
+      "pagesColCls": "CLS p75",
+      "mixedBrowserNote": "此概覽僅計入瀏覽器工作階段。行動應用程式指標位於下方。",
+      "mixedMobileNote": "下方篩選器僅適用於行動應用程式指標。"
     }
   },
   "about": {
@@ -3184,6 +3374,9 @@
     "delete": "刪除",
     "confirmDeleteHead": "刪除使用者",
     "confirmDeleteMsg": "您確定要刪除使用者 {name} 嗎？",
+    "block": "封鎖",
+    "confirmBlockHead": "封鎖使用者",
+    "confirmBlockMsg": "{email} 是透過您已驗證的網域加入的。封鎖會將其加入此組織的網域限制，並將其從此組織移除。他們下次登入時會從其他已對應的組織中移除。",
     "cancel": "取消",
     "save": "儲存",
     "ok": "確定",
@@ -3228,7 +3421,8 @@
     "revokeInvitationTitle": "撤銷邀請",
     "revokeInvitationMsg": "您確定要撤銷對 {email} 的邀請嗎？",
     "deleteUsersTitle": "刪除使用者",
-    "deleteUsersMsg": "您確定要刪除 {count} 個使用者嗎？ | 您確定要刪除 {count} 個使用者嗎？"
+    "deleteUsersMsg": "您確定要刪除 {count} 個使用者嗎？ | 您確定要刪除 {count} 個使用者嗎？",
+    "deleteUsersBlockNote": "其中 {count} 位是透過您已驗證的網域加入的，將被封鎖而非刪除。"
   },
   "invitation": {
     "pendingInvitations": "待處理的邀請",
@@ -3403,8 +3597,6 @@
       },
       "show": "顯示",
       "searchPermissions": "搜尋權限",
-      "filterModules": "篩選模組",
-      "noModuleMatch": "沒有模組符合您的篩選條件",
       "moduleScopeAll": "全部",
       "moduleScopeGranted": "已選取",
       "noGrantedModule": "尚未選取任何模組",
@@ -3434,7 +3626,7 @@
       "summaryGrantsLabel": "授權 | 授權",
       "summaryReachSome": "{count} / {total}",
       "summaryEmptyTitle": "此角色尚未授予任何權限",
-      "summaryEmptyDescription": "從左側選擇模組，或從預設集開始。",
+      "summaryEmptyDescription": "從預設集開始，或從清單中選擇模組。",
       "presetReadonlyTitle": "唯讀",
       "presetReadonlyDescription": "對每個模組進行列出與取得",
       "presetDbmTitle": "資料庫監控檢視者",
@@ -3503,7 +3695,108 @@
       "k8sPresetNoMatch": "此組織中尚不存在這 {total} 個 Kubernetes 指標串流，因此未預先選取任何項目。",
       "rumPresetSeeded": "已預先選取 {total} 個 RUM 串流中 {matched} 個的讀取權限,以及來源對應檔和任何 RUM 產品分析授權。儲存前請先檢閱。",
       "rumPresetNoMatch": "此組織中尚無 {total} 個 RUM 串流中的任何一個,因此未在其上預先選取任何項目;來源對應檔和任何 RUM 產品分析授權仍已暫存。",
-      "moduleGroupFleet": "機群"
+      "moduleGroupFleet": "機群",
+      "filterModulesTasks": "篩選模組",
+      "noModuleMatchQuery": "沒有符合「{query}」的模組",
+      "noModuleMatchHint": "可依模組、群組或工作搜尋，例如 slack、panel 或 token。",
+      "presetAlertManagerTitle": "警示管理者",
+      "presetAlertManagerDescription": "建立及管理警示、警示的傳送目標及其訊息",
+      "presetAlertViewerTitle": "警示檢視者",
+      "presetAlertViewerDescription": "檢視警示、目標與範本，但不能變更",
+      "presetDashboardEditorTitle": "儀表板編輯者",
+      "presetDashboardEditorDescription": "建立及編輯儀表板，並擁有其所查詢資料的讀取權限",
+      "presetDashboardViewerTitle": "儀表板檢視者",
+      "presetDashboardViewerDescription": "開啟儀表板並讀取其面板背後的資料",
+      "presetPipelineEditorTitle": "管線編輯者",
+      "presetPipelineEditorDescription": "建立管線與函式，並擁有串流與擴充表的讀取權限",
+      "presetApplied": "{title}：已新增 {permissions}。儲存前請先檢閱變更。",
+      "presetPermissionCount": "{count} 個權限 | {count} 個權限",
+      "companionReasonAlertStreams": "儲存警示。伺服器會在儲存時檢查串流存取權",
+      "companionReasonAlertDestinations": "選擇警示的傳送目標",
+      "companionReasonDestinationTemplates": "選擇訊息範本，每個目標都需要範本",
+      "companionReasonDashboardStreams": "載入面板資料",
+      "presetsTitle": "預設集",
+      "presetsClose": "關閉預設集",
+      "presetsShow": "顯示預設集",
+      "presetsSubtitle": "將預設集的授權新增至此角色。不會移除任何項目。",
+      "presetsSectionBuiltin": "內建",
+      "presetsSectionJob": "依職務",
+      "presetAddsTooltip": "新增 {count} 個權限 | 新增 {count} 個權限",
+      "presetInRole": "已在角色中",
+      "presetInRoleTooltip": "此角色已擁有此預設集中的所有項目",
+      "presetBack": "所有預設集",
+      "presetModuleCount": "{count} 個模組 | {count} 個模組",
+      "presetSummaryAdds": "在 {modules} 中新增 {permissions}。",
+      "presetSummaryWrite": "在 {modules} 中具有寫入權限。",
+      "presetSummaryViewOnly": "僅檢視：無法建立、編輯或刪除任何項目。",
+      "presetSummaryHasAll": "此角色已擁有此預設集中的所有項目。",
+      "presetSummarySkipped": "已略過此角色已有的 {count} 個權限。 | 已略過此角色已有的 {count} 個權限。",
+      "presetStillMissing": "新增後仍缺少：{list}",
+      "presetMissingItem": "{module}：{actions}",
+      "presetNothingMissing": "新增後將不會缺少任何項目。",
+      "neededBy": "{modules} 需要",
+      "stillNeededBy": "{modules} 仍需要",
+      "presetReadsEveryStream": "可讀取此組織中的所有串流，包括新建的串流。",
+      "presetAddButton": "新增 {count} 個權限 | 新增 {count} 個權限",
+      "presetNothingToAdd": "沒有可新增的項目",
+      "presetApplyNote": "新增的授權會成為未儲存的變更。儲存前請先檢閱。",
+      "presetLoadingStreams": "正在載入串流",
+      "presetNoMatchingStreams": "此組織中尚無符合的串流。",
+      "reviewMissingTooltip": "此角色缺少 {count} 個必要模組 | 此角色缺少 {count} 個必要模組",
+      "notAddedYetTitle": "尚未新增 · {modules}",
+      "companionAdd": "新增",
+      "companionAddItem": "新增 {item}",
+      "companionAddAll": "全部新增",
+      "companionOpenStreams": "開啟串流",
+      "companionOpenStreamsTooltip": "選擇此角色可讀取哪些串流",
+      "companionNeeds": "{module} 需要它來{reason}。",
+      "companionNeedsThis": "{module} 需要此權限來{reason}。",
+      "companionStillNeedsThis": "{module} 仍需要此權限來{reason}。",
+      "yourChanges": "您的變更",
+      "yourChangesCount": "{modules} 中的 {changes}",
+      "yourChangesNone": "尚無",
+      "changeCount": "{count} 項變更 | {count} 項變更",
+      "changeOtherGroup": "其他",
+      "saveSuccessCounts": "已儲存 {modules} 中的 {changes}。",
+      "effectCan": "可以{actions}{target}。",
+      "effectCannot": "無法再{actions}{target}。",
+      "effectCanLoadDestinations": "可以載入目標清單。",
+      "effectCannotLoadDestinations": "無法再載入目標清單。",
+      "effectCanLoadTemplates": "可以載入範本清單。",
+      "effectCannotLoadTemplates": "無法再載入範本清單。",
+      "verbView": "檢視",
+      "verbSeeListOf": "在清單中檢視",
+      "verbList": "列出",
+      "verbOpen": "開啟",
+      "verbCreate": "建立",
+      "verbEdit": "編輯",
+      "verbDelete": "刪除",
+      "targetEveryStream": "所有串流（日誌、指標、追蹤與索引），包括新建立的",
+      "targetTypeStreams": "所有 {type} 串流",
+      "targetOneStream": "{type} 串流 {name}",
+      "targetAlertsEveryFolder": "所有資料夾中的警示，包括新資料夾",
+      "targetAlertsInFolder": "資料夾 {name} 中的警示",
+      "targetOneAlert": "警示 {name}",
+      "targetDashboardsEveryFolder": "所有資料夾中的儀表板，包括新資料夾",
+      "targetDashboardsInFolder": "資料夾 {name} 中的儀表板",
+      "targetOneDashboard": "儀表板 {name}",
+      "targetReportsEveryFolder": "所有資料夾中的報表，包括新資料夾",
+      "targetReportsInFolder": "資料夾 {name} 中的報表",
+      "targetOneReport": "報表 {name}",
+      "targetEveryDestination": "所有警示目標（Slack、電子郵件、Webhook），包括新建立的",
+      "targetOneDestination": "目標 {name}",
+      "targetEveryTemplate": "所有通知範本，包括新建立的",
+      "targetOneTemplate": "範本 {name}",
+      "targetAllOf": "所有 {module}，包括新建立的",
+      "targetItemIn": "{module} 中的 {name}",
+      "noteDestinationsFiltered": "他們只會看到自己也能開啟的目標。在此處或個別目標上新增「取得」，即可選擇顯示哪些目標。",
+      "noteTemplatesFiltered": "他們只會看到自己也能開啟的範本。在此處或個別範本上新增「取得」，即可選擇顯示哪些範本。",
+      "presetStreamsFailed": "無法載入串流清單。",
+      "presetRetry": "重試",
+      "presetRestored": "{title}：已還原 {permissions}。儲存前請先檢閱變更。",
+      "presetSummaryRestores": "保留您標記為移除的 {count} 個權限。 | 保留您標記為移除的 {count} 個權限。",
+      "presetRestoreButton": "保留 {count} 個權限 | 保留 {count} 個權限",
+      "effectStillAllowed": "存取權限沒有變更：更廣泛的授權仍允許此操作。"
     },
     "rolesPage": {
       "subtitle": "角色會綑綁多個權限——將角色指派給使用者、服務帳戶或群組，即可授予存取權限。",
@@ -3679,6 +3972,12 @@
       "userUpdatedSuccess": "使用者更新成功。",
       "userDeletedSuccess": "使用者刪除成功。",
       "errorDeletingUser": "刪除使用者時發生錯誤。",
+      "userBlockedSuccess": "使用者已成功封鎖。",
+      "errorBlockingUser": "封鎖使用者時發生錯誤。",
+      "blockedButNotRemoved": "使用者已被封鎖，但無法從此組織移除。",
+      "blockedUsersSuccess": "已成功封鎖 {count} 位使用者 | 已成功封鎖 {count} 位使用者",
+      "blockedUsersPartial": "已封鎖並移除 {count} 位使用者，但有 {failed} 位無法從此組織移除 | 已封鎖並移除 {count} 位使用者，但有 {failed} 位無法從此組織移除",
+      "blockedUsersNotRemoved": "已封鎖 {count} 位使用者，但無法將其從此組織移除 | 已封鎖 {count} 位使用者，但無法將其從此組織移除",
       "pleaseWait": "請稍候...",
       "invitationRevokedSuccess": "成功撤銷邀請。",
       "errorRevokingInvitation": "撤銷邀請時發生錯誤。",
@@ -5672,6 +5971,9 @@
       "k8sEbpfNote": "追蹤是透過 eBPF 擷取：無需變更程式碼或使用 SDK。追蹤上下文僅透過明文 HTTP 在服務間傳遞（Go 應用程式在未啟用核心 lockdown 的節點上也可透過 HTTPS）。符合任一連接埠、可執行檔路徑或命令列的處理程序都會被追蹤；glob 不能包含 `,`、`{'{'}` 或 `{'}'}`，且連接埠會符合在該連接埠上持有 socket 的任何處理程序。需要 Helm 3.14+ 與 OpenTelemetry Operator v0.142.0+；若您的版本較舊，請先使用 `kubectl apply -f https://github.com/open-telemetry/opentelemetry-operator/releases/download/v0.161.0/opentelemetry-operator.yaml` 升級 Operator。若已在舊版 Operator 上啟用 eBPF，請加上 `--force`（Helm 4 為 `--force-replace`）重新執行命令。重新執行上方的安裝命令會重設該 release 並關閉 eBPF，因此之後請再次執行此命令。`openobserve-collector` 命名空間必須允許特權 Pod，節點必須在 amd64 或 arm64 上執行 Linux，核心 5.8+（或含 eBPF 回溯移植的 RHEL 系列 4.18）並支援 BTF。請勿選取已自行傳送追蹤的應用程式，或使用 Go `inject-go` sidecar 的 Pod。",
       "k8sEbpfVariant": "eBPF（任何語言，無需修改程式碼）",
       "k8sLibrariesVariant": "語言函式庫（自動 Instrumentation）",
+      "k8sNetworkFlowsDesc": "收集器的 eBPF DaemonSet 會在每個 Linux 節點上記錄**透過任何 TCP 或 UDP 協定在工作負載之間傳送的位元組**，包括資料庫、快取，以及未受追蹤的其他服務。這些資料會以 `obi_network_flow_bytes` 指標的形式送達，並以來源與目標擁有者（Deployment、StatefulSet、Node、……）及命名空間加上標籤。無論是否使用 eBPF 追蹤皆可運作。",
+      "k8sNetworkFlowsNote": "需要 Helm 3.14+ 與 OpenTelemetry operator v0.142.0+。`openobserve-collector` 命名空間必須允許特權 Pod，且節點必須在 amd64 或 arm64 上執行 Linux，核心為 5.8+（或 RHEL 系列 4.18 並具備 eBPF 回移植）且支援 BTF。eBPF Pod 會在主機網路上執行，而收集器自身的指標會在各節點的 `127.0.0.1:8888` 上監聽，因此該節點上的此埠必須空閒。您已設定的 eBPF 追蹤選擇器會保留。重新執行上述安裝命令會重設 release 並關閉此功能，因此之後請再次執行此命令。相同的位元組可能被回報多次：節點之間的流量會由雙方節點各自回報，而連線至 Service 的連線也會同時對 Service 及其後方的工作負載回報。eBPF 網路流量指南說明了如何查詢這些資料而不重複計算。",
+      "k8sNetworkFlowsTitle": "查看哪些工作負載會彼此通訊：eBPF 網路流量",
       "k8sInstallerNote": "這會自動安裝 cert-manager、OpenTelemetry operator 和 OpenObserve collector。",
       "k8sInternalEndpointNote": "當 OpenObserve 在此叢集中執行時，請使用此選項 — 流量永遠不會離開叢集。",
       "k8sTroubleAnnotationA": "注入發生在 Pod 建立時，因此現有 Pod 在重新啟動前不受影響 — 執行 `kubectl rollout restart deployment -n my-namespace`。使用 `kubectl get ns my-namespace -o yaml` 確認註解已生效，並確認值符合 `openobserve-collector/openobserve-<language>`。",
@@ -5686,7 +5988,11 @@
       "k8sTroubleWebhookQ": "安裝因有關准入 webhook 的錯誤而失敗",
       "linuxAgentFixBody": "安裝程式會以 systemd 服務啟動代理程式。如果沒有收到任何資料，請確認它正在執行，並閱讀其日誌以找出驗證或連線錯誤：",
       "linuxTracesNote": "追蹤是透過 eBPF 擷取：無需變更程式碼或使用 SDK。符合任一連接埠、可執行檔路徑或命令列的處理程序都會被追蹤；glob 不能包含 `,`、`{'{'}` 或 `{'}'}`。追蹤需要具備 BTF 的 Linux 5.8+（或含 eBPF 回溯移植的 RHEL 系列 4.18）；代理程式接著會以 root 身分執行。若主機無法進行追蹤，安裝會停止，且不會更動正在執行的代理程式。若代理程式接著在啟用追蹤的情況下無法啟動，追蹤會被停用——日誌與指標也會一併停用——直到您重新執行 **日誌與指標** 命令，或修正原因後重新執行並啟用追蹤。受追蹤的應用程式會在送出的純文字 HTTP 請求中加入 W3C `traceparent` 標頭。下方的 eBPF 追蹤指南涵蓋 HTTPS 與重複旗標。",
+      "linuxNetworkFlowsDesc": "使用 `--network-flows` 執行安裝程式，以回報**此主機透過任何 TCP 或 UDP 協定傳送與接收的位元組**，並以 `obi_network_flow_bytes` 指標呈現。每個流量都會以您列出的網路標記 `src_cidr` 與 `dst_cidr`，因此請為每部主機提供相同的清單：每部主機一個 `/32` 項目即可提供主機對主機的對應表。",
+      "linuxNetworkFlowsNote": "需要 Linux 5.8+（或 RHEL 系列 4.18 並具備 eBPF 回移植）且支援 BTF；代理程式接著會以 root 身分執行。無論是否啟用追蹤皆可運作，但每次執行安裝程式都會取代代理程式的設定：若要保留追蹤，請加入 **日誌、指標與 eBPF 追蹤** 命令中的 `--trace-*` 與 `--service-name` 旗標。若主機無法執行 eBPF，安裝會停止，且不會更動正在執行的代理程式。若網路擷取接著無法啟動，代理程式會被停用——日誌與指標也會一併停用——直到您重新執行 **日誌與指標** 命令，或修正原因並以 `--network-flows` 重新執行。兩個主機都執行代理程式時，它們之間的流量會由雙方各自回報；除非兩端位址相同，否則迴環流量也會被計入。下方的 eBPF 網路流量指南說明了標籤，以及如何查詢這些資料而不重複計算。",
+      "linuxNetworkFlowsTitle": "查看哪些主機會彼此通訊：eBPF 網路流量",
       "linuxTracesVerifyNote": "啟用追蹤後，被追蹤的應用程式處理請求後即會出現追蹤資料。",
+      "ebpfNetworkFlowsGuideLink": "eBPF 網路流量指南",
       "ebpfTracingGuideLink": "eBPF 追蹤指南",
       "logsMetricsTracesVariant": "日誌、指標與 eBPF 追蹤",
       "logsMetricsVariant": "日誌和指標",
@@ -5962,6 +6268,9 @@
       "taglineOtlpTraces": "將任何 OpenTelemetry exporter 指向 OpenObserve — collector 或 SDK、HTTP 或 gRPC。您的端點和權杖已填入下方。",
       "taglineWindows": "在任何 Windows 主機上安裝 OpenObserve agent — 事件日誌、效能計數器和主機指標。",
       "testAgain": "再次測試",
+      "networkFlowsHelp": "CIDR 或 CIDR=NAME 項目，以逗號分隔且不含空格；每個 CIDR 都需要前置長度，例如 10.0.1.5/32，且名稱只能包含字母、數字、.、_ 與 -。沒有任何項目符合的位址會保持未標記；0.0.0.0/0=other 會為其餘的 IPv4 命名，::/0=other6 會為其餘的 IPv6 命名。",
+      "networkFlowsLabel": "要標記的網路",
+      "networkFlowsRequired": "請至少列出一組網路：流量會以您列出的網路加上標籤。",
       "traceCmdHelp": "適用於 Python、Node.js 和 Java 應用程式。",
       "traceCmdLabel": "命令列",
       "traceExeLabel": "執行檔路徑",
@@ -7513,6 +7822,20 @@
     "heatmapHideBelow": "隱藏低於此值的儲存格",
     "heatmapHideBelowTooltip": "值低於此值的儲存格保持空白。",
     "heatmapHideBelowNote": "低於 {value} 的儲存格已隱藏",
+    "boxplotWhisker": "鬚線",
+    "boxplotWhiskerMinMax": "最小值到最大值",
+    "boxplotWhiskerIqr": "1.5 × IQR",
+    "logsMessageField": "訊息欄位",
+    "logsLevelField": "層級欄位",
+    "logsTimeField": "時間欄位",
+    "htmlPanelFieldTooltip": "留空則從查詢結果中偵測該欄",
+    "logsOrder": "順序",
+    "logsOrderNewest": "最新優先",
+    "logsOrderOldest": "最早優先",
+    "logsOrderTooltip": "對查詢傳回的列排序。未修改的初始查詢也會依此順序擷取，因此「最早優先」會顯示最早的日誌。",
+    "logsShowTime": "顯示時間",
+    "logsWrap": "自動換行",
+    "logsPrettifyJson": "格式化 JSON",
     "distributionBucketCount": "分桶數量",
     "distributionBucketSize": "分桶大小",
     "distributionBucketSizeTooltip": "每個分桶的寬度，單位與欄位相同。設定後將取代分桶數量。",
@@ -7817,6 +8140,8 @@
       "gauge": "儀表",
       "html": "HTML",
       "markdown": "Markdown",
+      "boxplot": "箱形圖",
+      "logs": "日誌",
       "barGauge": "條形儀表",
       "distribution": "分布",
       "treemap": "矩形樹狀圖",
@@ -8316,6 +8641,14 @@
       "missingRequiredArgument": "{field}：在第 {index} 個位置缺少必要的參數",
       "fieldNotAllowedForMetric": "指標圖表不允許使用 {label} 欄位",
       "rawValueSampled": "根據前 {count} 列",
+      "addAtMostOneFieldFor": "{label} 最多新增一個欄位",
+      "boxplotMin": "最小值",
+      "boxplotMax": "最大值",
+      "boxplotLowerWhisker": "下鬚線",
+      "boxplotUpperWhisker": "上鬚線",
+      "boxplotMedian": "中位數",
+      "boxplotSamples": "樣本數",
+      "boxplotOutlier": "離群值",
       "fieldNotAllowedForDistribution": "分布圖不允許使用 {label} 欄位",
       "distributionCount": "計數",
       "addAtLeastOneFieldFor": "為 {label} 至少新增一個欄位",
@@ -8520,6 +8853,8 @@
       "urlHidden": "無存取權限",
       "urlHiddenHint": "您無法檢視此連結的儀表板，因此其公開 URL 已隱藏。",
       "orgDisabledHint": "此組織已關閉公開連結",
+      "orgDisabledBanner": "此組織已關閉公開連結，因此不會提供連結。管理員可以重新開啟。",
+      "disabledPaused": "已停用 · 已暫停",
       "takeOver": "接管",
       "takeOverTitle": "要接管此連結嗎？",
       "takeOverBody": "您將成為發佈者。公開頁面會顯示您有權檢視的內容，可能比之前多或少。擁有該 URL 的任何人仍可存取，且連結會立即生效。",
@@ -8779,6 +9114,7 @@
     "wellGroup": "分組",
     "wellSubgroup": "子分組",
     "wellSize": "大小",
+    "wellCategory": "類別",
     "value": "值"
   },
   "home": {
@@ -9682,8 +10018,8 @@
       "raiseThresholdDesc": "讓觸發值遠離觀測到的穩定狀態。",
       "lengthenEvaluationWindow": "延長評估時間範圍",
       "lengthenEvaluationWindowDesc": "擴大時間範圍，讓短暫的尖峰不再觸發警示。",
-      "enableDeduplication": "啟用去重",
-      "enableDeduplicationDesc": "將去重時間範圍內的重複觸發合併。",
+      "enableDeduplication": "開啟抑制重複通知",
+      "enableDeduplicationDesc": "每次狀態變更時通知一次，而非每次評估都通知。",
       "reviewForDeletion": "審查是否刪除",
       "reviewForDeletionDesc": "在淘汰警示前，先確認查詢仍符合實際情況。",
       "fixAlertQuery": "修正警示查詢",
@@ -10000,12 +10336,8 @@
     "organizationIdLabel": "組織 ID",
     "alertCreationTitle": "建立警示",
     "noAlertsFound": "找不到任何警示",
-    "suppressedByDeduplication": "已由去重功能抑制",
-    "occurrence": "{count} 次發生 | {count} 次發生",
     "groupedNotification": "分組通知",
     "alertsBatchedTogether": "警示批次合併",
-    "notificationSent": "通知已傳送",
-    "occurrencesDeduplicated": "已去重的發生次數",
     "alertExecutionDetails": "警示執行詳細資料",
     "evaluationTime": "評估時間",
     "queryTime": "查詢時間",
@@ -10055,15 +10387,7 @@
     "serviceGraphTooltipTo": "至：{time}",
     "serviceGraphTooltipTemporalCorrelation": "時間相關性",
     "serviceGraphTooltipServiceDependency": "服務相依性",
-    "totalAlerts": "警示總數",
-    "usingDeduplication": "使用去重",
-    "deduplicationConfiguredTooltip": "已設定去重的警示",
-    "suppressionRate24h": "抑制率 (24 小時)",
     "suppressed": "已抑制 /",
-    "total": "總計",
-    "passedLabel": "通過:",
-    "pendingBatches": "待處理批次",
-    "pendingBatchesTooltip": "等待分組的警示",
     "historyTimeline": {
       "firing": "觸發中",
       "ok": "正常",
@@ -10084,7 +10408,8 @@
     "endTime": "結束時間",
     "duration": "持續時間",
     "retries": "重試次數",
-    "dedup": "去重",
+    "suppression": "抑制",
+    "suppressedAsRepeat": "因重複而抑制",
     "validation": {
       "streamTypeRequired": "Stream 類型為必填項。",
       "streamNameRequired": "Stream 名稱為必填項。",
@@ -10276,15 +10601,6 @@
     "all": "全部",
     "history": "警示歷史紀錄",
     "searcHistory": "輸入警示名稱",
-    "deduplication": {
-      "fingerprintFields": "將相似警示分組依據",
-      "fingerprintFieldsHint": "選擇使警示相似的欄位 (例如 hostname、service)。留空以根據查詢自動偵測。",
-      "fingerprintFieldsTooltip": "選擇哪些欄位應符合才將警示視為重複。例如，選擇 'hostname' 表示來自相同主機的警示會被分組在一起。不同類型的警示 (例如高 CPU vs 高記憶體) 即使來自相同主機也不會被分組。留空以根據查詢類型自動偵測。",
-      "timeWindow": "在以下時間內視為相同",
-      "timeWindowHint": "分組相似警示的時間區段。留空以符合檢查間隔。",
-      "timeWindowTooltip": "記住近期警示以進行分組的時間長度。如果在此時間內發生相似的警示，將不會再次傳送。留空以使用警示的檢查間隔。",
-      "fingerprintFieldsHelp": "留空以根據查詢自動偵測（SQL：GROUP BY 欄位，PromQL：標籤，自訂：條件欄位）"
-    },
     "summary": {
       "scrollToBottom": "捲動至底部",
       "title": "摘要",
@@ -10332,38 +10648,15 @@
         "defaultConditions": "當設定的條件被滿足時發出警示"
       }
     },
-    "correlation": {
-      "title": "警示關聯",
-      "description": "設定警示在整個組織中如何被關聯和去重複。具有相同指紋值的警示將被分組在一起。",
-      "semanticFieldNote": "注意：語意欄位對應在「服務識別」分頁中設定。",
-      "enableOrgLevel": "啟用組織層級去重複",
-      "enableOrgLevelTooltip": "為此組織中的所有警示啟用去重複和關聯功能",
-      "enableCrossAlert": "啟用跨警示去重複",
-      "enableCrossAlertTooltip": "當不同警示共用相同指紋時允許相互去重複",
-      "fingerprintGroups": "跨警示指紋群組",
-      "fingerprintGroupsTooltip": "選擇用於跨警示指紋辨識的語意群組。具有相同維度值的警示將被去重複。",
-      "fingerprintGroupsHint": "請至少選擇一個語意群組以進行跨警示去重複",
-      "fingerprintGroupsRequired": "必須選擇至少一個語意群組",
-      "defaultWindow": "預設關聯視窗 (分鐘)",
-      "defaultWindowTooltip": "在沒有語意欄位符合的情況下，指定期間內的警示和資料視為相關",
-      "defaultWindowDescription": "在沒有語意欄位符合的情況下，指定期間內的警示和資料視為相關",
-      "defaultWindowPlaceholder": "預設使用警示期間",
-      "cancelButton": "取消",
-      "saveButton": "儲存",
-      "settingsSaved": "組織重複資料刪除設定已成功儲存",
-      "settingsSaveError": "儲存設定失敗"
-    },
     "placeholders": {
       "typeSomething": "輸入內容",
       "value": "值",
       "selectColumn": "選擇欄位",
       "savedFunctions": "已儲存的函式",
-      "autoUsesCheckInterval": "自動 (使用檢查間隔)",
       "addTag": "新增標籤並按 Enter"
     },
     "steps": {
       "compareWithPast": "與過去比較",
-      "deduplication": "去重複",
       "advanced": "進階"
     },
     "stepCaptions": {
@@ -10371,7 +10664,6 @@
       "conditions": "觸發警示的條件",
       "compareWithPast": "將目前結果與另一個時間區段的資料進行比較",
       "alertSettings": "設定警示規則並選擇通知方式。",
-      "deduplication": "將相似的警示分組在一起，避免多次傳送相同的警示。",
       "advanced": "上下文變數、說明和列範本"
     },
     "failedToFetchHistory": "擷取警示歷史紀錄失敗",
@@ -10394,8 +10686,6 @@
         "closeActions": "關閉操作",
         "viewAlertHistory": "檢視警示歷史",
         "actionsFor": "操作對象：",
-        "configureDedup": "設定去重複",
-        "configureDedupTooltip": "為此警示設定去重複",
         "editAlert": "編輯警示",
         "editAlertTooltip": "編輯警示組態",
         "viewHistory": "檢視歷史紀錄",
@@ -11175,6 +11465,8 @@
       "recoveryChatMessage": "新的「已解決」訊息",
       "keepFiringFor": "持續觸發時間",
       "keepFiringForTooltip": "條件解除後等待這麼久才恢復。0 表示立即恢復。",
+      "suppressRepeats": "抑制重複通知",
+      "suppressRepeatsTooltip": "當警示開始觸發或變更等級時通知一次，而非每次評估都通知。若保持關閉，則會在每個靜默期後繼續收到提醒。",
       "keepFiringForInvalid": "請輸入 0 秒或以上",
       "keepFiringForTooLong": "最多輸入 86400 秒 (24 小時)"
     },
@@ -13580,6 +13872,7 @@
     "emailAlreadyExists": "此電子郵件地址已被新增",
     "confirmRemoveEmail": "您確定要移除電子郵件 {email} 嗎？",
     "domainNeedsEmails": "網域 '{domain}' 在不允許所有使用者時必須至少有一個電子郵件地址",
+    "noAllowedEmailsDenyAll": "尚無允許的電子郵件，因此來自 {domain} 的每位使用者都會被拒絕。",
     "domainSettingsSaved": "網域設定儲存成功",
     "errorSavingDomainSettings": "儲存網域設定時發生錯誤",
     "noDomainMessage": "尚未設定網域。請在上方新增網域以限制存取。",
@@ -13676,7 +13969,6 @@
       "identityConfigNoSets": "儲存前請至少設定一個身分集合。",
       "discoveredServicesTab": "已發現的服務",
       "serviceDiscoveryTab": "偵測規則",
-      "alertCorrelationTab": "警示分組",
       "fieldAliasesTab": "欄位對應",
       "fieldAliasesSaved": "欄位別名儲存成功",
       "fieldAliasesSaveError": "儲存欄位別名失敗",
@@ -14074,27 +14366,144 @@
     "runsIn": "執行於",
     "recommendedByFieldCoverage": "根據您串流中的欄位覆蓋率推薦。",
     "listConjunctionAndTwo": "{first} 和 {last}",
-    "domainOrgMappings": {
-      "title": "網域至組織的對應",
-      "subtitle": "使用符合電子郵件網域登入的新使用者會自動加入該組織。",
+    "orgDomainMapping": {
+      "tabLabel": "網域管理",
+      "tabDesc": "連結您的電子郵件網域，將其使用者對應到組織，並控制其中哪些可以加入。",
+      "loadFailed": "載入組織設定失敗",
       "addMapping": "新增對應",
       "editMapping": "編輯對應",
-      "empty": "尚無對應。使用「{addLabel}」新增一筆。",
       "domain": "電子郵件網域",
-      "domainHelp": "使用者電子郵件地址中 {at_sign} 之後的部分。",
+      "domainHelp": "使用者電子郵件地址中 {at_sign} 之後的部分。該網域會連結至此組織，且必須透過 DNS 驗證。",
+      "domainHelpRequest": "使用者電子郵件地址中 {at_sign} 之後的部分。一旦 OpenObserve 核准此請求，該網域就會連結到此組織。",
       "organization": "組織",
-      "organizationPlaceholder": "組織識別碼",
-      "organizationHelp": "符合的使用者所加入之組織的識別碼。",
-      "organizationRequired": "必須填寫組織",
-      "baseRole": "基本角色",
-      "baseRoleHelp": "符合的使用者在該組織中被賦予的角色。",
+      "organizationHelp": "此組織或其帳務群組成員之一。",
+      "organizationRequired": "組織為必填",
+      "baseRole": "基礎角色",
+      "baseRoleHelp": "使用者新增至該組織時所賦予的角色。現有成員會保留目前角色。",
       "roleClaimName": "角色宣告",
       "roleClaimNamePlaceholder": "宣告名稱，例如 groups",
-      "roleClaimNameHelp": "選填。列出使用者自訂角色的權杖宣告；每次登入時，使用者在該組織中的自訂角色都會與其同步。",
-      "createMissingRoles": "建立宣告中組織內不存在的角色",
-      "duplicateDomain": "此網域的對應已存在",
-      "confirmRemove": "確定要刪除 {name} 的對應關係嗎？",
-      "deleteTitle": "刪除對應"
+      "roleClaimNameHelp": "選填。列出使用者自訂角色的 SSO 權杖宣告。每次 SSO 登入時，其在該組織中的自訂角色會以宣告的角色取代；不存在的宣告角色會被略過，除非已建立。",
+      "createMissingRoles": "建立組織中不存在的宣告角色",
+      "verifyNow": "立即驗證",
+      "details": "詳細資料",
+      "detailsDialogTitle": "{domain} 的連結詳細資料",
+      "approvedLinkInfo": "在提出連結請求後由 OpenObserve 連結。無需 DNS 記錄。",
+      "pendingRequestInfo": "OpenObserve 正在審核此請求。核准前無需進行任何操作。",
+      "rejectedRequestInfo": "OpenObserve 已拒絕此請求。",
+      "verifyDialogTitle": "驗證 {domain}",
+      "recordDialogTitle": "{domain} 的 DNS 記錄",
+      "lastCheckFailed": "上次檢查失敗：{reason}",
+      "state": {
+        "pending": "待處理",
+        "verified": "已驗證",
+        "failed": "失敗",
+        "requested": "等待核准",
+        "approved": "已核准",
+        "rejected": "已拒絕"
+      },
+      "saved": "網域對應已儲存",
+      "saveFailed": "儲存設定失敗",
+      "linkFailed": "連結網域失敗",
+      "unlinkFailed": "取消連結網域失敗",
+      "verifyFailed": "驗證失敗",
+      "deleted": "對應已移除",
+      "deleteTitle": "移除對應？",
+      "deleteMappingBody": "來自 {domain} 的使用者登入時，將不再加入 {org}。",
+      "recordInstructions": "請在您的 DNS 供應商新增此 DNS TXT 記錄：",
+      "txtNameLabel": "記錄名稱",
+      "txtValueLabel": "記錄值",
+      "copyTxtName": "複製記錄名稱",
+      "copyTxtValue": "複製記錄值",
+      "txtNameCopied": "已複製記錄名稱",
+      "txtValueCopied": "已複製記錄值",
+      "verifyHint": "驗證會每 {minutes} 分鐘自動執行。您也可以立即驗證。",
+      "alreadyLinked": "此網域已連結至此組織",
+      "failureReason": {
+        "recordMissing": "找不到 TXT 記錄",
+        "valueMismatch": "找到 TXT 記錄，但值不相符",
+        "dnsFailed": "DNS 解析失敗"
+      },
+      "pageSubtitle": "連結您的電子郵件網域，將其使用者對應至組織，並控制其中哪些使用者可以加入。",
+      "linkedTab": "已連結網域",
+      "mappingsTab": "對應",
+      "accessTab": "封鎖的使用者",
+      "requestsTab": "連結請求",
+      "linkDomain": "連結網域",
+      "sendRequest": "傳送請求",
+      "linkMethod": "如何證明所有權",
+      "method": {
+        "dns": "DNS 記錄",
+        "approved": "已核准請求",
+        "request": "連結請求",
+        "dnsTitle": "新增 DNS TXT 記錄",
+        "dnsDesc": "記錄發布後會自動驗證。適合由您管理網域 DNS 的情況。",
+        "requestTitle": "向 OpenObserve 提出連結請求",
+        "requestDesc": "我們的團隊會審核請求，並在核准後連結網域。"
+      },
+      "searchDomains": "搜尋網域",
+      "searchMappings": "依網域或組織搜尋",
+      "searchRequests": "依網域、組織或請求者搜尋",
+      "status": "狀態",
+      "linkedVia": "連結方式",
+      "lastChecked": "上次檢查",
+      "linked": "網域已連結。請新增 DNS 記錄以完成驗證。",
+      "verified": "網域已驗證",
+      "notVerifiedYet": "尚未找到 DNS 記錄。記錄可能需要一段時間才會生效。",
+      "requestSent": "連結請求已送出",
+      "requestFailed": "無法送出連結請求",
+      "keepRecordHint": "請保留此記錄。系統每 {minutes} 分鐘會重新檢查擁有權；若記錄消失超過 {grace} 分鐘，該網域將被標記為失敗，其對應關係也會停止套用。",
+      "removeDomain": "移除網域",
+      "removeTitle": "移除網域？",
+      "removeBody": "{domain} 將與此組織解除連結。",
+      "removeWithMappingsBody": "{domain} 將與此組織解除連結，其 {count} 個對應關係將被移除。 | {domain} 將與此組織解除連結，其 {count} 個對應關係將被移除。",
+      "removed": "網域已移除",
+      "domainRequired": "網域為必填",
+      "mappingDomainHelp": "僅已驗證的網域可以建立對應。",
+      "createsRoles": "建立角色",
+      "duplicateMapping": "此網域已對應至該組織",
+      "domainNotVerified": "未驗證",
+      "noVerifiedDomains": "對應關係僅適用於已驗證的網域。請先連結並驗證網域。",
+      "goToLinked": "連結網域",
+      "goToLinkedDesc": "在對應其使用者之前，請先驗證您擁有的網域",
+      "enforceTitle": "將使用者從其他組織移除",
+      "enforceDesc": "當已對應網域的使用者透過 SSO 登入時，系統會將其從此組織及其帳務群組以外的所有組織移除。",
+      "enforceConfirmTitle": "將使用者從其他組織移除？",
+      "enforceConfirmBody": "每當電子郵件網域在此有對應關係的使用者透過 SSO 登入時，系統會將其從非此組織或其帳務群組的所有組織中移除，包括其個人組織。",
+      "enforceConfirmAction": "開啟",
+      "enforceSaved": "設定已儲存",
+      "blockUsers": "封鎖使用者",
+      "editBlockedUsers": "編輯已封鎖的使用者",
+      "block": "封鎖",
+      "blockedCount": "{count} 個已封鎖 | {count} 個已封鎖",
+      "blockedEmails": "已封鎖的電子郵件",
+      "blocklistDomainHelp": "此組織其中一個已驗證的網域。",
+      "blocklistEmailsHelp": "這些使用者無法透過 SSO 加入此組織或其帳務群組成員，並會在下次登入時被移除。",
+      "ruleBlockedRequired": "請至少新增一個要封鎖的電子郵件",
+      "noDomainForBlocklist": "每個已驗證的網域都已有封鎖的使用者。請編輯其資料列以進行變更。",
+      "unblockAll": "全部解除封鎖",
+      "unblockAllTitle": "解除封鎖所有使用者？",
+      "unblockAllBody": "{domain} 的每位已封鎖使用者可在下次透過 SSO 登入時再次加入。",
+      "blocklistSaved": "已儲存封鎖的使用者",
+      "blocklistDeleted": "使用者已解除封鎖",
+      "blocklistSection": "依網域分類的封鎖使用者",
+      "filterPending": "待處理",
+      "filterAll": "全部",
+      "requestedBy": "申請者",
+      "requestedAt": "申請時間",
+      "verifiedAt": "已驗證",
+      "answeredBy": "回覆者",
+      "reason": "原因",
+      "reasonHelp": "顯示給提出請求的組織。",
+      "reasonRequired": "拒絕請求時必須提供原因",
+      "approve": "核准",
+      "reject": "拒絕",
+      "approveTitle": "核准連結請求？",
+      "rejectTitle": "拒絕連結請求？",
+      "approveBody": "{domain} 將連結至 {org}，無需 DNS 檢查。",
+      "rejectBody": "{org} 將不會取得 {domain}。",
+      "requestApproved": "{domain} 已連結",
+      "requestRejected": "{domain} 的請求已遭拒絕",
+      "decisionFailed": "更新請求失敗"
     }
   },
   "reports": {
@@ -15351,11 +15760,11 @@
     "select_detect_at_option": "請選擇偵測於選項"
   },
   "search_history": {
-    "title": "搜尋歷史紀錄",
+    "title": "使用量與成本歷程",
     "get_history": "取得歷史紀錄",
     "executed_at": "執行於",
     "sql_query": "SQL 查詢",
-    "delayMessage": "搜尋歷史紀錄可能延遲"
+    "delayMessage": "使用量與成本歷程可能延遲"
   },
   "correlation": {
     "unstableDimensionNote": "不穩定的維度 - 在 Pod 重新啟動時會變更。預設值：所有值。",
@@ -18779,7 +19188,9 @@
     "dataFresh": "資料為最新",
     "dataGettingStale": "資料逐漸過時",
     "dataStale": "資料已過時",
-    "lastRefreshed": "上次重新整理：{time}"
+    "lastRefreshed": "上次重新整理：{time}",
+    "refresh": "重新整理",
+    "refreshWithAge": "重新整理，上次重新整理於 {age}"
   },
   "synthetics": {
     "variables": {
@@ -19148,6 +19559,7 @@
       "probeError": "探測錯誤"
     },
     "filters": {
+      "error": "Error",
       "actionClick": "點擊",
       "actionType": "輸入",
       "all": "全部",
@@ -19863,6 +20275,13 @@
       "attemptN": "Attempt {n}",
       "detailAction": "動作",
       "detailSelector": "選取器",
+      "detailStepId": "步驟 ID",
+      "detailTargetUrl": "目標 URL",
+      "detailStatus": "狀態",
+      "detailSkipReason": "略過原因",
+      "stepStatusSkipped": "已略過",
+      "stepStatusUnknown": "未知",
+      "skippedCount": "已略過 {n} 個",
       "downloadTrace": "下載 {filename}",
       "errorFullscreenTitle": "步驟 {id}: {action} - 錯誤",
       "failedAtStartLoad": "開啟起始 URL 失敗",
@@ -20012,7 +20431,7 @@
       "retriesMaxHint": "上限 {max}。重試在同一作業內執行，因此整個序列必須符合檢查預算。",
       "retriesMaxBrowserHint": "瀏覽器檢查的上限為 {max}。每次嘗試都會在每個裝置上重新執行旅程，因此更多嘗試會超出探查逾時，並回報您的網站從未發生的失敗。",
       "retryDelay": "等待",
-      "retryDelaySuffix": "毫秒（重試間隔）。",
+      "retryDelaySuffix": "重試之間間隔的秒數。",
       "schedule": "排程",
       "scheduleLater": "稍後排程",
       "scheduleLaterTooltip": "選擇未來的日期和時間以啟用檢查。",
@@ -20236,6 +20655,8 @@
         "restartConfig": "重新啟動設定 — 複製此代理程式的設定命令，以重新執行安裝 / docker restart（例如在 Token 輪替之後）",
         "noAgents": "此位置尚未有代理程式註冊。",
         "agentsUnavailable": "此位置的代理程式已向另一個叢集註冊，因此在此處看不到它們。",
+        "loadFailed": "Could not load this location. Check your connection and try again.",
+        "retry": "Retry",
         "checksTitle": "從此位置執行的檢查",
         "checkName": "名稱",
         "noChecks": "此位置尚未分配任何檢查。",
@@ -20541,7 +20962,7 @@
       "nodes": "節點",
       "modelPricing": "模型定價",
       "searchSchedulers": "搜尋排程器",
-      "searchHistory": "搜尋歷史記錄",
+      "searchHistory": "使用量與成本歷程",
       "sessions": "工作階段",
       "evalTemplates": "線上評估 — 範本",
       "scorers": "線上評估 — 評分器",
@@ -20629,7 +21050,7 @@
       "alertSourcesRefresh": "重新整理清單",
       "alertTemplatesAdd": "新增範本",
       "alertTemplatesRefresh": "重新整理清單",
-      "logsSearchHistory": "開啟搜尋歷史",
+      "logsSearchHistory": "開啟使用量與成本歷程",
       "alertsImport": "匯入警示",
       "panelEditorRun": "執行/套用查詢",
       "panelEditorSave": "儲存並繼續編輯",
@@ -21126,6 +21547,7 @@
         "system": "系統"
       },
       "serviceStatus": {
+        "error": "Error",
         "up": "運行中",
         "passed": "已通過",
         "healthy": "健康",
@@ -21213,7 +21635,6 @@
     "alerts": {
       "failedToNavigateToAlert": "無法導覽至警示",
       "alertNotFound": "找不到警示",
-      "alertNotFoundInAlerts": "在 {count} 個警示中找不到警示 \"{name}\"",
       "failedToLoadAlerts": "載入警示失敗",
       "alertsDeletedSuccessfully": "{count} 個警示已成功刪除 | {count} 個警示已成功刪除",
       "failedToDeleteAlerts": "刪除 {count} 個警示失敗 | 刪除 {count} 個警示失敗",
@@ -21282,7 +21703,6 @@
       "pleaseWaitWhileLoadingTemplates": "正在載入範本，請稍候...",
       "alertSavedSuccessfully": "警示已成功儲存。",
       "alertUpdatedSuccessfully": "警示已成功更新。",
-      "openingDedupConfig": "正在開啟 {name} 的重複資料排除設定",
       "editingAlert": "正在編輯警示：{name}",
       "ack": {
         "acked": "已確認 {name}",
@@ -22165,6 +22585,7 @@
     "modelPricingEditor": "模型定價編輯器",
     "storageSettings": "儲存設定",
     "domainManagement": "網域管理",
+    "orgDomainMapping": "網域管理",
     "slackApp": "Slack",
     "regexPatterns": "正規表示式模式",
     "syntheticsLocations": "合成監控位置",
@@ -26094,7 +26515,7 @@
       "logged": "已記錄"
     },
     "policy": {
-      "gateHint": "在對現有警示的變更中，只有去重複會自行套用，並附帶先前狀態的快照與審查期：檢查通過則保留，失敗則回復。其他所有變更都需等待一鍵核准。",
+      "gateHint": "在對現有警示的變更中，只有開啟抑制重複通知會自行套用，並附帶先前狀態快照與檢閱期間：若檢查通過則保留，若失敗則復原。其他所有變更都需要一鍵核准。",
       "off": "關閉",
       "suggest": "建議",
       "auto": "自動",
@@ -26113,7 +26534,7 @@
         "gateDesc": "暫緩發送通知，直到調查完成，最多等待 2 分鐘。失敗時採開放策略：若分診逾時或失敗，仍會發送通知，並說明調查仍在進行或已失敗，原因則於討論串中接續說明。"
       },
       "classes": {
-        "EnableDeduplication": "為數分鐘內重複出現的警示開啟去重功能。",
+        "EnableDeduplication": "為每次評估都通知的警示開啟抑制重複通知。",
         "CreateDetector": "針對服務的請求、錯誤或延遲建立異常偵測器。",
         "RaiseThreshold": "提高在健康狀況良好時仍觸發的閾值。",
         "LengthenEvaluationWindow": "延長反覆震盪之警示的時間範圍。",
@@ -26662,10 +27083,10 @@
           "on": "連線警示"
         },
         "L-302": {
-          "done": "將 3 個 checkout 延遲警示合併為一個",
-          "why": "它們有 94% 的時間會同時觸發，因此一次變慢就通知您 3 次。",
-          "from": "3 個警示",
-          "to": "1",
+          "done": "已為 3 個結帳延遲警示開啟抑制重複通知",
+          "why": "它們在持續觸發期間每次評估都通知，因此單一次變慢就向您發送了 120 次通知。",
+          "from": "每次評估",
+          "to": "每次變更一次",
           "on": "checkout 延遲"
         },
         "L-303": {
@@ -26722,7 +27143,7 @@
         "checkoutPaged": "我因 checkout 付款失敗呼叫了值班。",
         "recsHeld": "我把 recommendations 的一個小問題留到週五摘要。",
         "diskApproved": "您核准將 ingest-1 的磁碟警示提高到 {to}%。",
-        "latencyGrouped": "我將三個 checkout 變慢警示合併成一個，這樣單一變慢只會呼叫值班一次。",
+        "latencyGrouped": "我已為三個結帳延遲警示開啟抑制重複通知，因此單一次變慢只會通知一次。",
         "queueFixed": "我新增了 orders 佇列工作者，但佇列持續增長，所以我把它們還原並呼叫值班。",
         "loginPaged": "我因登入緩慢呼叫了值班。",
         "queuePermission": "您允許我自行新增佇列工作者，最多 8 個。",
@@ -28078,5 +28499,71 @@
       "legend": "管線狀態",
       "legendToggle": "在地圖上顯示或隱藏此狀態"
     }
+  },
+  "recentSearches": {
+    "title": "最近搜尋",
+    "aboutKeptDays": "只有您在 {org} 中的搜尋，僅您可見。保留 {days} 天；已加星號的搜尋會保留直到您移除。 | 只有您在 {org} 中的搜尋，僅您可見。保留 {days} 天；已加星號的搜尋會保留直到您移除。",
+    "aboutKeptForever": "只有您在 {org} 中的搜尋，僅您可見。保留至刪除為止。",
+    "pageTitle": {
+      "logs": "最近的日誌搜尋",
+      "traces": "最近的追蹤搜尋",
+      "metrics": "最近的指標搜尋",
+      "dbm": "最近搜尋",
+      "profiles": "最近搜尋"
+    },
+    "page": {
+      "logs": "日誌",
+      "traces": "追蹤",
+      "metrics": "指標",
+      "dbm": "資料庫",
+      "profiles": "效能剖析"
+    },
+    "allPages": "所有頁面",
+    "viewAll": "檢視全部",
+    "failedCount": "{count} 個失敗",
+    "keyHints": "↑↓ 移動 · PgUp/PgDn 捲動查詢 · Enter 執行 · Shift+Enter 僅載入 · Esc 關閉",
+    "loadToFix": "載入以修正",
+    "emptyTitle": "尚無最近搜尋",
+    "loadError": "無法載入最近搜尋",
+    "retry": "重試",
+    "warning": "已完成但有警告：逾時或部分結果",
+    "failed": "失敗",
+    "ranCount": "已執行 {count} 次",
+    "lineCount": "{count} 行 | {count} 行",
+    "relativeWindow": "最近 {period}",
+    "rerunNow": "立即重新執行",
+    "rerunOriginal": "依原始時間",
+    "loadOnly": "僅載入不執行",
+    "copyLink": "複製連結",
+    "copyQuery": "複製查詢",
+    "star": "加星號",
+    "unstar": "取消星號",
+    "linkCopied": "已複製連結",
+    "queryCopied": "已複製查詢",
+    "copyFunction": "複製函式",
+    "functionCopied": "已複製函式",
+    "functionLabel": "函式 (VRL)",
+    "searchPlaceholder": "搜尋查詢與串流",
+    "allStreams": "所有串流",
+    "statusAll": "任何狀態",
+    "statusOk": "成功",
+    "statusError": "失敗",
+    "starredOnly": "僅星號",
+    "datePlaceholder": "dd/mm/yyyy",
+    "filterByDateRun": "依執行日期篩選",
+    "today": "今天",
+    "yesterday": "昨天",
+    "noMatch": "沒有搜尋符合這些篩選條件",
+    "reset": "全部重設",
+    "resetFilters": "重設篩選條件",
+    "loadMore": "載入更多",
+    "clear": "清除我的歷史記錄",
+    "confirmClear": "清除歷史記錄",
+    "clearBodyPage": "這會移除您在 {org} 中最近 {count} 筆 {page} 搜尋。已儲存的檢視不會受到影響。 | 這會移除您在 {org} 中最近 {count} 筆 {page} 搜尋。已儲存的檢視不會受到影響。",
+    "clearBodyAll": "這會移除您在 {org} 中最近 {count} 筆搜尋，涵蓋日誌、追蹤與指標。已儲存的檢視不會受到影響。 | 這會移除您在 {org} 中最近 {count} 筆搜尋，涵蓋日誌、追蹤與指標。已儲存的檢視不會受到影響。",
+    "includeStarred": "同時移除我的 {count} 筆已加星號搜尋 | 同時移除我的 {count} 筆已加星號搜尋",
+    "recentRow": "最近搜尋",
+    "deletedQuery": "已刪除 {query}",
+    "undo": "復原"
   }
 }
diff --git a/web/src/locales/menuTerms.spec.ts b/web/src/locales/menuTerms.spec.ts
index bd2be28f3d..61ffc793ee 100644
--- a/web/src/locales/menuTerms.spec.ts
+++ b/web/src/locales/menuTerms.spec.ts
@@ -200,7 +200,9 @@ describe("menu terms (AC-12)", () => {
     expect(fr.common.logs).toBe("Logs");
     expect(fr.menu.downtimes).toBe("Périodes de maintenance");
     expect(fr.settings.lightMode).toBe("Mode clair");
-    expect(read("fr-FR")).not.toMatch(/[Cc]analisation|[Ii]ndisponibilit|[Bb]uteur/);
+    expect(read("fr-FR")).not.toMatch(
+      /[Cc]analisation|[Ii]ndisponibilit|[Bb]uteur|[Cc]ombustion|[Gg]rumes|[Ss]urveillance réelle|[Pp]ériode d'arrêt/,
+    );
   });
 
   it("de-DE says Alarme in the header and the menu, like its items", () => {
diff --git a/web/src/plugins/logs/Index.recentReapply.spec.ts b/web/src/plugins/logs/Index.recentReapply.spec.ts
new file mode 100644
index 0000000000..428ae5c52d
--- /dev/null
+++ b/web/src/plugins/logs/Index.recentReapply.spec.ts
@@ -0,0 +1,271 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+import Index from "./Index.vue";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import router from "@/test/unit/helpers/router";
+import { readLogsSignature, resetLogsAutoRunForTests } from "@/composables/useLogs/logsAutoRun";
+import { buildLogsRecord } from "@/utils/queryHistory/logs";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { openRecentOnItsPage, recentSearchRoute } from "@/utils/queryHistory/routes";
+import { landingRouter } from "@/test/unit/helpers/recentLanding";
+
+interface SentSearch {
+  type: string;
+  queryReq: { query: { sql: string } };
+}
+
+const { sent, streams } = vi.hoisted(() => ({
+  sent: [] as SentSearch[],
+  streams: [
+    {
+      name: "app",
+      schema: [
+        { name: "_timestamp", type: "Int64" },
+        { name: "method", type: "Utf8" },
+        { name: "status", type: "Int64" },
+      ],
+      settings: {},
+    },
+  ],
+}));
+vi.mock("@/stores", async () => ({ default: (await import("@/test/unit/helpers/store")).default }));
+vi.mock("@/composables/useStreamingSearch", () => ({
+  default: () => ({
+    fetchQueryDataWithHttpStream: (payload: SentSearch) => {
+      sent.push(payload);
+      return Promise.resolve();
+    },
+    cancelStreamQueryBasedOnRequestId: vi.fn(),
+  }),
+}));
+vi.mock("@/composables/useStreams", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/composables/useStreams")>();
+  return {
+    ...actual,
+    default: () => ({
+      ...actual.default(),
+      getStream: async (name: string) => streams.find((stream) => stream.name === name),
+      getStreams: async () => ({ list: streams }),
+    }),
+  };
+});
+
+const app = document.createElement("div");
+app.id = "app";
+document.body.appendChild(app);
+
+const recorded = (query: string): QueryHistoryEntry => {
+  const signature = readLogsSignature(wrapper.vm.searchObj);
+  const body = buildLogsRecord({
+    signature: { ...signature, query, sqlMode: true, streams: ["app"] },
+    startUs: 1,
+    endUs: 2,
+    columns: [],
+    result: { status: "ok" },
+  });
+  if (!body) throw new Error("no record for " + query);
+  return {
+    ...body,
+    id: query,
+    query_key: "k",
+    starred: false,
+    run_count: 1,
+    created_at: 1,
+    updated_at: 2,
+  };
+};
+
+const Q1 = "SELECT * FROM \"app\" WHERE method = 'GET'";
+const Q2 = 'SELECT * FROM "app" WHERE status >= 500';
+
+let wrapper: ReturnType<typeof mount<typeof Index>>;
+
+const WAIT = { timeout: 5000 };
+
+interface SearchBarApi {
+  restoreRecent: (entry: QueryHistoryEntry, when: "now" | "original", run: boolean) => void;
+}
+
+const restore = async (query: string, run: boolean) => {
+  const searchBar = (wrapper.vm as unknown as { searchBarRef: SearchBarApi }).searchBarRef;
+  searchBar.restoreRecent(recorded(query), "now", run);
+  await flushPromises();
+};
+
+const searchesFor = (text: string) =>
+  sent.filter((s) => s.type === "search" && s.queryReq.query.sql.includes(text)).length;
+
+describe("Logs re-apply from recent searches", { timeout: 30000 }, () => {
+  beforeEach(async () => {
+    resetLogsAutoRunForTests();
+    sent.length = 0;
+    (store.state as Record<string, unknown>).logs = { isInitialized: true, logs: {} };
+    vi.spyOn(store, "dispatch").mockResolvedValue(undefined as never);
+    wrapper = mount(Index, {
+      attachTo: "#app",
+      global: { provide: { store }, plugins: [i18n, router] },
+    });
+    await flushPromises();
+  });
+
+  afterEach(() => {
+    wrapper?.unmount();
+    vi.restoreAllMocks();
+    resetLogsAutoRunForTests();
+  });
+
+  it("applies two re-runs of different rows in a row", async () => {
+    const state = wrapper.vm.searchObj;
+    await restore(Q1, true);
+    await vi.waitFor(() => expect(state.data.query).toBe(Q1), WAIT);
+    await restore(Q2, true);
+    await vi.waitFor(() => expect(state.data.query).toBe(Q2), WAIT);
+    expect(state.data.editorValue).toBe(Q2);
+    await vi.waitFor(() => expect(searchesFor("status >= 500")).toBe(1), WAIT);
+  });
+
+  it("runs the same row twice when it is re-run twice", async () => {
+    await restore(Q2, true);
+    await vi.waitFor(() => expect(searchesFor("status >= 500")).toBe(1), WAIT);
+    await restore(Q2, true);
+    await vi.waitFor(() => expect(searchesFor("status >= 500")).toBe(2), WAIT);
+  });
+
+  it("loads without running after a re-run, so no run request leaks into the next restore", async () => {
+    const state = wrapper.vm.searchObj;
+    await restore(Q2, true);
+    await vi.waitFor(() => expect(searchesFor("status >= 500")).toBe(1), WAIT);
+    await restore(Q1, false);
+    await vi.waitFor(() => expect(state.data.query).toBe(Q1), WAIT);
+    await flushPromises();
+    expect(searchesFor("method = 'GET'")).toBe(0);
+  });
+
+  it("runs only the last of two overlapping restores when that one asked to run", async () => {
+    const state = wrapper.vm.searchObj;
+    const searchBar = (wrapper.vm as unknown as { searchBarRef: SearchBarApi }).searchBarRef;
+    searchBar.restoreRecent(recorded(Q1), "now", false);
+    searchBar.restoreRecent(recorded(Q2), "now", true);
+    await vi.waitFor(() => expect(searchesFor("status >= 500")).toBe(1), WAIT);
+    await flushPromises();
+    expect(state.data.query).toBe(Q2);
+    expect(searchesFor("method = 'GET'")).toBe(0);
+    expect(searchesFor("status >= 500")).toBe(1);
+  });
+
+  it("re-applies an AI-chat landing once, not again when a column or the refresh interval changes the URL", async () => {
+    const state = wrapper.vm.searchObj;
+    const org = store.state.selectedOrganization.identifier;
+    const landing = recentSearchRoute(recorded(Q1), "now", org, "load")!;
+    const query = { ...landing.query, type: "ai_chat_query" };
+    router.currentRoute.value = router.resolve({ ...landing, query });
+    await vi.waitFor(() => expect(state.data.query).toBe(Q1), WAIT);
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    await flushPromises();
+
+    state.data.editorValue = Q2;
+    state.data.query = Q2;
+    router.currentRoute.value = router.resolve({
+      ...landing,
+      query: { ...query, fields: "status" },
+    });
+    await flushPromises();
+    router.currentRoute.value = router.resolve({
+      ...landing,
+      query: { ...query, fields: "status", refresh: "10" },
+    });
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    await flushPromises();
+    expect(state.data.editorValue).toBe(Q2);
+    expect(state.data.query).toBe(Q2);
+  });
+
+  it("does not run a re-run that a load-only restore overtook", async () => {
+    const state = wrapper.vm.searchObj;
+    const searchBar = (wrapper.vm as unknown as { searchBarRef: SearchBarApi }).searchBarRef;
+    searchBar.restoreRecent(recorded(Q2), "now", true);
+    searchBar.restoreRecent(recorded(Q1), "now", false);
+    await vi.waitFor(() => expect(state.data.query).toBe(Q1), WAIT);
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    await flushPromises();
+    expect(searchesFor("status >= 500")).toBe(0);
+    expect(searchesFor("method = 'GET'")).toBe(0);
+  });
+});
+
+describe("Logs landing for a restore from another page", { timeout: 30000 }, () => {
+  beforeEach(async () => {
+    // The server default: the picker's first emit on mount does not search.
+    store.state.zoConfig.query_on_stream_selection = true;
+    resetLogsAutoRunForTests();
+    sent.length = 0;
+    (store.state as Record<string, unknown>).logs = { isInitialized: true, logs: {} };
+    vi.spyOn(store, "dispatch").mockImplementation((async (type: string, payload: unknown) => {
+      if (type === "logs/setIsInitialized") {
+        (store.state as { logs: { isInitialized: unknown } }).logs.isInitialized = payload;
+      }
+    }) as never);
+    wrapper = mount(Index, {
+      attachTo: "#app",
+      global: { provide: { store }, plugins: [i18n, router] },
+    });
+    await flushPromises();
+  });
+
+  afterEach(() => {
+    wrapper?.unmount();
+    vi.restoreAllMocks();
+    resetLogsAutoRunForTests();
+    store.state.zoConfig.query_on_stream_selection = false;
+  });
+
+  // The page left with Q1 cached for the same stream and org, then another page restores Q2 here.
+  const landWith = async (run: boolean) => {
+    await restore(Q1, false);
+    await vi.waitFor(() => expect(wrapper.vm.searchObj.data.query).toBe(Q1), WAIT);
+    const entry = recorded(Q2);
+    wrapper.unmount();
+    sent.length = 0;
+    const org = store.state.selectedOrganization.identifier;
+    await openRecentOnItsPage(landingRouter().router, entry, "now", org, run);
+    // A full navigation never settles in this harness; the landing reads only the current route.
+    router.currentRoute.value = router.resolve(
+      recentSearchRoute(entry, "now", org, run ? "run" : "load")!,
+    );
+    wrapper = mount(Index, {
+      attachTo: "#app",
+      global: { provide: { store }, plugins: [i18n, router] },
+    });
+    await flushPromises();
+  };
+
+  it("applies the picked query over the cached one, and Load without running does not run it", async () => {
+    await landWith(false);
+    await vi.waitFor(() => expect(wrapper.vm.searchObj.data.query).toBe(Q2), WAIT);
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    await flushPromises();
+    expect(searchesFor("status >= 500")).toBe(0);
+  });
+
+  it("runs the picked query once when it was restored with Run", async () => {
+    await landWith(true);
+    await vi.waitFor(() => expect(wrapper.vm.searchObj.data.query).toBe(Q2), WAIT);
+    await vi.waitFor(() => expect(searchesFor("status >= 500")).toBe(1), WAIT);
+  });
+});
diff --git a/web/src/plugins/logs/Index.vue b/web/src/plugins/logs/Index.vue
index 1d99872a75..4598c16fda 100644
--- a/web/src/plugins/logs/Index.vue
+++ b/web/src/plugins/logs/Index.vue
@@ -328,7 +328,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         :query-window-us="queryWindowUs"
                         :timezone="store.state.timezone"
                         @jump-to-stream-data="onJumpToStreamData"
-                        @open-history="showSearchHistoryfn"
+                        @open-history="openSearchHistory"
                         @ask-ai="onAskAiFixQuery"
                       />
                     </div>
@@ -567,7 +567,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :query-window-us="queryWindowUs"
               :timezone="store.state.timezone"
               @jump-to-stream-data="onJumpToStreamData"
-              @open-history="showSearchHistoryfn"
+              @open-history="openSearchHistory"
               @ask-ai="onAskAiFixQuery"
             />
             <OEmptyState
@@ -703,6 +703,8 @@ import useBreakpoint from "@/composables/useBreakpoint";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import LogsNoEventsState from "@/plugins/logs/LogsNoEventsState.vue";
+import { logsReapplyRequest } from "@/utils/queryHistory/logs";
+import { takeRecentLanding } from "@/utils/queryHistory/routes";
 import LogsNoDataState from "@/plugins/logs/LogsNoDataState.vue";
 import FirstDataPanel from "@/components/ingestion/FirstDataPanel.vue";
 import type { FirstEventResult } from "@/composables/firstEvent/useFirstEventWatch";
@@ -1184,10 +1186,13 @@ export default defineComponent({
         }
       },
     );
+    // Two primitive sources, so other route changes never re-apply; a recent-searches restore bumps seq to restore one row twice.
     watch(
-      () => router.currentRoute.value.query.type,
-      async (type) => {
-        if (type == "search_history_re_apply" || type == "ai_chat_query") {
+      [() => router.currentRoute.value.query.type, () => logsReapplyRequest.value.seq],
+      async ([type, seq], [, prevSeq]) => {
+        const requested = seq !== prevSeq;
+        const runRequested = requested && logsReapplyRequest.value.run;
+        if (requested || type === "search_history_re_apply" || type === "ai_chat_query") {
           searchObj.meta.jobId = "";
           resetRunStateForReapply();
 
@@ -1197,11 +1202,7 @@ export default defineComponent({
           resetSearchObj();
 
           // Set time range based on source type
-          if (
-            type == "ai_chat_query" &&
-            router.currentRoute.value.query.from &&
-            router.currentRoute.value.query.to
-          ) {
+          if (router.currentRoute.value.query.from && router.currentRoute.value.query.to) {
             searchBarRef.value.dateTimeRef.setAbsoluteTime(
               router.currentRoute.value.query.from,
               router.currentRoute.value.query.to,
@@ -1224,6 +1225,8 @@ export default defineComponent({
           await getFunctions();
           await extractFields();
           refreshData();
+          // A newer restore started meanwhile; it carries its own run decision.
+          if (runRequested && logsReapplyRequest.value.seq === seq) runQueryFn();
         }
       },
     );
@@ -1505,6 +1508,8 @@ export default defineComponent({
       try {
         // restoreUrlQueryParams() deletes a search_history_re_apply `type` off the route, so read it first.
         const arrivalType = router.currentRoute.value.query.type;
+        // Claimed on arrival, so a restore that lands on another tab is not left for a later landing.
+        const landing = takeRecentLanding("logs");
         isRouteChanged();
         if (!store.state.logs.isInitialized) {
           searchObj.organizationIdentifier = store.state.selectedOrganization.identifier;
@@ -1561,6 +1566,7 @@ export default defineComponent({
           if (isLogsTab() || searchObj.meta.logsVisualizeToggle === "drilldown") {
             if (RE_APPLY_QUERY_TYPES.includes(arrivalType)) {
               await applyReAppliedQuery();
+              if (landing?.run) runQueryFn();
             } else {
               searchObj.loading = true;
               loadLogsData("landing", { origin: currentInitOrigin() ?? undefined });
@@ -1964,6 +1970,11 @@ export default defineComponent({
         handleRunQueryFn();
       }
     };
+    // The usage page stays the fallback when recent searches are turned off.
+    const openSearchHistory = () => {
+      if (!searchBarRef.value?.openRecentSearches?.()) showSearchHistoryfn();
+    };
+
     const showSearchHistoryfn = () => {
       // Search History is now its own route (was an `action=history` overlay).
       // Forward the active stream type/name so the history shown there matches
@@ -4087,6 +4098,7 @@ export default defineComponent({
       onChangeInterval,
       onAutoIntervalTrigger,
       showSearchHistoryfn,
+      openSearchHistory,
       isAiEnabled,
       onSelectStream,
       onPickStream,
diff --git a/web/src/plugins/logs/SearchBar.recentFocusEscape.spec.ts b/web/src/plugins/logs/SearchBar.recentFocusEscape.spec.ts
new file mode 100644
index 0000000000..ba4ee9c087
--- /dev/null
+++ b/web/src/plugins/logs/SearchBar.recentFocusEscape.spec.ts
@@ -0,0 +1,255 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { defineComponent, h, nextTick } from "vue";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import router from "@/test/unit/helpers/router";
+import SearchBar from "@/plugins/logs/SearchBar.vue";
+
+interface FocusDropdownVm {
+  recentFocusOpen: boolean;
+  onQueryEditorFocus: () => void;
+  queryEditorBoxRef: HTMLElement | null;
+}
+
+describe("logs recent-searches focus dropdown and the editor's Escape", () => {
+  let wrapper: VueWrapper | null = null;
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+    vi.clearAllMocks();
+  });
+
+  it("closes the dropdown on Escape and still lets the editor handle it", async () => {
+    wrapper = mount(SearchBar, {
+      attachTo: document.body,
+      global: {
+        provide: { store },
+        plugins: [i18n, router],
+        stubs: { QueryEditor: true, RecentSearchesFocusDropdown: true },
+      },
+    });
+    const vm = wrapper.vm as unknown as FocusDropdownVm;
+    expect(vm.queryEditorBoxRef).not.toBeNull();
+    // Stands in for Monaco, whose Escape binding moves focus out of the editor and stops the event.
+    const editorEscape = vi.fn();
+    const editor = document.createElement("textarea");
+    editor.addEventListener("keydown", (e) => {
+      if (e.key !== "Escape") return;
+      editorEscape(e.defaultPrevented);
+      e.stopPropagation();
+    });
+    const monaco = document.createElement("div");
+    monaco.className = "monaco-editor";
+    monaco.appendChild(editor);
+    vm.queryEditorBoxRef!.appendChild(monaco);
+    vm.recentFocusOpen = true;
+    await nextTick();
+
+    editor.dispatchEvent(
+      new KeyboardEvent("keydown", { key: "Escape", bubbles: true, cancelable: true }),
+    );
+
+    expect(vm.recentFocusOpen).toBe(false);
+    expect(editorEscape).toHaveBeenCalledExactlyOnceWith(false);
+  });
+
+  it("hides the typing placeholder while the dropdown is open, so only one list changes", async () => {
+    wrapper = mount(SearchBar, {
+      attachTo: document.body,
+      global: {
+        provide: { store },
+        plugins: [i18n, router],
+        stubs: { QueryEditor: true, RecentSearchesFocusDropdown: true },
+      },
+    });
+    const vm = wrapper.vm as unknown as FocusDropdownVm & {
+      searchObj: { data: { editorValue: string }; meta: Record<string, unknown> };
+    };
+    vm.searchObj.data.editorValue = "";
+    vm.searchObj.meta.queryEditorPlaceholderFlag = true;
+    vm.searchObj.meta.nlpMode = false;
+    vm.recentFocusOpen = false;
+    await nextTick();
+    expect(wrapper.find(".query-editor-placeholder-overlay").exists()).toBe(true);
+
+    vm.recentFocusOpen = true;
+    await nextTick();
+    expect(wrapper.find(".query-editor-placeholder-overlay").exists()).toBe(false);
+
+    vm.recentFocusOpen = false;
+    await nextTick();
+    expect(wrapper.find(".query-editor-placeholder-overlay").exists()).toBe(true);
+  });
+
+  it("opens when an edit clears the focused editor and closes on the next character", async () => {
+    store.state.zoConfig.query_history_enabled = true;
+    wrapper = mount(SearchBar, {
+      attachTo: document.body,
+      global: {
+        provide: { store },
+        plugins: [i18n, router],
+        stubs: { QueryEditor: true, RecentSearchesFocusDropdown: true },
+      },
+    });
+    const vm = wrapper.vm as unknown as FocusDropdownVm & {
+      onEditorUserEdit: (isBlank: boolean, wasBlank: boolean) => void;
+      searchObj: { data: { editorValue: string; query: string } };
+    };
+    vm.searchObj.data.editorValue = "code=200";
+    vm.onQueryEditorFocus();
+    expect(vm.recentFocusOpen).toBe(false);
+
+    vm.onEditorUserEdit(true, false);
+    expect(vm.recentFocusOpen).toBe(true);
+    vm.onEditorUserEdit(false, true);
+    expect(vm.recentFocusOpen).toBe(false);
+
+    vm.searchObj.data.editorValue = "";
+    vm.onQueryEditorFocus();
+    expect(vm.recentFocusOpen).toBe(true);
+    vm.recentFocusOpen = false;
+    vm.onEditorUserEdit(true, false);
+    expect(vm.recentFocusOpen).toBe(true);
+    delete store.state.zoConfig.query_history_enabled;
+  });
+
+  it("stays closed when Escape in the list hands focus back to the editor, until the next real focus", async () => {
+    store.state.zoConfig.query_history_enabled = true;
+    const route = router.currentRoute.value;
+    router.currentRoute.value = router.resolve({ name: "logs" });
+    // Monaco fires its focus event inside focus(), in the same tick as the dismissal.
+    const EditorStub = defineComponent({
+      emits: ["focus"],
+      setup(_, { emit, expose }) {
+        expose({ focus: () => emit("focus") });
+        return () => h("div");
+      },
+    });
+    wrapper = mount(SearchBar, {
+      attachTo: document.body,
+      global: {
+        provide: { store },
+        plugins: [i18n, router],
+        stubs: { QueryEditor: EditorStub, RecentSearchesFocusDropdown: true },
+      },
+    });
+    await vi.dynamicImportSettled();
+    await flushPromises();
+    const vm = wrapper.vm as unknown as FocusDropdownVm & {
+      onEditorUserEdit: (isBlank: boolean, wasBlank: boolean) => void;
+      searchObj: { data: { editorValue: string; query: string } };
+    };
+    vm.searchObj.data.editorValue = "";
+    vm.searchObj.data.query = "";
+    vm.onQueryEditorFocus();
+    expect(vm.recentFocusOpen).toBe(true);
+
+    const dropdown = wrapper.findComponent({ name: "RecentSearchesFocusDropdown" });
+    dropdown.vm.$emit("update:open", false);
+    dropdown.vm.$emit("dismiss");
+    await nextTick();
+    expect(vm.recentFocusOpen).toBe(false);
+
+    vm.onQueryEditorFocus();
+    expect(vm.recentFocusOpen).toBe(true);
+    vm.recentFocusOpen = false;
+
+    dropdown.vm.$emit("dismiss");
+    vm.onEditorUserEdit(false, true);
+    vm.onEditorUserEdit(true, false);
+    expect(vm.recentFocusOpen).toBe(true);
+    delete store.state.zoConfig.query_history_enabled;
+    router.currentRoute.value = route;
+  });
+
+  describe("in the full-screen editor", () => {
+    type FullScreenVm = FocusDropdownVm & {
+      isFocused: boolean;
+      noteEditorPointer: () => void;
+      handleEscKey: (event: KeyboardEvent) => void;
+      searchObj: { data: { editorValue: string } };
+    };
+    const mountFullScreen = async () => {
+      store.state.zoConfig.query_history_enabled = true;
+      wrapper = mount(SearchBar, {
+        attachTo: document.body,
+        global: {
+          provide: { store },
+          plugins: [i18n, router],
+          stubs: { QueryEditor: true, RecentSearchesFocusDropdown: true },
+        },
+      });
+      const vm = wrapper.vm as unknown as FullScreenVm;
+      vm.searchObj.data.editorValue = "";
+      vm.isFocused = true;
+      await nextTick();
+      return vm;
+    };
+    afterEach(() => {
+      delete store.state.zoConfig.query_history_enabled;
+    });
+
+    it("opens for a click into the editor, not for a scripted focus", async () => {
+      const vm = await mountFullScreen();
+      vm.onQueryEditorFocus();
+      expect(vm.recentFocusOpen).toBe(false);
+      vm.noteEditorPointer();
+      vm.onQueryEditorFocus();
+      expect(vm.recentFocusOpen).toBe(true);
+    });
+
+    it("closes only the list on the first Esc and keeps the editor's Esc from running", async () => {
+      const vm = await mountFullScreen();
+      const editorEscape = vi.fn();
+      const monaco = document.createElement("div");
+      monaco.className = "monaco-editor";
+      const editor = document.createElement("textarea");
+      editor.addEventListener("keydown", editorEscape);
+      monaco.appendChild(editor);
+      vm.queryEditorBoxRef!.appendChild(monaco);
+      vm.recentFocusOpen = true;
+      await nextTick();
+
+      const escape = new KeyboardEvent("keydown", {
+        key: "Escape",
+        bubbles: true,
+        cancelable: true,
+      });
+      editor.dispatchEvent(escape);
+
+      expect(vm.recentFocusOpen).toBe(false);
+      expect(escape.defaultPrevented).toBe(true);
+      expect(editorEscape).not.toHaveBeenCalled();
+      expect(vm.isFocused).toBe(true);
+    });
+
+    it("keeps full-screen while a recent-searches list or drawer takes the Esc", async () => {
+      const vm = await mountFullScreen();
+      const layer = document.createElement("div");
+      layer.setAttribute("data-test", "recent-searches-drawer");
+      document.body.appendChild(layer);
+      vm.handleEscKey(new KeyboardEvent("keydown", { key: "Escape" }));
+      expect(vm.isFocused).toBe(true);
+      layer.remove();
+      vm.handleEscKey(new KeyboardEvent("keydown", { key: "Escape" }));
+      expect(vm.isFocused).toBe(false);
+    });
+  });
+});
diff --git a/web/src/plugins/logs/SearchBar.vue b/web/src/plugins/logs/SearchBar.vue
index b4dd00237e..47927d5c98 100644
--- a/web/src/plugins/logs/SearchBar.vue
+++ b/web/src/plugins/logs/SearchBar.vue
@@ -694,7 +694,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   <OIcon name="history" size="sm" />
                 </span>
               </template>
-              {{ t("search.searchHistory") }}
+              {{ t("search.usageCostHistory") }}
             </ODropdownItem>
           </ODropdownGroup>
 
@@ -999,6 +999,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 </div>
               </ODropdown>
             </OButtonGroup>
+            <RecentSearchesButton
+              source="logs"
+              :examples="recentExamples"
+              data-test="logs-search-bar-recent-searches-btn"
+              @run="(entry, when) => restoreRecent(entry, when, true)"
+              @load="(entry, when) => restoreRecent(entry, when, false)"
+              @view-all="openRecentSearches"
+              @example="applyRecentExample"
+            />
             <div
               v-if="
                 searchObj.meta.logsVisualizeToggle === 'visualize' ||
@@ -1306,7 +1315,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         >
           <template #before>
             <div
+              ref="queryEditorBoxRef"
               class="relative flex h-full flex-col overflow-hidden"
+              @keydown.capture="onRecentEditorKeydown"
+              @pointerdown.capture="noteEditorPointer"
               :class="{
                 'rounded-r-none border-e-0': searchObj.data.transformType,
                 'fn-editor-open': showFunctionEditor,
@@ -1320,6 +1332,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 :keywords="effectiveKeywords"
                 :suggestions="effectiveSuggestions"
                 :field-value-resolver="resolveFieldValues"
+                :recent-queries="recentQueries"
                 :debounce-time="100"
                 :nlp-mode="searchObj.meta.nlpMode"
                 :has-expand-button="!showFunctionEditor"
@@ -1352,12 +1365,25 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 @focus="onQueryEditorFocus"
                 @blur="handleQueryEditorBlur"
               />
+              <RecentSearchesFocusDropdown
+                ref="recentFocusRef"
+                v-model:open="recentFocusOpen"
+                source="logs"
+                :anchor="queryEditorBoxRef"
+                :examples="recentExamples"
+                @run="(entry, when) => restoreRecent(entry, when, true)"
+                @load="(entry, when) => restoreRecent(entry, when, false)"
+                @view-all="openRecentSearches"
+                @example="applyRecentExample"
+                @dismiss="dismissRecentFocus"
+              />
               <!-- Query editor placeholder overlay — shown when editor is empty and unfocused -->
               <div
                 v-if="
                   searchObj.data.editorValue == '' &&
                   searchObj.meta.queryEditorPlaceholderFlag &&
-                  !searchObj.meta.nlpMode
+                  !searchObj.meta.nlpMode &&
+                  !recentFocusOpen
                 "
                 class="query-editor-placeholder-overlay pointer-events-none absolute top-0 right-0 bottom-0 left-0 z-1 flex items-start [padding:0.1875rem_0.5rem_0_2.15rem] select-none"
               >
@@ -1429,6 +1455,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </div>
     </div>
 
+    <RecentSearchesDrawer ref="recentDrawerRef" source="logs" @restore="restoreRecent" />
     <ODialog
       data-test="search-bar-confirm-dialog"
       ref="confirmDialog"
@@ -1743,6 +1770,28 @@ import DateTime from "@/components/DateTime.vue";
 import ShareButton from "@/components/common/ShareButton.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
+import RecentSearchesButton from "@/components/queryHistory/RecentSearchesButton.vue";
+import RecentSearchesDrawer from "@/components/queryHistory/RecentSearchesDrawer.vue";
+import RecentSearchesFocusDropdown from "@/components/queryHistory/RecentSearchesFocusDropdown.vue";
+import {
+  useRecentSearches,
+  useRecentSearchesList,
+} from "@/composables/queryHistory/useRecentSearches";
+import { useLogsHistoryRecorder } from "@/composables/queryHistory/useLogsHistoryRecorder";
+import {
+  recentQueryList,
+  recentsOpenAfterEdit,
+  routeEditorKeyToRecents,
+  type RestoreTime,
+} from "@/utils/queryHistory/recentSearches";
+import { openRecentOnItsPage } from "@/utils/queryHistory/routes";
+import {
+  isUntouchedLogsQuery,
+  logsExampleQueries,
+  logsRouteQuery,
+  requestLogsReapply,
+} from "@/utils/queryHistory/logs";
+import type { HistoryStatus, QueryHistoryEntry } from "@/services/query_history";
 import OSplitter from "@/lib/core/Splitter/OSplitter.vue";
 import useLogs from "@/composables/useLogs";
 import { useToolbarResponsive } from "@/composables/useToolbarResponsive";
@@ -1757,6 +1806,9 @@ import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDi
 import { checkFeatureAccess, buildFeatureGateContext } from "@/utils/enterpriseFeatures";
 // Unified QueryEditor for main query editor (with built-in AI bar)
 const UnifiedQueryEditor = defineAsyncComponent(() => import("@/components/QueryEditor.vue"));
+const RECENT_SEARCHES_LAYERS =
+  '[data-test="recent-searches-popover"], [data-test="recent-searches-drawer"]';
+const EDITOR_POINTER_FOCUS_MS = 1000;
 
 import AutoRefreshInterval from "@/components/AutoRefreshInterval.vue";
 import useSqlSuggestions from "@/composables/useSuggestions";
@@ -1947,6 +1999,9 @@ export default defineComponent({
     OSwitch,
     OTree,
     SavedViewsListDialog,
+    RecentSearchesButton,
+    RecentSearchesDrawer,
+    RecentSearchesFocusDropdown,
   },
   emits: [
     "searchdata",
@@ -2217,6 +2272,10 @@ export default defineComponent({
 
     const { isStreamExists, isStreamFetched, getStreams, getStream } = useStreams(t);
     const queryEditorRef = ref(null);
+    const queryEditorBoxRef = ref<HTMLElement | null>(null);
+    const recentFocusRef = ref<InstanceType<typeof RecentSearchesFocusDropdown> | null>(null);
+    const recentDrawerRef = ref<InstanceType<typeof RecentSearchesDrawer> | null>(null);
+    const recentFocusOpen = ref(false);
     const syntaxGuideRef = ref(null);
 
     const {
@@ -2244,10 +2303,18 @@ export default defineComponent({
     const onQueryEditorFocus = () => {
       searchObj.meta.queryEditorPlaceholderFlag = false;
       _sqlOnFocus();
+      openRecentOnFocus();
     };
 
     const focusEditor = () => queryEditorRef.value?.focus?.();
 
+    // Escape in the list hands focus back to the editor, and that focus must not reopen the list.
+    let recentFocusDismissed = false;
+    const dismissRecentFocus = () => {
+      recentFocusDismissed = true;
+      focusEditor();
+    };
+
     const handleQueryEditorBlur = async () => {
       searchObj.meta.queryEditorPlaceholderFlag = true;
       await _sqlOnBlur();
@@ -2962,10 +3029,11 @@ export default defineComponent({
       }
       autoRun.engine.reconcileEditorDirty();
     };
+    // Esc first closes an open recent-searches list or drawer; only the next one leaves full-screen.
     const handleEscKey = (event: KeyboardEvent) => {
-      if (event.key === "Escape") {
-        isFocused.value = false;
-      }
+      if (event.key !== "Escape") return;
+      if (document.querySelector(RECENT_SEARCHES_LAYERS)) return;
+      isFocused.value = false;
     };
 
     // DateTime.setCustomDate keeps second-precision local date/time strings; a zoom is matched on those.
@@ -4424,9 +4492,90 @@ export default defineComponent({
       t,
     );
 
-    const onEditorUserEdit = () => {
+    const onEditorUserEdit = (isBlank = false, wasBlank = false) => {
+      recentFocusDismissed = false;
       autoRun.engine.markEditorDirty();
       updateFreeTextPreview();
+      recentFocusOpen.value = recentsOpenAfterEdit(
+        recentFocusOpen.value,
+        wasBlank,
+        recentSearchesEnabled.value && isBlank,
+      );
+    };
+
+    useLogsHistoryRecorder();
+    const { enabled: recentSearchesEnabled } = useRecentSearches();
+    const recentListActive = ref(false);
+    const recentList = useRecentSearchesList("logs", recentListActive);
+    const recentQueries = computed(() =>
+      recentSearchesEnabled.value ? recentQueryList(recentList.data.value ?? []) : [],
+    );
+    const recentExamples = computed(() =>
+      logsExampleQueries(
+        String(searchObj.data.stream.selectedStream?.[0] ?? ""),
+        !!searchObj.meta.sqlMode,
+      ),
+    );
+
+    let lastEditorPointer = 0;
+    const noteEditorPointer = () => {
+      lastEditorPointer = Date.now();
+    };
+
+    function openRecentOnFocus() {
+      if (recentFocusDismissed) {
+        recentFocusDismissed = false;
+        return;
+      }
+      if (!recentSearchesEnabled.value) return;
+      // Full-screen opens it for a click into the editor only, so a scripted focus keeps Esc collapsing.
+      if (isFocused.value && Date.now() - lastEditorPointer > EDITOR_POINTER_FOCUS_MS) return;
+      recentListActive.value = true;
+      const text = String(searchObj.data.editorValue ?? searchObj.data.query ?? "");
+      if (isUntouchedLogsQuery(text, !!searchObj.meta.sqlMode)) recentFocusOpen.value = true;
+    }
+
+    // Capture phase: the editor's Escape binding stops the event, and that binding must still run.
+    const onRecentEditorKeydown = (e: KeyboardEvent) => {
+      if (!recentFocusOpen.value) return;
+      // In full-screen the first Esc only closes the list; the editor's own Esc would also collapse it.
+      if (isFocused.value && e.key === "Escape") {
+        recentFocusOpen.value = false;
+        e.preventDefault();
+        e.stopPropagation();
+        return;
+      }
+      const text = String(searchObj.data.editorValue ?? searchObj.data.query ?? "");
+      routeEditorKeyToRecents(
+        e,
+        recentFocusRef.value,
+        () => (recentFocusOpen.value = false),
+        !text.trim(),
+      );
+    };
+
+    const openRecentSearches = (status: HistoryStatus | null = null) => {
+      if (!recentSearchesEnabled.value) return false;
+      recentDrawerRef.value?.show(status);
+      return true;
+    };
+
+    const restoreRecent = (entry: QueryHistoryEntry, when: RestoreTime, run: boolean) => {
+      const orgId = store.state.selectedOrganization.identifier;
+      if (entry.source !== "logs") {
+        void openRecentOnItsPage(router, entry, when, orgId, run);
+        return;
+      }
+      router
+        .push({ path: "/logs", query: logsRouteQuery(entry, when, orgId, false) })
+        .finally(() => requestLogsReapply(run));
+    };
+
+    const applyRecentExample = (query: string) => {
+      searchObj.data.query = query;
+      searchObj.data.editorValue = query;
+      updateQuery();
+      focusEditor();
     };
 
     const cancelRun = () => {
@@ -4976,6 +5125,7 @@ export default defineComponent({
       searchObj,
       queryEditorRef,
       focusEditor,
+      dismissRecentFocus,
       syntaxGuideRef,
       confirmDialogVisible,
       confirmCallback,
@@ -5009,6 +5159,17 @@ export default defineComponent({
       handleRunQueryFn,
       onQueryEditorFocus,
       handleQueryEditorBlur,
+      queryEditorBoxRef,
+      recentFocusRef,
+      recentDrawerRef,
+      recentFocusOpen,
+      recentQueries,
+      recentExamples,
+      onRecentEditorKeydown,
+      noteEditorPointer,
+      openRecentSearches,
+      restoreRecent,
+      applyRecentExample,
       autoCompleteKeywords,
       autoCompleteSuggestions,
       effectiveKeywords,
diff --git a/web/src/plugins/logs/SearchResult.spec.ts b/web/src/plugins/logs/SearchResult.spec.ts
index 0177a75c66..a9239c7004 100644
--- a/web/src/plugins/logs/SearchResult.spec.ts
+++ b/web/src/plugins/logs/SearchResult.spec.ts
@@ -141,6 +141,41 @@ describe("SearchResult Component", () => {
     vi.clearAllMocks();
   });
 
+  describe("Quick mode hint in the expanded row (issue 16022)", () => {
+    const setQuickModeState = (quickMode: boolean) => {
+      const { meta, data } = wrapper.vm.searchObj;
+      meta.quickMode = quickMode;
+      meta.sqlMode = false;
+      data.stream.selectedStream = ["app"];
+      data.stream.interestingFieldList = ["level"];
+      data.stream.selectedStreamFields = [
+        { name: "_timestamp", isSchemaField: true },
+        { name: "level", isSchemaField: true },
+        { name: "message", isSchemaField: true },
+      ];
+    };
+
+    it("reports hidden fields for a quick-mode row", () => {
+      setQuickModeState(true);
+      expect(wrapper.vm.quickModeHiddenFields({ _timestamp: 1, level: "info" })).toEqual({
+        shown: 2,
+        total: 3,
+      });
+    });
+
+    it("reports nothing when quick mode is off", () => {
+      setQuickModeState(false);
+      expect(wrapper.vm.quickModeHiddenFields({ _timestamp: 1, level: "info" })).toBeNull();
+    });
+
+    it("turns off quick mode and runs the query again", () => {
+      setQuickModeState(true);
+      wrapper.vm.turnOffQuickMode();
+      expect(wrapper.vm.searchObj.meta.quickMode).toBe(false);
+      expect(wrapper.emitted("run-query")).toHaveLength(1);
+    });
+  });
+
   describe("Table Functionality", () => {
     it("should calculate table width correctly", () => {
       window.innerWidth = 1000;
diff --git a/web/src/plugins/logs/SearchResult.vue b/web/src/plugins/logs/SearchResult.vue
index cc729cf197..ec1938a239 100644
--- a/web/src/plugins/logs/SearchResult.vue
+++ b/web/src/plugins/logs/SearchResult.vue
@@ -629,6 +629,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
                   <!-- Expanded row → JSON preview -->
                   <template #expansion="{ row }">
+                    <div
+                      v-if="quickModeHiddenFields(row)"
+                      class="text-text-secondary flex items-center gap-2 px-2 pt-1.5 text-xs"
+                      data-test="logs-expanded-quick-mode-hint"
+                    >
+                      <span>
+                        {{
+                          t("search.quickModeHiddenFields", {
+                            shown: quickModeHiddenFields(row)!.shown,
+                            total: quickModeHiddenFields(row)!.total,
+                          })
+                        }}
+                      </span>
+                      <OButton
+                        variant="ghost"
+                        size="sm"
+                        data-test="logs-expanded-quick-mode-off"
+                        @click="turnOffQuickMode"
+                      >
+                        {{ t("search.turnOffQuickMode") }}
+                      </OButton>
+                    </div>
                     <JsonPreview
                       :value="row"
                       :index="logsRowIndex(row)"
@@ -954,6 +976,7 @@ import { extractSeverity } from "@/utils/sourceEventSeverity";
 import config from "@/aws-exports";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
+import { quickModeHiddenFieldCount } from "@/utils/query/quickModeFieldList";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
@@ -2890,6 +2913,21 @@ export default defineComponent({
     // the value off a single click. The parent already tracks `expandedLogs` as
     // hit indices, so use those directly.
     const logsRowKey = (row: any): string => String(logsRowIndex(row));
+
+    // Quick mode fetches only the interesting fields; say so in the expanded row.
+    const quickModeHiddenFields = (row: any) =>
+      quickModeHiddenFieldCount(row, {
+        quickMode: !!searchObj.meta.quickMode,
+        sqlMode: !!searchObj.meta.sqlMode,
+        streamCount: searchObj.data.stream.selectedStream.length,
+        interestingFields: searchObj.data.stream.interestingFieldList,
+        streamFields: searchObj.data.stream.selectedStreamFields,
+        allFieldsName: store.state.zoConfig?.all_fields_name,
+      });
+    const turnOffQuickMode = () => {
+      searchObj.meta.quickMode = false;
+      emit("run-query");
+    };
     const expandedLogIds = computed<string[]>(() =>
       ((props.expandedLogs as number[]) || []).map(String),
     );
@@ -2976,6 +3014,8 @@ export default defineComponent({
       severityFieldTextClass,
       expandedLogIds,
       onExpandedLogIdsChange,
+      quickModeHiddenFields,
+      turnOffQuickMode,
       openLogDetailsByRow,
       isFunctionErrorOpen,
       contextCell,
diff --git a/web/src/plugins/metrics/Index.history.spec.ts b/web/src/plugins/metrics/Index.history.spec.ts
index 01c7c1bcda..824b284bf6 100644
--- a/web/src/plugins/metrics/Index.history.spec.ts
+++ b/web/src/plugins/metrics/Index.history.spec.ts
@@ -15,8 +15,12 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
-import { inject, reactive } from "vue";
+import { inject, nextTick, reactive, type SetupContext } from "vue";
 import { encodeMetricsConfig, getMetricsConfig } from "@/composables/metrics/metricsUrlState";
+import { metricsRestore } from "@/utils/queryHistory/metrics";
+import { openRecentOnItsPage, recentSearchRoute } from "@/utils/queryHistory/routes";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { landingRouter } from "@/test/unit/helpers/recentLanding";
 
 // Only an explicit Run writes history; auto-refresh, deep links and refresh share runQuery.
 
@@ -43,7 +47,7 @@ const mockStore = vi.hoisted(() => ({
   state: {
     theme: "light",
     selectedOrganization: { identifier: "org1" },
-    zoConfig: { min_auto_refresh_interval: 5 },
+    zoConfig: { min_auto_refresh_interval: 5, query_history_enabled: true },
   },
 }));
 vi.mock("vuex", async (importOriginal) => ({
@@ -81,7 +85,20 @@ vi.mock("@/composables/dashboard/useDefaultPanelFields", () => ({
 
 import MetricsIndex from "./Index.vue";
 
-const editorRunQuery = vi.fn();
+interface PanelRun {
+  state: { panels: Record<string, boolean> } | null;
+  emitError: ((e: unknown) => void) | null;
+}
+const panelRun: PanelRun = { state: null, emitError: null };
+const editorRunQuery = vi.fn(() => {
+  if (panelRun.state) panelRun.state.panels.p1 = true;
+});
+const finishRun = async (error?: { message: string; code: string | number }) => {
+  if (error) panelRun.emitError?.(error);
+  if (panelRun.state) panelRun.state.panels.p1 = false;
+  await flushPromises();
+  await nextTick();
+};
 type RunQuery = (withoutCache?: boolean) => void;
 const injected = { runQuery: null as RunQuery | null };
 const picker = {
@@ -119,8 +136,11 @@ const mountIndex = () =>
           template: '<div data-test="metrics-history" />',
         },
         PanelEditor: {
-          setup: (_: any, { expose }: any) => {
+          emits: ["chartApiError", "renderer-error"],
+          setup: (_: unknown, { expose, emit }: SetupContext) => {
             injected.runQuery = inject<RunQuery | null>("runQuery", null);
+            panelRun.state = inject<PanelRun["state"]>("variablesAndPanelsDataLoadingState", null);
+            panelRun.emitError = (e: unknown) => emit("renderer-error", e);
             expose({ runQuery: editorRunQuery });
             return {};
           },
@@ -162,8 +182,10 @@ describe("Metrics editor — query history", () => {
 
     await wrapper.find('[data-test="metrics-apply"]').trigger("click");
     await flushPromises();
-
     expect(editorRunQuery).toHaveBeenCalled();
+    expect(api.record).not.toHaveBeenCalled();
+
+    await finishRun();
     expect(api.record).toHaveBeenCalledTimes(1);
     const [org, body] = api.record.mock.calls[0];
     expect(org).toBe("org1");
@@ -178,6 +200,7 @@ describe("Metrics editor — query history", () => {
 
     shortcuts.handlers.metricsRunQuery();
     await flushPromises();
+    await finishRun();
     expect(api.record).toHaveBeenCalledTimes(1);
   });
 
@@ -187,6 +210,7 @@ describe("Metrics editor — query history", () => {
 
     injected.runQuery?.(false);
     await flushPromises();
+    await finishRun();
 
     expect(editorRunQuery).toHaveBeenCalledTimes(1);
     expect(api.record).toHaveBeenCalledTimes(1);
@@ -199,6 +223,7 @@ describe("Metrics editor — query history", () => {
     shortcuts.handlers.metricsRefresh();
     await wrapper.find('[data-test="metrics-auto-refresh"]').trigger("click");
     await flushPromises();
+    await finishRun();
 
     expect(editorRunQuery).toHaveBeenCalledTimes(2);
     expect(api.record).not.toHaveBeenCalled();
@@ -208,11 +233,61 @@ describe("Metrics editor — query history", () => {
     route.query = { metrics_data: encodeMetricsConfig(getMetricsConfig(makePanel())) };
     mountIndex();
     await flushPromises();
+    await finishRun();
 
     expect(editorRunQuery).toHaveBeenCalled();
     expect(api.record).not.toHaveBeenCalled();
   });
 
+  describe("a recent search restored from another page", () => {
+    const entry = (): QueryHistoryEntry => ({
+      id: "m",
+      source: "metrics",
+      query: "up",
+      query_key: "k",
+      streams: ["up"],
+      context: {
+        metrics_data: encodeMetricsConfig(getMetricsConfig(makePanel())),
+        time_range: { period: "15m" },
+      },
+      status: "ok",
+      starred: false,
+      run_count: 1,
+      created_at: 1,
+      updated_at: 2,
+    });
+    const land = async (run: boolean) => {
+      await openRecentOnItsPage(landingRouter().router, entry(), "now", "org1", run);
+      route.query = recentSearchRoute(entry(), "now", "org1", run ? "run" : "load")!.query;
+      const wrapper = mountIndex();
+      await flushPromises();
+      await finishRun();
+      return wrapper;
+    };
+
+    it("runs and records it when it was restored with Run", async () => {
+      await land(true);
+      expect(editorRunQuery).toHaveBeenCalledTimes(1);
+      expect(api.record).toHaveBeenCalledTimes(1);
+    });
+
+    it("loads it without running or recording when it was restored with Load without running", async () => {
+      await land(false);
+      expect(editorRunQuery).not.toHaveBeenCalled();
+      expect(api.record).not.toHaveBeenCalled();
+    });
+
+    it("uses the restore once: reopening the same URL afterwards runs without recording", async () => {
+      const first = await land(true);
+      first.unmount();
+      mountIndex();
+      await flushPromises();
+      await finishRun();
+      expect(editorRunQuery).toHaveBeenCalledTimes(2);
+      expect(api.record).toHaveBeenCalledTimes(1);
+    });
+  });
+
   it("records nothing when the query fails validation", async () => {
     validatePanel.mockImplementation((errors: string[]) => errors.push("bad"));
     const wrapper = mountIndex();
@@ -230,12 +305,99 @@ describe("Metrics editor — query history", () => {
 
     await wrapper.find('[data-test="metrics-apply"]').trigger("click");
     await flushPromises();
+    await finishRun();
 
     expect(editorRunQuery).toHaveBeenCalled();
     expect(consoleError).toHaveBeenCalled();
     expect(showErrorNotification).not.toHaveBeenCalled();
   });
 
+  it("records the run's window in microseconds and reopens it at that window", async () => {
+    const startUs = 1_761_500_000_000_000;
+    const endUs = startUs + 3_600_000_000;
+    picker.getConsumableDateTime.mockReturnValue({ startTime: startUs, endTime: endUs });
+    const wrapper = mountIndex();
+    await flushPromises();
+    await wrapper.find('[data-test="metrics-apply"]').trigger("click");
+    await flushPromises();
+    await finishRun();
+    const body = api.record.mock.calls[0][1];
+    expect(body.context.time).toMatchObject({ start_time: startUs, end_time: endUs });
+
+    const reopened = metricsRestore(
+      {
+        ...body,
+        id: "r",
+        query_key: "k",
+        starred: false,
+        run_count: 1,
+        created_at: 1,
+        updated_at: 2,
+      },
+      "original",
+    );
+    wrapper
+      .findComponent('[data-test="metrics-history"]')
+      .vm.$emit("load", { ...reopened, run: false });
+    await flushPromises();
+    const saved = picker.setSavedDate.mock.calls.at(-1)?.[0];
+    expect(saved).toEqual({ type: "absolute", startTime: startUs, endTime: endUs });
+    // DateTime.setSavedDate reads these as microseconds and divides by 1000 for its labels.
+    expect(new Date(saved.startTime / 1000).getUTCFullYear()).toBe(2025);
+    picker.getConsumableDateTime.mockReturnValue({ startTime: 1_000_000, endTime: 2_000_000 });
+  });
+
+  it("names the metric the custom query selects, not the stream picker's last choice", async () => {
+    panel.current.data.queries = [
+      {
+        query: "sum(rate(http_requests_total[5m])) by (service)",
+        customQuery: true,
+        fields: { stream_type: "metrics", stream: "node_memory_MemAvailable_bytes" },
+      },
+    ];
+    const wrapper = mountIndex();
+    await flushPromises();
+    await wrapper.find('[data-test="metrics-apply"]').trigger("click");
+    await flushPromises();
+    await finishRun();
+    expect(api.record.mock.calls[0][1].streams).toEqual(["http_requests_total"]);
+  });
+
+  it("records a query error as failed, with its message", async () => {
+    const wrapper = mountIndex();
+    await flushPromises();
+    await wrapper.find('[data-test="metrics-apply"]').trigger("click");
+    await flushPromises();
+    await finishRun({ message: "parse error: unexpected <EOF>", code: 400 });
+
+    expect(api.record).toHaveBeenCalledTimes(1);
+    expect(api.record.mock.calls[0][1]).toMatchObject({
+      status: "error",
+      context: { error: "parse error: unexpected <EOF>" },
+    });
+  });
+
+  it("records a timeout as ok with a warning", async () => {
+    const wrapper = mountIndex();
+    await flushPromises();
+    await wrapper.find('[data-test="metrics-apply"]').trigger("click");
+    await flushPromises();
+    await finishRun({ message: "timed out", code: 20010 });
+    expect(api.record.mock.calls[0][1]).toMatchObject({
+      status: "ok",
+      context: { warning: "timed out" },
+    });
+  });
+
+  it("records nothing for a cancelled run", async () => {
+    const wrapper = mountIndex();
+    await flushPromises();
+    await wrapper.find('[data-test="metrics-apply"]').trigger("click");
+    await flushPromises();
+    await finishRun({ message: "query cancelled", code: 20009 });
+    expect(api.record).not.toHaveBeenCalled();
+  });
+
   describe("loading an entry applies it live", () => {
     const blobFor = (type: string, query: string) => {
       const p = makePanel();
@@ -280,7 +442,35 @@ describe("Metrics editor — query history", () => {
         endTime: 9000,
       });
       expect(editorRunQuery).toHaveBeenCalledTimes(2);
-      // Loading an entry is not a new run of it.
+    });
+
+    it("records a re-run from history once it settles, like a Run", async () => {
+      const wrapper = mountIndex();
+      await flushPromises();
+      wrapper.findComponent('[data-test="metrics-history"]').vm.$emit("load", {
+        metricsData: blobFor("bar", "sum(a)"),
+        timeRange: { valueType: "relative", relativeTimePeriod: "6h" },
+        run: true,
+      });
+      await flushPromises();
+      await finishRun();
+      expect(editorRunQuery).toHaveBeenCalledTimes(1);
+      expect(api.record).toHaveBeenCalledTimes(1);
+      expect(api.record.mock.calls[0][1]).toMatchObject({ source: "metrics", query: "sum(a)" });
+    });
+
+    it("loads without running or recording when asked to load only", async () => {
+      const wrapper = mountIndex();
+      await flushPromises();
+      const data = panel.current.data;
+      wrapper.findComponent('[data-test="metrics-history"]').vm.$emit("load", {
+        metricsData: blobFor("bar", "sum(a)"),
+        timeRange: { valueType: "relative", relativeTimePeriod: "6h" },
+        run: false,
+      });
+      await flushPromises();
+      expect(data.queries.map((q: { query: string }) => q.query)).toEqual(["sum(a)"]);
+      expect(editorRunQuery).not.toHaveBeenCalled();
       expect(api.record).not.toHaveBeenCalled();
     });
   });
diff --git a/web/src/plugins/metrics/Index.vue b/web/src/plugins/metrics/Index.vue
index 7d57bc94eb..0fdb411568 100644
--- a/web/src/plugins/metrics/Index.vue
+++ b/web/src/plugins/metrics/Index.vue
@@ -58,8 +58,24 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         shortcut-id="metricsCopyUrl"
         class="h-8"
       />
-      <QueryHistoryDrawer @load="onHistoryLoad" />
+      <QueryHistoryDrawer ref="historyDrawerRef" @load="onHistoryLoad" />
+      <RecentSearchesFocusDropdown
+        ref="recentDropdownRef"
+        v-model:open="recentEditor.open.value"
+        source="metrics"
+        :anchor="recentEditor.anchor.value"
+        @run="(entry, when) => historyDrawerRef?.restore(entry, when, true)"
+        @load="(entry, when) => historyDrawerRef?.restore(entry, when, false)"
+        @view-all="(status) => historyDrawerRef?.show(status)"
+      />
       <template v-if="!['html', 'markdown'].includes(dashboardPanelData.data.type)">
+        <RecentSearchesButton
+          source="metrics"
+          data-test="metrics-history-btn"
+          @run="(entry, when) => historyDrawerRef?.restore(entry, when, true)"
+          @load="(entry, when) => historyDrawerRef?.restore(entry, when, false)"
+          @view-all="(status) => historyDrawerRef?.show(status)"
+        />
         <OButton
           v-if="config.isEnterprise == 'true' && searchRequestTraceIds.length"
           variant="cancel-query"
@@ -101,6 +117,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :selectedDateTime="dashboardPanelData.meta.dateTime"
       @addToDashboard="addToDashboard"
       @chartApiError="handleChartApiError"
+      @renderer-error="historyRecorder.onPanelError"
       @dataZoom="onDataZoom"
     />
 
@@ -158,6 +175,10 @@ import {
 import { useQueryHistoryRecorder } from "@/composables/metrics/useQueryHistoryRecorder";
 import { pickerSavedDate } from "@/utils/metrics/queryHistory";
 import QueryHistoryDrawer from "./QueryHistoryDrawer.vue";
+import RecentSearchesButton from "@/components/queryHistory/RecentSearchesButton.vue";
+import RecentSearchesFocusDropdown from "@/components/queryHistory/RecentSearchesFocusDropdown.vue";
+import { useRecentSearchesEditorHost } from "@/composables/queryHistory/useRecentSearchesEditorHost";
+import { metricsEditorIsEmpty, metricsEditorIsEmptyWith } from "@/utils/queryHistory/metrics";
 import analytics from "@/services/product_analytics";
 import {
   queryParamsToSelectedDate,
@@ -176,6 +197,7 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { takeRecentLanding } from "@/utils/queryHistory/routes";
 
 export default defineComponent({
   name: "Metrics",
@@ -193,6 +215,8 @@ export default defineComponent({
     OTooltip,
     ShareButton,
     QueryHistoryDrawer,
+    RecentSearchesButton,
+    RecentSearchesFocusDropdown,
   },
   setup() {
     provide("dashboardPanelDataPageKey", "metrics");
@@ -336,9 +360,12 @@ export default defineComponent({
     const isPanelConfigChanged = ref(false);
 
     // Reset before children mount so FieldList sees stream_type=metrics (avoids a spurious logs stream fetch).
+    // A restore from recent searches runs only on request, and records then; any other landing runs unrecorded.
+    let landing: { run: boolean } | null = null;
     onBeforeMount(() => {
       applyMetricsDefaults();
-      pendingAutoRun = hydrateFromUrl();
+      landing = takeRecentLanding("metrics");
+      pendingAutoRun = hydrateFromUrl() && (landing?.run ?? true);
     });
 
     onMounted(async () => {
@@ -355,7 +382,8 @@ export default defineComponent({
       if (pendingAutoRun) {
         pendingAutoRun = false;
         updateDateTime();
-        runQuery();
+        if (landing?.run) onUserRun();
+        else runQuery();
       }
     });
 
@@ -444,23 +472,33 @@ export default defineComponent({
       return true;
     };
 
-    const { record } = useQueryHistoryRecorder();
-
-    /** An explicit Run (button or shortcut): runs, then records a valid query. */
+    /** An explicit Run (button, shortcut or a history re-run): runs, then records a valid query. */
     const onUserRun = () => {
-      if (runQuery()) record(dashboardPanelData, selectedDate.value);
+      if (runQuery()) historyRecorder.record(dashboardPanelData, selectedDate.value);
     };
 
-    /** The editor hydrates only on mount, so an entry replaces the panel in place and reruns. */
-    const applyPanelData = (metricsData: string, timeRange: SelectedDate) => {
+    /** The editor hydrates only on mount, so an entry replaces the panel in place; a re-run is a user Run. */
+    const applyPanelData = (metricsData: string, timeRange: SelectedDate, run = true) => {
       if (!applyMetricsBlob(metricsData, dashboardPanelData)) return;
       selectedDate.value = timeRange;
       dateTimePickerRef.value?.setSavedDate?.(pickerSavedDate(timeRange));
-      runQuery();
+      if (run) onUserRun();
     };
 
-    const onHistoryLoad = (entry: { metricsData: string; timeRange: SelectedDate }) => {
-      applyPanelData(entry.metricsData, entry.timeRange);
+    const historyDrawerRef = ref<InstanceType<typeof QueryHistoryDrawer> | null>(null);
+    // One editor takes one query, so multi-query rows stay out of its clock rows.
+    const recentEditor = useRecentSearchesEditorHost("metrics", {
+      opensOnFocus: () => metricsEditorIsEmpty(dashboardPanelData),
+      emptyWith: (isBlank) => metricsEditorIsEmptyWith(dashboardPanelData, isBlank),
+      acceptsQuery: (query) => !query.includes("\n"),
+    });
+
+    const onHistoryLoad = (entry: {
+      metricsData: string;
+      timeRange: SelectedDate;
+      run?: boolean;
+    }) => {
+      applyPanelData(entry.metricsData, entry.timeRange, entry.run !== false);
       try {
         analytics.track("metrics_query_history_loaded", {
           org_id: store.state.selectedOrganization?.identifier,
@@ -588,6 +626,7 @@ export default defineComponent({
     const { traceIdRef, cancelQuery } = useCancelQuery(t);
 
     const cancelAddPanelQuery = () => {
+      historyRecorder.cancel();
       traceIdRef.value = searchRequestTraceIds.value;
       cancelQuery();
     };
@@ -599,6 +638,8 @@ export default defineComponent({
       disable.value = panelsValues.some((item: any) => item === true);
     });
 
+    const historyRecorder = useQueryHistoryRecorder(() => disable.value);
+
     const isRunQueryPending = computed(() => {
       if (!isRunQueryArmed.value || disable.value || appliedSignature.value === null) return false;
       return panelPayloadSignature(dashboardPanelData.data) !== appliedSignature.value;
@@ -699,6 +740,10 @@ export default defineComponent({
       onUserRun,
       applyPanelData,
       onHistoryLoad,
+      historyDrawerRef,
+      historyRecorder,
+      recentEditor,
+      recentDropdownRef: recentEditor.dropdownRef,
       dashboardPanelData,
       chartData,
       editMode,
diff --git a/web/src/plugins/metrics/QueryHistoryDrawer.spec.ts b/web/src/plugins/metrics/QueryHistoryDrawer.spec.ts
index 22bbc6b989..99de3f1902 100644
--- a/web/src/plugins/metrics/QueryHistoryDrawer.spec.ts
+++ b/web/src/plugins/metrics/QueryHistoryDrawer.spec.ts
@@ -13,17 +13,17 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { mount, flushPromises } from "@vue/test-utils";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { enableAutoUnmount, mount, flushPromises } from "@vue/test-utils";
 import { ref } from "vue";
 import store from "@/test/unit/helpers/store";
-import i18n from "@/locales";
 
 const api = vi.hoisted(() => ({
   list: vi.fn(),
   record: vi.fn(),
   star: vi.fn(),
   remove: vi.fn(),
+  clear: vi.fn(),
 }));
 vi.mock("@/services/query_history", () => ({ default: api }));
 
@@ -32,22 +32,44 @@ vi.mock("@/composables/useBreakpoint", () => ({
   default: () => ({ isMobile: ref(breakpoint.mobile) }),
 }));
 
+const push = vi.hoisted(() => vi.fn(() => Promise.resolve()));
+vi.mock("vue-router", () => ({
+  useRouter: () => ({ push, resolve: () => ({ href: "/web/metrics" }) }),
+}));
+
 import QueryHistoryDrawer from "./QueryHistoryDrawer.vue";
 
-const ENTRIES = [
+enableAutoUnmount(afterEach);
+
+const NOW_US = Date.now() * 1000;
+
+// v1.1.x rows: no key, no window; the migration gave them source metrics and updated_at.
+const LEGACY = [
   {
     id: "e2",
+    source: "metrics",
     query: "rate(x[5m])",
+    query_key: null,
+    streams: [],
     context: { metrics_data: "blob-2", time_range: { period: "6h" }, chart_type: "bar" },
+    status: "ok",
     starred: true,
-    created_at: 2_000_000,
+    run_count: 1,
+    created_at: NOW_US,
+    updated_at: NOW_US,
   },
   {
     id: "e1",
+    source: "metrics",
     query: "up",
+    query_key: null,
+    streams: [],
     context: { metrics_data: "blob-1", time_range: { from: 1000, to: 2000 }, chart_type: "line" },
+    status: "ok",
     starred: false,
-    created_at: 1_000_000,
+    run_count: 1,
+    created_at: NOW_US - 1,
+    updated_at: NOW_US - 1,
   },
 ];
 
@@ -58,240 +80,122 @@ const mountDrawer = () =>
       stubs: {
         ODrawer: {
           props: ["open", "size"],
-          emits: ["update:open"],
-          template: `<div>
-            <span @click="$emit('update:open', true)"><slot name="trigger" /></span>
-            <div v-if="open" data-test="drawer" :data-size="size"><slot /></div>
-          </div>`,
+          template: `<div v-if="open" data-stub="drawer" :data-size="size"><slot /></div>`,
         },
-        OTable: {
-          props: ["data"],
-          emits: ["row-click"],
-          template: `<div>
-            <div v-for="row in data" :key="row.id" :data-test="'row-' + row.id" @click="$emit('row-click', row, $event)">
-              <slot name="cell-query" :row="row" />
-              <slot name="cell-actions" :row="row" />
-            </div>
-          </div>`,
+        ODropdown: { template: `<div @click.stop><slot name="trigger" /><slot /></div>` },
+        ODropdownItem: {
+          emits: ["select"],
+          template: `<button v-bind="$attrs" @click="$emit('select')"><slot /></button>`,
         },
         OTimeCell: true,
         OTooltip: true,
-        OSearchInput: {
-          props: ["modelValue"],
-          emits: ["update:modelValue"],
-          template:
-            '<input :value="modelValue" @input="$emit(\'update:modelValue\', $event.target.value)" />',
-        },
-        OSwitch: {
-          props: ["modelValue"],
-          emits: ["update:modelValue"],
-          template:
-            '<input type="checkbox" :checked="modelValue" @change="$emit(\'update:modelValue\', $event.target.checked)" />',
-        },
       },
     },
   });
 
-const open = async (wrapper: any) => {
-  await wrapper.find('[data-test="metrics-history-btn"]').trigger("click");
+const open = async (wrapper: ReturnType<typeof mountDrawer>) => {
+  (wrapper.vm as unknown as { show: () => void }).show();
   await flushPromises();
 };
 
-describe("QueryHistoryDrawer", () => {
+describe("QueryHistoryDrawer (Metrics on the shared drawer)", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     breakpoint.mobile = false;
-    api.list.mockResolvedValue({ data: ENTRIES });
-    api.star.mockResolvedValue({ data: {} });
-    api.remove.mockResolvedValue({ data: {} });
+    api.list.mockResolvedValue({ data: LEGACY });
   });
 
-  it("fetches nothing until opened, then lists the entries in server (newest-first) order", async () => {
+  it("fetches nothing until opened, then lists this page's rows newest first", async () => {
     const wrapper = mountDrawer();
     await flushPromises();
     expect(api.list).not.toHaveBeenCalled();
 
     await open(wrapper);
-    expect(api.list).toHaveBeenCalledWith("default", { limit: 50, offset: 0 });
-    const rows = wrapper.findAll('[data-test^="row-"]').map((r) => r.attributes("data-test"));
-    expect(rows).toEqual(["row-e2", "row-e1"]);
+    expect(api.list).toHaveBeenCalledWith("default", { source: "metrics", limit: 50, offset: 0 });
+    const rows = wrapper
+      .findAll('[data-test^="recent-searches-drawer-row-"]')
+      .map((r) => r.attributes("data-test"));
+    expect(rows).toEqual(["recent-searches-drawer-row-e2", "recent-searches-drawer-row-e1"]);
   });
 
-  it("asks the server for starred entries only when the toggle is on", async () => {
+  it("re-runs a v1.1.x row with its stored panel and range", async () => {
     const wrapper = mountDrawer();
     await open(wrapper);
 
-    await wrapper.find('[data-test="metrics-history-starred-only"]').setValue(true);
+    await wrapper.find('[data-test="recent-searches-drawer-row-e2"]').trigger("click");
     await flushPromises();
-    expect(api.list).toHaveBeenLastCalledWith("default", { starred: true, limit: 50, offset: 0 });
+    expect(wrapper.emitted("load")?.[0]?.[0]).toEqual({
+      metricsData: "blob-2",
+      timeRange: expect.objectContaining({ valueType: "relative", relativeTimePeriod: "6h" }),
+      run: true,
+    });
+    expect(wrapper.find('[data-stub="drawer"]').exists()).toBe(false);
   });
 
-  it("searches on the server", async () => {
+  it("loads a v1.1.x absolute row without running", async () => {
     const wrapper = mountDrawer();
     await open(wrapper);
 
-    await wrapper.find('[data-test="metrics-history-search"]').setValue("rate");
+    await wrapper.find('[data-test="recent-searches-load-e1"]').trigger("click");
     await flushPromises();
-    expect(api.list).toHaveBeenLastCalledWith("default", { q: "rate", limit: 50, offset: 0 });
+    expect(wrapper.emitted("load")?.[0]?.[0]).toEqual({
+      metricsData: "blob-1",
+      timeRange: expect.objectContaining({ valueType: "absolute", startTime: 1000, endTime: 2000 }),
+      run: false,
+    });
   });
 
   it("stars, unstars and deletes through the entry routes", async () => {
+    api.star.mockResolvedValue({ data: {} });
+    api.remove.mockResolvedValue({ data: {} });
     const wrapper = mountDrawer();
     await open(wrapper);
 
-    await wrapper.find('[data-test="metrics-history-star-e1"]').trigger("click");
+    await wrapper.find('[data-test="recent-searches-star-e1"]').trigger("click");
     await flushPromises();
     expect(api.star).toHaveBeenCalledWith("default", "e1", true);
-
-    await wrapper.find('[data-test="metrics-history-star-e2"]').trigger("click");
+    await wrapper.find('[data-test="recent-searches-star-e2"]').trigger("click");
     await flushPromises();
     expect(api.star).toHaveBeenCalledWith("default", "e2", false);
-
-    await wrapper.find('[data-test="metrics-history-delete-e1"]').trigger("click");
-    await flushPromises();
+    vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
+    try {
+      await wrapper.find('[data-test="recent-searches-delete-e1"]').trigger("click");
+      vi.advanceTimersByTime(6000);
+      await flushPromises();
+    } finally {
+      vi.useRealTimers();
+    }
     expect(api.remove).toHaveBeenCalledWith("default", "e1");
-    // A row action is not a load.
     expect(wrapper.emitted("load")).toBeUndefined();
   });
 
-  it("loads a clicked entry and closes", async () => {
+  it("opens another page's row on that page instead of loading it here", async () => {
     const wrapper = mountDrawer();
-    await open(wrapper);
-
-    await wrapper.find('[data-test="row-e2"]').trigger("click");
-    await flushPromises();
-
-    expect(wrapper.emitted("load")?.[0]?.[0]).toMatchObject({
-      metricsData: "blob-2",
-      timeRange: { valueType: "relative", relativeTimePeriod: "6h" },
-    });
-    expect(wrapper.find('[data-test="drawer"]').exists()).toBe(false);
-  });
-
-  describe("loading past the first page", () => {
-    const page = (from: number, count: number) =>
-      Array.from({ length: count }, (_, i) => ({
-        ...ENTRIES[1],
-        id: `p${from + i}`,
-        created_at: 1_000_000 - (from + i),
-      }));
-    const loadMore = (wrapper: any) => wrapper.find('[data-test="metrics-history-load-more"]');
-
-    it("fetches the next page by offset and appends it", async () => {
-      api.list.mockImplementation((_org: string, params: any) =>
-        Promise.resolve({ data: params.offset ? page(50, 7) : page(0, 50) }),
-      );
-      const wrapper = mountDrawer();
-      await open(wrapper);
-      expect(wrapper.findAll('[data-test^="row-"]')).toHaveLength(50);
-
-      await loadMore(wrapper).trigger("click");
-      await flushPromises();
-      expect(api.list).toHaveBeenLastCalledWith("default", { limit: 50, offset: 50 });
-      const rows = wrapper.findAll('[data-test^="row-"]').map((r) => r.attributes("data-test"));
-      expect(rows).toHaveLength(57);
-      expect(rows[0]).toBe("row-p0");
-      expect(rows[50]).toBe("row-p50");
-      // The short page was the last one.
-      expect(loadMore(wrapper).exists()).toBe(false);
-    });
-
-    it("offers no more when the first page is already short", async () => {
-      const wrapper = mountDrawer();
-      await open(wrapper);
-      expect(loadMore(wrapper).exists()).toBe(false);
-    });
+    (wrapper.vm as unknown as { restore: (...args: unknown[]) => void }).restore(
+      {
+        ...LEGACY[0],
+        id: "logs-row",
+        source: "logs",
+        query: "level = 'error'",
+        streams: ["k8s"],
+        context: { page: { stream: "k8s" } },
+      },
+      "now",
+      true,
+    );
+    expect(push).toHaveBeenCalledWith(
+      expect.objectContaining({
+        path: "/logs",
+        query: expect.objectContaining({ type: "search_history_re_apply" }),
+      }),
+    );
+    expect(wrapper.emitted("load")).toBeUndefined();
   });
 
   it("goes full screen on mobile", async () => {
     breakpoint.mobile = true;
     const wrapper = mountDrawer();
     await open(wrapper);
-    expect(wrapper.find('[data-test="drawer"]').attributes("data-size")).toBe("full");
-  });
-});
-
-// The real OTable: it owns the #empty slot and the cell slots, so a stub would hide a wrong slot.
-describe("QueryHistoryDrawer with the real OTable", () => {
-  const DrawerStub = {
-    props: ["open", "size"],
-    emits: ["update:open"],
-    template: `<div>
-      <span @click="$emit('update:open', true)"><slot name="trigger" /></span>
-      <div v-if="open" data-test="drawer"><slot /></div>
-    </div>`,
-  };
-  const mountReal = () =>
-    mount(QueryHistoryDrawer, {
-      global: { plugins: [i18n, store], stubs: { ODrawer: DrawerStub } },
-    });
-  const emptyTitle = (wrapper: any) => wrapper.find('[data-test="metrics-history-empty"]').text();
-
-  beforeEach(() => {
-    vi.clearAllMocks();
-    breakpoint.mobile = false;
-    api.list.mockResolvedValue({ data: [] });
-  });
-
-  it("says there are no queries yet when nothing filters the list", async () => {
-    const wrapper = mountReal();
-    await open(wrapper);
-    await vi.waitFor(() => expect(emptyTitle(wrapper)).toContain("No queries yet"));
-  });
-
-  it("says no queries match when a search finds nothing", async () => {
-    const wrapper = mountReal();
-    await open(wrapper);
-    const search = wrapper.find('[data-test="metrics-history-search"]');
-    await (search.element.tagName === "INPUT" ? search : search.find("input")).setValue("nomatch");
-    await vi.waitFor(() =>
-      expect(api.list).toHaveBeenCalledWith("default", expect.objectContaining({ q: "nomatch" })),
-    );
-    await vi.waitFor(() =>
-      expect(emptyTitle(wrapper)).toContain("No queries match the search or starred filter"),
-    );
-  });
-
-  it("folds the row actions into a kebab on a phone, whose Star and Delete reach the entry routes", async () => {
-    breakpoint.mobile = true;
-    api.list.mockResolvedValue({ data: ENTRIES });
-    api.star.mockResolvedValue({ data: {} });
-    api.remove.mockResolvedValue({ data: {} });
-    const wrapper = mount(QueryHistoryDrawer, {
-      attachTo: document.body,
-      global: { plugins: [i18n, store], stubs: { ODrawer: DrawerStub } },
-    });
-    await open(wrapper);
-    const more = () => wrapper.find('[data-test="metrics-history-more-e1"]');
-    await vi.waitFor(() => expect(more().exists()).toBe(true));
-    expect(more().classes()).toContain("md:hidden");
-    expect(wrapper.find('[data-test="metrics-history-delete-e1"]').classes()).toContain(
-      "max-md:hidden",
-    );
-    expect(wrapper.find('[data-test="metrics-history-star-e1"]').classes()).toContain(
-      "max-md:hidden",
-    );
-
-    // The menu is portalled to <body>, outside the wrapper.
-    const pick = async (dataTest: string) => {
-      await more().trigger("keydown", { key: "Enter" });
-      await flushPromises();
-      const item = await vi.waitFor(() => {
-        const el = document.querySelector<HTMLElement>(`[data-test="${dataTest}"]`);
-        expect(el).not.toBeNull();
-        return el!;
-      });
-      expect(item.classList.contains("md:hidden")).toBe(false);
-      item.click();
-      await flushPromises();
-    };
-
-    await pick("metrics-history-star-e1-menu");
-    expect(api.star).toHaveBeenCalledWith("default", "e1", true);
-
-    await pick("metrics-history-delete-e1-menu");
-    expect(api.remove).toHaveBeenCalledWith("default", "e1");
-    expect(wrapper.emitted("load")).toBeUndefined();
-    wrapper.unmount();
+    expect(wrapper.find('[data-stub="drawer"]').attributes("data-size")).toBe("full");
   });
 });
diff --git a/web/src/plugins/metrics/QueryHistoryDrawer.vue b/web/src/plugins/metrics/QueryHistoryDrawer.vue
index bac90645a3..3fbb9a2496 100644
--- a/web/src/plugins/metrics/QueryHistoryDrawer.vue
+++ b/web/src/plugins/metrics/QueryHistoryDrawer.vue
@@ -15,218 +15,41 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 -->
 
 <template>
-  <ODrawer
-    v-model:open="open"
-    :size="isMobile ? 'full' : 'md'"
-    :title="t('metrics.history.title')"
-    bleed
-    data-test="metrics-history-drawer"
-  >
-    <template #trigger>
-      <OButton
-        variant="outline"
-        size="icon-toolbar"
-        icon-left="history"
-        :aria-label="t('metrics.history.title')"
-        data-test="metrics-history-btn"
-      >
-        <OTooltip :content="t('metrics.history.title')" />
-      </OButton>
-    </template>
-
-    <div class="flex h-full min-h-0 flex-col">
-      <div class="border-border-default flex shrink-0 items-center gap-3 border-b px-4 py-2">
-        <OSearchInput
-          v-model="search"
-          size="sm"
-          clearable
-          :debounce="300"
-          :placeholder="t('metrics.history.searchPlaceholder')"
-          class="min-w-0 flex-1"
-          data-test="metrics-history-search"
-        />
-        <OSwitch
-          v-model="starredOnly"
-          size="sm"
-          :label="t('metrics.history.starredOnly')"
-          data-test="metrics-history-starred-only"
-        />
-      </div>
-      <div class="min-h-0 flex-1">
-        <OTable
-          :data="rows"
-          :columns="columns"
-          row-key="id"
-          :loading="history.isPending.value && open"
-          :frame="false"
-          :default-columns="false"
-          :show-global-filter="false"
-          pagination="none"
-          sorting="none"
-          wrap
-          data-test="metrics-history-table"
-          @row-click="onLoad"
-        >
-          <template #cell-query="{ row }">
-            <span class="text-text-body font-mono text-xs break-all">{{ row.query }}</span>
-          </template>
-          <template #cell-created_at="{ row }">
-            <OTimeCell :value="row.created_at" unit="us" mode="relative" />
-          </template>
-          <template #cell-actions="{ row }">
-            <div class="flex items-center gap-1">
-              <OButton
-                variant="ghost"
-                size="icon-sm"
-                class="max-md:hidden"
-                :icon-left="row.starred ? 'star' : 'star-outline'"
-                :aria-label="row.starred ? t('metrics.history.unstar') : t('metrics.history.star')"
-                :data-test="`metrics-history-star-${row.id}`"
-                @click.stop="toggleStar(row)"
-              >
-                <OTooltip
-                  :content="row.starred ? t('metrics.history.unstar') : t('metrics.history.star')"
-                />
-              </OButton>
-              <OButton
-                variant="ghost-destructive"
-                size="icon-sm"
-                class="max-md:hidden"
-                icon-left="delete"
-                :aria-label="t('common.delete')"
-                :data-test="`metrics-history-delete-${row.id}`"
-                @click.stop="deleteEntry.mutate(row.id)"
-              >
-                <OTooltip :content="t('common.delete')" />
-              </OButton>
-              <ODropdown side="bottom" align="end">
-                <template #trigger>
-                  <OButton
-                    variant="ghost"
-                    size="icon-xs-sq"
-                    icon-left="more-vert"
-                    class="md:hidden"
-                    :aria-label="t('common.more')"
-                    :data-test="`metrics-history-more-${row.id}`"
-                    @click.stop
-                  />
-                </template>
-                <ODropdownItem
-                  :icon-left="row.starred ? 'star' : 'star-outline'"
-                  :data-test="`metrics-history-star-${row.id}-menu`"
-                  @select="toggleStar(row)"
-                >
-                  <span>{{
-                    row.starred ? t("metrics.history.unstar") : t("metrics.history.star")
-                  }}</span>
-                </ODropdownItem>
-                <ODropdownItem
-                  variant="destructive"
-                  icon-left="delete"
-                  :data-test="`metrics-history-delete-${row.id}-menu`"
-                  @select="deleteEntry.mutate(row.id)"
-                >
-                  <span>{{ t("common.delete") }}</span>
-                </ODropdownItem>
-              </ODropdown>
-            </div>
-          </template>
-          <template #empty>
-            <OEmptyState
-              size="inline"
-              icon="history"
-              :title="filtered ? t('metrics.history.noMatch') : t('metrics.history.empty')"
-              data-test="metrics-history-empty"
-            />
-          </template>
-        </OTable>
-      </div>
-      <div
-        v-if="history.hasNextPage.value"
-        class="border-border-default flex shrink-0 justify-center border-t p-3"
-      >
-        <OButton
-          variant="outline"
-          size="sm"
-          :loading="history.isFetchingNextPage.value"
-          data-test="metrics-history-load-more"
-          @click="history.fetchNextPage()"
-        >
-          {{ t("metrics.history.loadMore") }}
-        </OButton>
-      </div>
-    </div>
-  </ODrawer>
+  <RecentSearchesDrawer ref="drawerRef" v-model:open="open" source="metrics" @restore="restore" />
 </template>
 
 <script setup lang="ts">
-import { computed, ref } from "vue";
-import { useInfiniteQuery, useMutation } from "@tanstack/vue-query";
-import { useI18nTyped } from "@/types/i18n";
-import useBreakpoint from "@/composables/useBreakpoint";
+import { ref } from "vue";
+import { useRouter } from "vue-router";
 import { useOrgId } from "@/composables/query/useOrgId";
-import {
-  deleteQueryHistoryMutation,
-  queryHistoryQuery,
-  starQueryHistoryMutation,
-} from "@/services/query_history.queries";
-import type { QueryHistoryEntry } from "@/services/query_history";
-import { historyEntryToLoad } from "@/utils/metrics/queryHistory";
+import type { HistoryStatus, QueryHistoryEntry } from "@/services/query_history";
 import type { SelectedDate } from "@/utils/dashboard/urlTimeParams";
-import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
-import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
-import OButton from "@/lib/core/Button/OButton.vue";
-import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
-import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
-import OSwitch from "@/lib/forms/Switch/OSwitch.vue";
-import OTable from "@/lib/core/Table/OTable.vue";
-import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
-import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
-import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
-import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
+import { metricsRestore } from "@/utils/queryHistory/metrics";
+import { openRecentOnItsPage } from "@/utils/queryHistory/routes";
+import type { RestoreTime } from "@/utils/queryHistory/recentSearches";
+import RecentSearchesDrawer from "@/components/queryHistory/RecentSearchesDrawer.vue";
 
 const emit = defineEmits<{
-  load: [entry: { metricsData: string; timeRange: SelectedDate }];
+  load: [entry: { metricsData: string; timeRange: SelectedDate; run: boolean }];
 }>();
 
-const { t } = useI18nTyped();
-const { isMobile } = useBreakpoint();
+const open = defineModel<boolean>("open", { default: false });
+
+const router = useRouter();
 const orgId = useOrgId();
+const drawerRef = ref<InstanceType<typeof RecentSearchesDrawer> | null>(null);
 
-const open = ref(false);
-const search = ref("");
-const starredOnly = ref(false);
-
-const history = useInfiniteQuery(() =>
-  Object.assign(queryHistoryQuery(orgId.value, starredOnly.value, search.value.trim()), {
-    enabled: open.value && !!orgId.value,
-  }),
-);
-const filtered = computed(() => !!search.value.trim() || starredOnly.value);
-// The server returns newest first; the table keeps that order.
-const rows = computed(() => history.data.value?.pages.flat() ?? []);
-
-const starEntry = useMutation(() => starQueryHistoryMutation(orgId.value));
-const deleteEntry = useMutation(() => deleteQueryHistoryMutation(orgId.value));
-
-const toggleStar = (row: QueryHistoryEntry) =>
-  starEntry.mutate({ id: row.id, starred: !row.starred });
-
-const columns = computed<OTableColumnDef<QueryHistoryEntry>[]>(() => [
-  {
-    id: "query",
-    header: t("metrics.history.query"),
-    accessorKey: "query",
-    meta: { autoWidth: true, fillRemaining: true },
-  },
-  { id: "created_at", header: t("metrics.history.ranAt"), accessorKey: "created_at", size: 112 },
-  { id: "actions", header: t("common.actions"), isAction: true, size: 80 },
-]);
-
-const onLoad = (row: QueryHistoryEntry) => {
-  const entry = historyEntryToLoad(row.context);
-  if (!entry) return;
-  emit("load", entry);
-  open.value = false;
+/** Applies a row here, or opens another page's row on that page. */
+const restore = (entry: QueryHistoryEntry, when: RestoreTime, run: boolean) => {
+  if (entry.source !== "metrics") {
+    void openRecentOnItsPage(router, entry, when, orgId.value, run);
+    return;
+  }
+  const loaded = metricsRestore(entry, when);
+  if (loaded) emit("load", { ...loaded, run });
 };
+
+const show = (status: HistoryStatus | null = null) => drawerRef.value?.show(status);
+
+defineExpose({ show, restore });
 </script>
diff --git a/web/src/plugins/metrics/explorer/MetricsExplorer.spec.ts b/web/src/plugins/metrics/explorer/MetricsExplorer.spec.ts
index 4ea55cac65..a35cba6ebf 100644
--- a/web/src/plugins/metrics/explorer/MetricsExplorer.spec.ts
+++ b/web/src/plugins/metrics/explorer/MetricsExplorer.spec.ts
@@ -1974,14 +1974,26 @@ describe("MetricsExplorer wiring", () => {
       const timeRange = { valueType: "relative", relativeTimePeriod: "6h" };
       wrapper
         .findComponent('[data-test="metrics-history"]')
-        .vm.$emit("load", { metricsData: "blob", timeRange });
-      expect(visualizeApplyPanelData).toHaveBeenCalledWith("blob", timeRange);
+        .vm.$emit("load", { metricsData: "blob", timeRange, run: true });
+      expect(visualizeApplyPanelData).toHaveBeenCalledWith("blob", timeRange, true);
       expect(analytics.track).toHaveBeenCalledWith(
         "metrics_explorer_history_loaded",
         expect.any(Object),
       );
     });
 
+    it("passes a load-only pick through without running", async () => {
+      const wrapper = mountExplorer();
+      (wrapper.vm as unknown as { setMode: (mode: string) => void }).setMode("visualize");
+      await wrapper.vm.$nextTick();
+
+      const timeRange = { valueType: "relative", relativeTimePeriod: "6h" };
+      wrapper
+        .findComponent('[data-test="metrics-history"]')
+        .vm.$emit("load", { metricsData: "blob", timeRange, run: false });
+      expect(visualizeApplyPanelData).toHaveBeenCalledWith("blob", timeRange, false);
+    });
+
     it("the pane's range change sets the toolbar picker", async () => {
       const setSavedDate = vi.fn();
       const wrapper = mountExplorer({
diff --git a/web/src/plugins/metrics/explorer/MetricsExplorer.vue b/web/src/plugins/metrics/explorer/MetricsExplorer.vue
index 6c57f5e118..281e04c166 100644
--- a/web/src/plugins/metrics/explorer/MetricsExplorer.vue
+++ b/web/src/plugins/metrics/explorer/MetricsExplorer.vue
@@ -115,7 +115,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         />
         <!-- Only an explicit Run writes query history; Refresh does not. -->
         <template v-if="mode === 'visualize'">
-          <QueryHistoryDrawer @load="onHistoryLoad" />
+          <QueryHistoryDrawer ref="historyDrawerRef" @load="onHistoryLoad" />
+          <RecentSearchesFocusDropdown
+            ref="recentDropdownRef"
+            v-model:open="recentEditor.open.value"
+            source="metrics"
+            :anchor="recentEditor.anchor.value"
+            @run="(entry, when) => historyDrawerRef?.restore(entry, when, true)"
+            @load="(entry, when) => historyDrawerRef?.restore(entry, when, false)"
+            @view-all="(status) => historyDrawerRef?.show(status)"
+          />
+          <RecentSearchesButton
+            source="metrics"
+            data-test="metrics-history-btn"
+            @run="(entry, when) => historyDrawerRef?.restore(entry, when, true)"
+            @load="(entry, when) => historyDrawerRef?.restore(entry, when, false)"
+            @view-all="(status) => historyDrawerRef?.show(status)"
+          />
           <OButtonGroup>
             <OButton
               :variant="isVisualizePending ? 'pending' : 'primary'"
@@ -747,6 +763,10 @@ import FunctionConfigDialog from "./FunctionConfigDialog.vue";
 import MetricDetailView from "./MetricDetailView.vue";
 import ExplorerSavedViews from "./ExplorerSavedViews.vue";
 import QueryHistoryDrawer from "../QueryHistoryDrawer.vue";
+import RecentSearchesButton from "@/components/queryHistory/RecentSearchesButton.vue";
+import RecentSearchesFocusDropdown from "@/components/queryHistory/RecentSearchesFocusDropdown.vue";
+import { useRecentSearchesEditorHost } from "@/composables/queryHistory/useRecentSearchesEditorHost";
+import { metricsEditorIsEmpty, metricsEditorIsEmptyWith } from "@/utils/queryHistory/metrics";
 
 import useMetricsExplorerGrid, {
   PAGE_SIZE_INCREMENT,
@@ -835,6 +855,8 @@ export default defineComponent({
     MetricDetailView,
     ExplorerSavedViews,
     QueryHistoryDrawer,
+    RecentSearchesButton,
+    RecentSearchesFocusDropdown,
   },
   setup() {
     const { t } = useI18nTyped();
@@ -2093,8 +2115,21 @@ export default defineComponent({
     const onVisualizeRunWithoutCache = () =>
       visualizeRef.value?.onUserRun?.(selectedDate.value, true);
 
-    const onHistoryLoad = (entry: { metricsData: string; timeRange: SelectedDate }) => {
-      visualizeRef.value?.applyPanelData?.(entry.metricsData, entry.timeRange);
+    const historyDrawerRef = ref<InstanceType<typeof QueryHistoryDrawer> | null>(null);
+    // One editor takes one query, so multi-query rows stay out of its clock rows.
+    const recentEditor = useRecentSearchesEditorHost("metrics", {
+      opensOnFocus: () => metricsEditorIsEmpty(visualizeRef.value?.dashboardPanelData),
+      emptyWith: (isBlank) =>
+        metricsEditorIsEmptyWith(visualizeRef.value?.dashboardPanelData, isBlank),
+      acceptsQuery: (query) => !query.includes("\n"),
+    });
+
+    const onHistoryLoad = (entry: {
+      metricsData: string;
+      timeRange: SelectedDate;
+      run?: boolean;
+    }) => {
+      visualizeRef.value?.applyPanelData?.(entry.metricsData, entry.timeRange, entry.run !== false);
       track("metrics_explorer_history_loaded");
     };
 
@@ -2363,6 +2398,9 @@ export default defineComponent({
       onVisualizeRun,
       onVisualizeRunWithoutCache,
       onHistoryLoad,
+      historyDrawerRef,
+      recentEditor,
+      recentDropdownRef: recentEditor.dropdownRef,
       onVisualizeTimeRange,
     };
   },
diff --git a/web/src/plugins/metrics/explorer/MetricsVisualize.historyStatus.spec.ts b/web/src/plugins/metrics/explorer/MetricsVisualize.historyStatus.spec.ts
new file mode 100644
index 0000000000..0fc070f3de
--- /dev/null
+++ b/web/src/plugins/metrics/explorer/MetricsVisualize.historyStatus.spec.ts
@@ -0,0 +1,251 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { enableAutoUnmount, flushPromises, shallowMount } from "@vue/test-utils";
+import { nextTick, reactive, ref, type Ref } from "vue";
+import i18n from "@/locales";
+
+interface EditorState {
+  isLoading: Ref<boolean> | null;
+  chartData: Ref<object> | null;
+}
+
+interface VisualizeApi {
+  onUserRun: (range: typeof RANGE) => void;
+}
+
+const panel = vi.hoisted(() => ({ current: null as ReturnType<typeof makePanel> | null }));
+const editor = vi.hoisted((): EditorState => ({ isLoading: null, chartData: null }));
+
+const makePanel = () =>
+  reactive({
+    data: {
+      type: "line",
+      queryType: "promql",
+      config: {},
+      queries: [
+        { query: "sum(up)", customQuery: true, fields: { stream: "up", stream_type: "metrics" } },
+      ],
+    },
+    layout: {
+      splitter: 20,
+      showFieldList: true,
+      showQueryBar: true,
+      querySplitter: 50,
+      currentQueryIndex: 0,
+      isConfigPanelOpen: false,
+    },
+    meta: {
+      dateTime: { start_time: new Date(1000), end_time: new Date(2000) },
+      stream: { customQueryFields: [], vrlFunctionFieldList: [] },
+      streamFields: { groupedFields: [] },
+    },
+  });
+
+vi.mock("vuex", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("vuex")>()),
+  useStore: () => ({
+    state: {
+      timezone: "UTC",
+      theme: "light",
+      selectedOrganization: { identifier: "org1" },
+      organizationData: { isDataIngested: true },
+      zoConfig: {
+        query_history_enabled: true,
+        timestamp_column: "_timestamp",
+        default_functions: [],
+        auto_query_enabled: false,
+      },
+      savedViewDialog: { show: false },
+    },
+    commit: vi.fn(),
+    dispatch: vi.fn().mockResolvedValue({}),
+    getters: {},
+  }),
+}));
+
+vi.mock("@/composables/dashboard/useDashboardPanel", () => ({
+  default: () => ({
+    dashboardPanelData: panel.current,
+    resetDashboardPanelData: vi.fn(),
+    validatePanel: vi.fn(),
+    makeAutoSQLQuery: vi.fn(async () => undefined),
+    regenerateOtherBuilderQueries: vi.fn(),
+    resetAggregationFunction: vi.fn(),
+    updateGroupedFields: vi.fn(),
+  }),
+}));
+
+vi.mock("@/components/dashboards/PanelEditor/composables/usePanelEditor", () => ({
+  usePanelEditor: vi.fn(() => {
+    editor.isLoading = ref(false);
+    editor.chartData = ref({});
+    return {
+      chartData: editor.chartData,
+      errorData: reactive({ errors: [] }),
+      metaData: ref(null),
+      seriesData: ref([]),
+      lastTriggeredAt: ref(null),
+      showLegendsDialog: ref(false),
+      shouldRefreshWithoutCache: ref(false),
+      maxQueryRangeWarning: ref(""),
+      panelDiagnostics: ref(null),
+      seriesLimit: ref(null),
+      noticeProps: ref({}),
+      handlePanelDiagnosticsUpdate: vi.fn(),
+      handleSeriesLimitUpdate: vi.fn(),
+      limitNumberOfSeriesWarningMessage: ref(""),
+      errorMessage: ref(""),
+      isPartialData: ref(false),
+      isPanelLoading: ref(false),
+      isCachedDataDifferWithCurrentTimeRange: ref(false),
+      searchRequestTraceIds: ref([]),
+      panelSchemaRendererRef: ref(null),
+      splitterModel: ref(50),
+      isOutDated: ref(false),
+      isLoading: editor.isLoading,
+      currentPanelData: ref({}),
+      initChartData: vi.fn(),
+      runQuery: vi.fn(() => {
+        if (editor.isLoading) editor.isLoading.value = true;
+      }),
+      handleChartApiError: vi.fn(),
+      handleLastTriggeredAtUpdate: vi.fn(),
+      handleLimitNumberOfSeriesWarningMessage: vi.fn(),
+      handleIsPartialDataUpdate: vi.fn(),
+      handleLoadingStateChange: vi.fn(),
+      handleIsCachedDataDifferWithCurrentTimeRangeUpdate: vi.fn(),
+      handleResultMetadataUpdate: vi.fn(),
+      metaDataValue: vi.fn(),
+      seriesDataUpdate: vi.fn(),
+      collapseFieldList: vi.fn(),
+      layoutSplitterUpdated: vi.fn(),
+      updateVrlFunctionFieldList: vi.fn(),
+      onDataZoom: vi.fn().mockReturnValue({ start: new Date(), end: new Date() }),
+      cancelRunningQuery: vi.fn(),
+      resetErrors: vi.fn(),
+      updateDateTime: vi.fn(),
+    };
+  }),
+}));
+
+const historyApi = vi.hoisted(() => ({
+  record: vi.fn(),
+  list: vi.fn(),
+  star: vi.fn(),
+  remove: vi.fn(),
+}));
+vi.mock("@/services/query_history", () => ({ default: historyApi }));
+
+vi.mock("@/utils/streamPersist", () => ({ restoreMetricsStream: vi.fn(() => "") }));
+
+import MetricsVisualize from "./MetricsVisualize.vue";
+
+enableAutoUnmount(afterEach);
+
+const RANGE = { valueType: "relative", relativeTimePeriod: "1h", startTime: null, endTime: null };
+
+const mountVisualize = () =>
+  shallowMount(MetricsVisualize, {
+    props: { selectedDateTime: { startTime: 1000, endTime: 2000 } },
+    global: {
+      plugins: [i18n],
+      stubs: {
+        PanelEditor: false,
+        OSplitter: {
+          name: "OSplitter",
+          template:
+            '<div><slot name="before" /><slot name="separator" /><slot name="after" /></div>',
+        },
+        PanelSchemaRenderer: {
+          name: "PanelSchemaRenderer",
+          emits: ["error"],
+          template: "<div />",
+        },
+      },
+    },
+  });
+
+const settle = async (wrapper: ReturnType<typeof mountVisualize>, error: object) => {
+  wrapper.findComponent({ name: "PanelSchemaRenderer" }).vm.$emit("error", error);
+  if (editor.isLoading) editor.isLoading.value = false;
+  await flushPromises();
+  await nextTick();
+};
+
+const run = async (wrapper: ReturnType<typeof mountVisualize>) => {
+  (wrapper.vm as unknown as VisualizeApi).onUserRun(RANGE);
+  await flushPromises();
+};
+
+describe("Metrics history status from the real PanelEditor", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    panel.current = makePanel();
+    historyApi.record.mockResolvedValue({ data: {} });
+  });
+
+  it("renders the real PanelEditor around the renderer", async () => {
+    const wrapper = mountVisualize();
+    await flushPromises();
+    expect(wrapper.findComponent({ name: "PanelSchemaRenderer" }).exists()).toBe(true);
+  });
+
+  it("records a renderer query error as failed with its message", async () => {
+    const wrapper = mountVisualize();
+    await flushPromises();
+    if (panel.current) panel.current.data.queries[0].query = "sum(up{";
+    await run(wrapper);
+    await settle(wrapper, { message: "parse error: unclosed left brace", code: 400 });
+
+    expect(historyApi.record).toHaveBeenCalledTimes(1);
+    expect(historyApi.record.mock.calls[0][1].context.time).toMatchObject({
+      start_time: 1000,
+      end_time: 2000,
+    });
+    expect(historyApi.record.mock.calls[0][1]).toMatchObject({
+      source: "metrics",
+      query: "sum(up{",
+      status: "error",
+      context: { error: "parse error: unclosed left brace" },
+    });
+  });
+
+  it("records ok once the renderer clears its error, and nothing for a cancel", async () => {
+    const wrapper = mountVisualize();
+    await flushPromises();
+    await run(wrapper);
+    await settle(wrapper, { message: "query cancelled", code: 20009 });
+    expect(historyApi.record).not.toHaveBeenCalled();
+
+    await run(wrapper);
+    await settle(wrapper, { message: "", code: "" });
+    expect(historyApi.record).toHaveBeenCalledTimes(1);
+    expect(historyApi.record.mock.calls[0][1]).toMatchObject({ status: "ok" });
+    expect(historyApi.record.mock.calls[0][1].context.error).toBeUndefined();
+  });
+
+  it("records a timeout as ok with a warning", async () => {
+    const wrapper = mountVisualize();
+    await flushPromises();
+    await run(wrapper);
+    await settle(wrapper, { message: "search timed out", code: 20010 });
+    expect(historyApi.record.mock.calls[0][1]).toMatchObject({
+      status: "ok",
+      context: { warning: "search timed out" },
+    });
+  });
+});
diff --git a/web/src/plugins/metrics/explorer/MetricsVisualize.spec.ts b/web/src/plugins/metrics/explorer/MetricsVisualize.spec.ts
index b94bac6eb5..39a17c127a 100644
--- a/web/src/plugins/metrics/explorer/MetricsVisualize.spec.ts
+++ b/web/src/plugins/metrics/explorer/MetricsVisualize.spec.ts
@@ -15,7 +15,7 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
-import { reactive } from "vue";
+import { nextTick, reactive, type SetupContext } from "vue";
 
 // A fresh panel-data object per test so mounting can reset it in place and the
 // assertions see the metrics defaults the container applied.
@@ -49,6 +49,7 @@ const editorRunQuery = vi.hoisted(() => vi.fn());
 const injectedRunQuery = vi.hoisted(() => ({ current: null as any }));
 /** The stub's exposed staleness state, as refs so the container's computed tracks them. */
 const editorState = vi.hoisted(() => ({ current: null as any }));
+const emitChartError = vi.hoisted(() => ({ current: null as ((e: unknown) => void) | null }));
 
 // The real PanelEditor pulls in ECharts + the whole dashboard config surface;
 // none of that is what this container's own logic needs. Stub it, but keep its
@@ -61,9 +62,10 @@ vi.mock("@/components/dashboards/PanelEditor", async () => {
     PanelEditor: {
       name: "PanelEditor",
       props: ["allowedChartTypes"],
-      emits: ["add-to-dashboard", "chart-api-error"],
-      setup: (_: any, { expose }: any) => {
+      emits: ["add-to-dashboard", "chart-api-error", "renderer-error"],
+      setup: (_: unknown, { expose, emit }: SetupContext) => {
         injectedRunQuery.current = inject("runQuery", null);
+        emitChartError.current = (e: unknown) => emit("renderer-error", e);
         editorState.current = {
           isOutDated: ref(false),
           isLoading: ref(false),
@@ -72,6 +74,7 @@ vi.mock("@/components/dashboards/PanelEditor", async () => {
         // Like the real editor, a run snapshots the panel it ran with.
         const runQuery = (...args: any[]) => {
           editorRunQuery(...args);
+          editorState.current.isLoading.value = true;
           editorState.current.chartData.value = JSON.parse(JSON.stringify(panelData.current.data));
         };
         expose({ runQuery, ...editorState.current });
@@ -103,7 +106,7 @@ vi.mock("@/utils/streamPersist", () => ({
 // partial: the panel seed path reaches @/stores, which needs the real createStore
 const storeState = vi.hoisted(() => ({
   selectedOrganization: { identifier: "org1" },
-  zoConfig: { auto_query_enabled: false },
+  zoConfig: { auto_query_enabled: false, query_history_enabled: true },
 }));
 vi.mock("vuex", async (importOriginal) => ({
   ...(await importOriginal<typeof import("vuex")>()),
@@ -119,6 +122,17 @@ const historyApi = vi.hoisted(() => ({
 vi.mock("@/services/query_history", () => ({ default: historyApi }));
 
 import MetricsVisualize from "./MetricsVisualize.vue";
+
+interface VisualizeApi {
+  onUserRun: (range: object) => void;
+}
+
+const finishRun = async (error?: { message: string; code: number }) => {
+  if (error) emitChartError.current?.(error);
+  editorState.current.isLoading.value = false;
+  await flushPromises();
+  await nextTick();
+};
 import { encodeMetricsConfig } from "@/composables/metrics/metricsUrlState";
 import { LIVE_PREVIEW_DEBOUNCE_MS } from "@/composables/dashboard/usePanelLivePreview";
 
@@ -203,6 +217,7 @@ describe("MetricsVisualize", () => {
       panelData.current.data.queries[0].query = "avg(up)";
       (wrapper.vm as any).runQuery();
       await flushPromises();
+      await finishRun();
       editorRunQuery.mockClear();
       window.dispatchEvent(new Event("pointerdown"));
       return wrapper;
@@ -224,6 +239,7 @@ describe("MetricsVisualize", () => {
 
       vm.onUserRun({ valueType: "relative", relativeTimePeriod: "15m" });
       await flushPromises();
+      await finishRun();
       expect(vm.isRunQueryPending).toBe(false);
       expect(historyApi.record).toHaveBeenCalledTimes(1);
     });
@@ -265,6 +281,7 @@ describe("MetricsVisualize", () => {
       const wrapper = await mountEdited();
       (wrapper.vm as any).onUserRun({ valueType: "relative", relativeTimePeriod: "15m" }, true);
       await flushPromises();
+      await finishRun();
       expect(editorRunQuery).toHaveBeenCalledWith(true);
       expect(historyApi.record).toHaveBeenCalledTimes(1);
     });
@@ -360,6 +377,8 @@ describe("MetricsVisualize", () => {
 
       (wrapper.vm as any).onUserRun(RANGE);
       await flushPromises();
+      expect(historyApi.record).not.toHaveBeenCalled();
+      await finishRun();
 
       expect(editorRunQuery).toHaveBeenCalledTimes(1);
       expect(historyApi.record).toHaveBeenCalledWith(
@@ -403,6 +422,7 @@ describe("MetricsVisualize", () => {
 
       (wrapper.vm as any).onUserRun(RANGE);
       await flushPromises();
+      await finishRun();
       expect(editorRunQuery).toHaveBeenCalledTimes(1);
       expect(consoleError).toHaveBeenCalled();
       expect(showErrorNotification).not.toHaveBeenCalled();
@@ -423,6 +443,26 @@ describe("MetricsVisualize", () => {
       expect(historyApi.record).not.toHaveBeenCalled();
     });
 
+    it("records a failed run as error and a cancelled run not at all", async () => {
+      const wrapper = mountVisualize({ selectedDateTime: { startTime: 1000, endTime: 2000 } });
+      await flushPromises();
+      withQuery("sum(up{");
+
+      (wrapper.vm as unknown as VisualizeApi).onUserRun(RANGE);
+      await flushPromises();
+      await finishRun({ message: "parse error: unclosed left brace", code: 400 });
+      expect(historyApi.record.mock.calls[0][1]).toMatchObject({
+        status: "error",
+        context: { error: "parse error: unclosed left brace" },
+      });
+
+      historyApi.record.mockClear();
+      (wrapper.vm as unknown as VisualizeApi).onUserRun(RANGE);
+      await flushPromises();
+      await finishRun({ message: "cancelled", code: 20009 });
+      expect(historyApi.record).not.toHaveBeenCalled();
+    });
+
     it("applies two consecutive entries live, each with its range, running once each", async () => {
       // A parent that owns the range, as the explorer does.
       const Parent = {
@@ -460,7 +500,13 @@ describe("MetricsVisualize", () => {
       expect(data.queries[0].query).toBe("max(b)");
       expect(panelData.current.meta.dateTime.start_time).toEqual(new Date(7000));
       expect(editorRunQuery).toHaveBeenCalledTimes(2);
-      expect(historyApi.record).not.toHaveBeenCalled();
+      await finishRun();
+      expect(historyApi.record).toHaveBeenCalledTimes(1);
+
+      await viz.applyPanelData(blob("bar", "sum(c)"), RANGE, false);
+      await flushPromises();
+      expect(data.queries[0].query).toBe("sum(c)");
+      expect(editorRunQuery).toHaveBeenCalledTimes(2);
     });
   });
 });
diff --git a/web/src/plugins/metrics/explorer/MetricsVisualize.vue b/web/src/plugins/metrics/explorer/MetricsVisualize.vue
index d656080032..a8f5f7eba8 100644
--- a/web/src/plugins/metrics/explorer/MetricsVisualize.vue
+++ b/web/src/plugins/metrics/explorer/MetricsVisualize.vue
@@ -39,6 +39,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :selected-date-time="dashboardPanelData.meta.dateTime"
       @add-to-dashboard="onAddToDashboard"
       @chart-api-error="onChartApiError"
+      @renderer-error="onRendererError"
     />
 
     <AddToDashboard
@@ -69,6 +70,7 @@ import useNotifications from "@/composables/useNotifications";
 import { restoreMetricsStream } from "@/utils/streamPersist";
 import { applyMetricsBlob, normaliseMetricsBlobData } from "@/composables/metrics/metricsUrlState";
 import { useQueryHistoryRecorder } from "@/composables/metrics/useQueryHistoryRecorder";
+import type { PanelErrorDetail } from "@/utils/queryHistory/metrics";
 import type { SelectedDate } from "@/utils/dashboard/urlTimeParams";
 import { PanelEditor } from "@/components/dashboards/PanelEditor";
 import type { PanelEditorVariablesData } from "@/components/dashboards/PanelEditor";
@@ -195,6 +197,11 @@ export default defineComponent({
       // PanelEditor surfaces its own error UI; nothing extra to do here.
     };
 
+    // History reads the renderer's error to classify the run; PanelEditor shows it itself.
+    const onRendererError = (error: PanelErrorDetail | string | null) => {
+      historyRecorder.onPanelError(error);
+    };
+
     const timeKey = () => `${props.selectedDateTime?.startTime}:${props.selectedDateTime?.endTime}`;
     // The window the chart last ran with; null until the first one is applied, which always applies.
     const appliedTimeKey = ref<string | null>(null);
@@ -270,27 +277,27 @@ export default defineComponent({
       if (on && isTimeChangePending.value) runQuery();
     });
 
-    const { record } = useQueryHistoryRecorder();
+    const historyRecorder = useQueryHistoryRecorder(() => !!panelEditorRef.value?.isLoading);
 
     /** An explicit Run (button, shortcut or Refresh Cache & Run): the only run that writes history. */
     const onUserRun = (selectedDate: SelectedDate, withoutCache = false) => {
       runQuery(withoutCache);
       const errors: string[] = [];
       validatePanel(errors, false);
-      if (!errors.length) record(dashboardPanelData, selectedDate);
+      if (!errors.length) historyRecorder.record(dashboardPanelData, selectedDate);
     };
 
     // Set while applying an entry, so its range change does not also run the old query.
     let applyingEntry = false;
 
-    /** Loads a history entry live: its panel in place, its range on the parent's picker, one run. */
-    const applyPanelData = async (metricsData: string, timeRange: SelectedDate) => {
+    /** Loads a history entry live: its panel in place, its range on the parent's picker; a re-run is a user Run. */
+    const applyPanelData = async (metricsData: string, timeRange: SelectedDate, run = true) => {
       if (!applyMetricsBlob(metricsData, dashboardPanelData)) return;
       applyingEntry = true;
       emit("update:time-range", timeRange);
       await nextTick();
       applyingEntry = false;
-      runQuery();
+      if (run) onUserRun(timeRange);
     };
 
     // Declared AFTER applyDateTime/runQuery: the hooks call them, and a const
@@ -332,6 +339,7 @@ export default defineComponent({
       showAddToDashboardDialog,
       onAddToDashboard,
       onChartApiError,
+      onRendererError,
       runQuery,
       onUserRun,
       applyPanelData,
diff --git a/web/src/plugins/traces/Index.spec.ts b/web/src/plugins/traces/Index.spec.ts
index 480b65d8fa..8a1e8b57fa 100644
--- a/web/src/plugins/traces/Index.spec.ts
+++ b/web/src/plugins/traces/Index.spec.ts
@@ -26,6 +26,10 @@ import router from "@/test/unit/helpers/router";
 import * as useDurationPercentilesModule from "@/composables/useDurationPercentiles";
 import { buildViewTracesFilter } from "@/plugins/traces/viewTracesHandoff";
 import analytics from "@/services/product_analytics";
+import queryHistory from "@/services/query_history";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { openRecentOnItsPage, takeRecentLanding } from "@/utils/queryHistory/routes";
+import { landingRouter, landWithoutRestore } from "@/test/unit/helpers/recentLanding";
 import {
   announceTracesRowNav,
   tracesRowNavAnnouncement,
@@ -1609,6 +1613,143 @@ describe("Index.vue (Main Traces Page)", () => {
       return calls[calls.length - 1][1];
     };
 
+    it("records a Run in recent searches once it completes, and never a page fetch", async () => {
+      const record = vi.spyOn(queryHistory, "record").mockResolvedValue({ data: {} } as never);
+      await mountPage();
+      mockSearchObj.data.resultGrid.currentPage = 0;
+      mockSearchObj.data.editorValue = "service_name = 'cart'";
+      wrapper.vm.runQueryFn();
+      await flushPromises();
+      lastCallbacks().complete({});
+      await flushPromises();
+      expect(record).toHaveBeenCalledTimes(1);
+      expect(record.mock.calls[0][1]).toMatchObject({
+        source: "traces",
+        query: "service_name = 'cart'",
+        streams: ["default"],
+        status: "ok",
+        context: { page: { stream: "default", tab: "spans" } },
+      });
+
+      record.mockClear();
+      await wrapper.vm.getMoreData();
+      lastCallbacks().complete({});
+      await flushPromises();
+      expect(record).not.toHaveBeenCalled();
+      record.mockRestore();
+    });
+
+    it("records a query error as failed and a cancel not at all", async () => {
+      const record = vi.spyOn(queryHistory, "record").mockResolvedValue({ data: {} } as never);
+      await mountPage();
+      mockSearchObj.data.editorValue = "nosuch = 1";
+      wrapper.vm.runQueryFn();
+      await flushPromises();
+      lastCallbacks().error({}, { content: { code: 20004, message: "field not found" } });
+      await flushPromises();
+      expect(record.mock.calls[0][1]).toMatchObject({
+        status: "error",
+        context: { error: "field not found" },
+      });
+
+      record.mockClear();
+      wrapper.vm.runQueryFn();
+      await flushPromises();
+      lastCallbacks().error({}, { content: { code: 20009, message: "cancelled" } });
+      await flushPromises();
+      expect(record).not.toHaveBeenCalled();
+      record.mockRestore();
+    });
+
+    describe("page landings and restores from another page", () => {
+      const restoredEntry: QueryHistoryEntry = {
+        id: "t1",
+        source: "traces",
+        query: "service_name = 'cart'",
+        query_key: "k",
+        streams: ["default"],
+        context: { page: { stream: "default", tab: "spans" } },
+        status: "ok",
+        starred: false,
+        run_count: 1,
+        created_at: 1,
+        updated_at: 2,
+      };
+      const landWith = async (run: boolean | null) => {
+        mockSearchObj.data.stream.streamLists = [{ label: "default", value: "default" }];
+        mockSearchObj.data.stream.selectedStream = { label: "default", value: "default" };
+        if (run !== null) {
+          await openRecentOnItsPage(landingRouter().router, restoredEntry, "now", "default", run);
+        }
+        mockSearchObj.data.editorValue = "service_name = 'cart'";
+        const before = mockFetchQueryDataWithHttpStream.mock.calls.length;
+        await wrapper.vm.loadPageData();
+        await flushPromises();
+        mockSearchObj.data.stream.streamLists = [{ label: "default", value: "default" }];
+        mockSearchObj.data.stream.selectedStream = { label: "default", value: "default" };
+        return mockFetchQueryDataWithHttpStream.mock.calls.length - before;
+      };
+
+      it("runs a plain landing without recording it", async () => {
+        const record = vi.spyOn(queryHistory, "record").mockResolvedValue({ data: {} } as never);
+        await mountPage();
+        record.mockClear();
+        expect(await landWith(null)).toBe(1);
+        lastCallbacks().complete({});
+        await flushPromises();
+        expect(record).not.toHaveBeenCalled();
+        record.mockRestore();
+      });
+
+      it("runs and records a restore that asked to run", async () => {
+        const record = vi.spyOn(queryHistory, "record").mockResolvedValue({ data: {} } as never);
+        await mountPage();
+        record.mockClear();
+        expect(await landWith(true)).toBe(1);
+        lastCallbacks().complete({});
+        await flushPromises();
+        expect(record).toHaveBeenCalledTimes(1);
+        record.mockRestore();
+      });
+
+      it("claims a restore that finds no stream, so a later landing is not taken for it", async () => {
+        await mountPage();
+        await openRecentOnItsPage(landingRouter().router, restoredEntry, "now", "default", true);
+        mockGetStreams.mockResolvedValueOnce({ list: [] });
+        mockSearchObj.data.stream.streamLists = [];
+        mockSearchObj.data.stream.selectedStream = { label: "", value: "" };
+        const before = mockFetchQueryDataWithHttpStream.mock.calls.length;
+        await wrapper.vm.loadPageData();
+        await flushPromises();
+        expect(mockSearchObj.data.stream.selectedStream.value || "").toBe("");
+        expect(mockFetchQueryDataWithHttpStream.mock.calls.length).toBe(before);
+        expect(takeRecentLanding("traces")).toBeNull();
+        landWithoutRestore();
+      });
+
+      it("remembers the query each search ran with, so the Run button can tell when the editor moved on", async () => {
+        await mountPage();
+        mockSearchObj.data.editorValue = "service_name = 'cart'";
+        wrapper.vm.runQueryFn();
+        await flushPromises();
+        expect(mockSearchObj.data.appliedEditorValue).toBe("service_name = 'cart'");
+        mockSearchObj.data.editorValue = "service_name = 'checkout'";
+        await wrapper.vm.getMoreData();
+        await flushPromises();
+        expect(mockSearchObj.data.appliedEditorValue).toBe("service_name = 'cart'");
+      });
+
+      it("only loads a restore that asked not to run", async () => {
+        const record = vi.spyOn(queryHistory, "record").mockResolvedValue({ data: {} } as never);
+        await mountPage();
+        record.mockClear();
+        expect(await landWith(false)).toBe(0);
+        await flushPromises();
+        expect(record).not.toHaveBeenCalled();
+        record.mockRestore();
+      });
+    });
+
     describe("J/K page crossing signals (4a §3.4)", () => {
       const navigation = () => mockSearchObj.meta.resultGrid.navigation;
       const pend = () => {
diff --git a/web/src/plugins/traces/Index.vue b/web/src/plugins/traces/Index.vue
index f7e7105c56..64b2c20387 100644
--- a/web/src/plugins/traces/Index.vue
+++ b/web/src/plugins/traces/Index.vue
@@ -68,7 +68,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :isLoading="searchObj.loading"
               :activeTab="activeTab"
               class="bg-card-glass-bg"
-              @searchdata="searchData"
+              @searchdata="searchData()"
               @onChangeTimezone="refreshTimezone"
               @update:activeTab="activeTab = $event"
               @error-only-toggled="onErrorOnlyToggled"
@@ -76,6 +76,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               @cancel-query="cancelSearch"
               @update:searchMode="onSearchModeChange"
               @apply-saved-view="onApplySavedView"
+              @recent-restore="onRecentRestore"
               @service-graph-refresh="serviceGraphRef?.refresh()"
               @services-catalog-refresh="servicesCatalogRef?.loadServicesCatalog()"
               @drill-down="searchResultRef?.openComparison()"
@@ -228,7 +229,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         @shareLink="(range: any) => copyTracesUrl(t, range)"
                         @metrics:editor-filter-set="onMetricsEditorFilterSet"
                         @metrics:editor-filter-run="onMetricsEditorFilterRun"
-                        @run-query="searchData"
+                        @run-query="searchData()"
                         @remove-filter="onRemoveTracesFilter"
                         @jump-to-stream-data="onJumpToTracesStreamData"
                         @error-only-toggled="onErrorOnlyToggled"
@@ -359,6 +360,15 @@ import { toast } from "@/lib/feedback/Toast/useToast";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { recordPageLoad, recordPageRequest, type PageLoadReason } from "@/utils/pageCrossing";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { useRecentSearches } from "@/composables/queryHistory/useRecentSearches";
+import {
+  runResultFromError,
+  toRunError,
+  type RestoreTime,
+} from "@/utils/queryHistory/recentSearches";
+import { buildTracesRecord, tracesRestore } from "@/utils/queryHistory/traces";
+import { openRecentOnItsPage, takeRecentLanding } from "@/utils/queryHistory/routes";
+import type { HistoryTime, QueryHistoryEntry } from "@/services/query_history";
 
 interface TracesSavedView {
   version?: number;
@@ -381,6 +391,7 @@ const supportedTraceSearchMode = (value: unknown): TraceSearchMode =>
   resolveTraceSearchMode(value, config.isEnterprise === "true");
 
 const store = useStore();
+const { record: recordRecent } = useRecentSearches();
 const activeTab = computed(() => {
   if (searchObj.meta.searchMode === "service-graph") return "service-graph";
   if (searchObj.meta.searchMode === "services-catalog") return "services-catalog";
@@ -835,7 +846,11 @@ const dropStaleSelection = () => {
   if (dropped) searchResultRef.value?.metricsDashboardRef?.clearOriginalTimeRange();
 };
 
-async function getQueryData(isPagination: boolean = false, isSort: boolean = false) {
+async function getQueryData(
+  isPagination: boolean = false,
+  isSort: boolean = false,
+  recordRun: boolean = false,
+) {
   let boundTraceId: string | null = null;
   try {
     if (searchObj.data.stream.selectedStream.value == "") {
@@ -888,9 +903,11 @@ async function getQueryData(isPagination: boolean = false, isSort: boolean = fal
     // A search or sort reads the editor and the resolved window; a page fetch keeps page 1's, so its selection still holds.
     if (!isPagination) {
       submittedFilter = buildEditorFilter();
+      searchObj.data.appliedEditorValue = String(searchObj.data.editorValue ?? "");
       dropStaleSelection();
     }
     const combinedFilter = submittedFilter;
+    const historyRun = recordRun && !isPagination ? tracesHistoryRun(queryReq) : null;
 
     if (!isPagination && !isSort) searchResultRef?.value?.getDashboardData();
 
@@ -1054,6 +1071,12 @@ async function getQueryData(isPagination: boolean = false, isSort: boolean = fal
 
           const errData = err?.content || err;
           const { message, trace_id, code, error_detail } = errData ?? {};
+          if (historyRun) {
+            const result = runResultFromError(
+              toRunError({ code, status: errData?.status, message }),
+            );
+            if (result) recordRecent(buildTracesRecord({ ...historyRun, result }));
+          }
 
           let errorMsg = message || err?.message || t("traces.index.errorProcessingRequest");
           if (code) {
@@ -1088,6 +1111,9 @@ async function getQueryData(isPagination: boolean = false, isSort: boolean = fal
           delete tracesRequestState[searchTraceId];
         },
         complete: (_payload: any) => {
+          if (historyRun && tracesRequestState[searchTraceId]) {
+            recordRecent(buildTracesRecord({ ...historyRun, result: { status: "ok" } }));
+          }
           searchObj.loading = false;
           currentSearchTraceId = null;
           // An exhausted page must not leave the previous page under the new page number.
@@ -1378,6 +1404,8 @@ const isAutoRunOff = () => !!store.state.zoConfig?.auto_query_enabled && !search
 
 async function loadPageData() {
   const streamFromUrl = typeof router.currentRoute.value.query.stream === "string";
+  // Claimed before any early return, so a restore that finds no stream is not left for a later landing.
+  const landing = takeRecentLanding("traces");
   searchObj.loadingStream = true;
   if (!searchObj.data?.queryResults?.hits?.length) searchObj.data.resultGrid.currentPage = 0;
 
@@ -1388,9 +1416,13 @@ async function loadPageData() {
 
   //get stream list
   await getStreamList();
-  if (searchObj.data.stream.selectedStream.value && (streamFromUrl || !isAutoRunOff())) {
-    searchData();
+  if (!searchObj.data.stream.selectedStream.value) return;
+  // Only a restore from recent searches is a user run; any other landing runs without recording.
+  if (landing) {
+    if (landing.run) searchData();
+    return;
   }
+  if (streamFromUrl || !isAutoRunOff()) searchData(false);
 }
 
 onBeforeMount(async () => {
@@ -1448,17 +1480,34 @@ onActivated(async () => {
     if (applyHandoffFilter()) {
       await loadPageData();
       await nextTick();
-      runQueryFn();
+      runQueryFn(false);
     }
   }
 });
 
-const runQueryFn = () => {
+/** Runs the search; `record` is false for runs no user asked for, such as a page landing. */
+const runQueryFn = (record = true) => {
   searchObj.data.resultGrid.currentPage = 0;
   searchObj.runQuery = false;
-  getQueryData();
+  getQueryData(false, false, record);
 };
 
+/** What a run records once it settles, captured when it is dispatched. */
+function tracesHistoryRun(queryReq: { query: { start_time: number; end_time: number } }) {
+  const datetime = searchObj.data.datetime;
+  return {
+    stream: String(selectedStreamName.value ?? ""),
+    searchMode: String(searchObj.meta.searchMode),
+    query: String(searchObj.data.editorValue ?? ""),
+    time: {
+      type: datetime.type === "absolute" ? "absolute" : "relative",
+      ...(datetime.type === "absolute" ? {} : { period: String(datetime.relativeTimePeriod) }),
+      start_time: Number(queryReq.query.start_time),
+      end_time: Number(queryReq.query.end_time),
+    } as HistoryTime,
+  };
+}
+
 const runQueryOnSort = () => {
   searchObj.data.resultGrid.currentPage = 0;
   searchObj.runQuery = false;
@@ -1927,14 +1976,14 @@ const showErrorOnly = computed(
   () => activeIncludeFilterValues.value["span_status"]?.includes("ERROR") ?? false,
 );
 
-const searchData = () => {
+const searchData = (record = true) => {
   if (!(searchObj.data.stream.streamLists.length && searchObj.data.stream.selectedStream?.label)) {
     return;
   }
 
   if (activeTab.value === "service-graph" || activeTab.value === "services-catalog") return;
 
-  runQueryFn();
+  runQueryFn(record);
 
   analytics.track("traces_search_run", {
     stream_name: searchObj.data.stream.selectedStream.value,
@@ -1975,11 +2024,16 @@ const syncSavedViewDateTime = async (datetime: TracesSavedView["datetime"]) => {
 
 let savedViewApplySeq = 0;
 const onApplySavedView = async (view: TracesSavedView) => {
-  const seq = ++savedViewApplySeq;
   if (view.version !== undefined && view.version !== 1) {
     toast({ variant: "error", message: t("search.errorWhileApplyingSavedView") });
     return;
   }
+  await applyTracesView(view, true);
+};
+
+/** Applies a stream, filter, window and mode in place, then runs unless only loading. */
+const applyTracesView = async (view: TracesSavedView, run: boolean) => {
+  const seq = ++savedViewApplySeq;
   const streamName = view.stream?.value;
   const streamChanged = streamName !== searchObj.data.stream.selectedStream.value;
   if (
@@ -2023,7 +2077,35 @@ const onApplySavedView = async (view: TracesSavedView) => {
   if (view.editorValue && searchObj.data.stream.selectedStreamFields.length) {
     restoreFilters(view.editorValue);
   }
-  runQueryFn();
+  if (run) runQueryFn();
+};
+
+const onRecentRestore = (entry: QueryHistoryEntry, when: RestoreTime, run: boolean) => {
+  if (entry.source !== "traces") {
+    void openRecentOnItsPage(router, entry, when, store.state.selectedOrganization.identifier, run);
+    return;
+  }
+  const restore = tracesRestore(entry, when);
+  const current = searchObj.data.datetime;
+  const window = restore.window;
+  void applyTracesView(
+    {
+      stream: { label: restore.stream, value: restore.stream },
+      editorValue: restore.query,
+      datetime: {
+        type: window?.type ?? current.type,
+        relativeTimePeriod:
+          window?.type === "relative" ? window.period : current.relativeTimePeriod,
+        startTime: window?.type === "absolute" ? window.startUs : current.startTime,
+        endTime: window?.type === "absolute" ? window.endUs : current.endTime,
+      },
+      searchMode: restore.searchMode === "spans" ? "spans" : "traces",
+      sortBy: searchObj.meta.resultGrid.sortBy,
+      sortOrder: searchObj.meta.resultGrid.sortOrder,
+      selectedFields: [...(searchObj.data.stream.selectedFields ?? [])],
+    },
+    run,
+  );
 };
 
 const streamChangeDialog = ref({ show: false, pendingStream: "" });
diff --git a/web/src/plugins/traces/SearchBar.spec.ts b/web/src/plugins/traces/SearchBar.spec.ts
index 291ade5d00..0b04849dd6 100644
--- a/web/src/plugins/traces/SearchBar.spec.ts
+++ b/web/src/plugins/traces/SearchBar.spec.ts
@@ -305,6 +305,7 @@ import SearchBar from "@/plugins/traces/SearchBar.vue";
 import analytics from "@/services/product_analytics";
 import SavedViewsListDialog from "@/components/savedViews/SavedViewsListDialog.vue";
 import { useToolbarPins } from "@/composables/useToolbarPins";
+import { placeCaret } from "@/test/unit/helpers/monacoCaret";
 
 // ---------------------------------------------------------------------------
 // DOM anchor node required by attachTo
@@ -339,7 +340,12 @@ const sharedStubs = {
     },
   },
   CodeQueryEditor: {
-    template: '<div data-test="code-query-editor-stub" />',
+    // Monaco's caret element: the recent-searches dropdown opens at it.
+    template:
+      '<div data-test="code-query-editor-stub"><div class="monaco-editor"><div class="cursors-layer"><div class="cursor" /></div></div></div>',
+    mounted(this: { $el: Element }) {
+      placeCaret(this.$el.querySelector(".cursor"));
+    },
     props: [
       "editorId",
       "query",
@@ -351,12 +357,14 @@ const sharedStubs = {
       "debounceTime",
       "fieldValueResolver",
     ],
-    emits: ["update:query", "run-query", "focus", "blur"],
-    setup() {
+    emits: ["update:query", "run-query", "focus", "blur", "user-edit"],
+    setup(_: unknown, { emit }: { emit: (event: "focus") => void }) {
       return {
         setValue: vi.fn(),
         getCursorIndex: vi.fn().mockReturnValue(0),
         triggerAutoComplete: vi.fn(),
+        // Monaco fires its focus event inside focus(), in the same tick.
+        focus: () => emit("focus"),
       };
     },
   },
@@ -2431,4 +2439,111 @@ describe("SearchBar", () => {
       expect(searchObjInstance.data.parsedQuery).toEqual(previous);
     });
   });
+
+  describe("recent-searches dropdown and the editor placeholder", () => {
+    it("hides the typing placeholder while the dropdown is open, so only one list changes", async () => {
+      wrapper = mountSearchBar();
+      await flushPromises();
+      searchObjInstance.data.editorValue = "";
+      searchObjInstance.meta.queryEditorPlaceholderFlag = true;
+      const vm = wrapper.vm as unknown as { recentFocusOpen: boolean };
+      vm.recentFocusOpen = false;
+      await flushPromises();
+      expect(wrapper.find(".query-editor-placeholder-overlay").exists()).toBe(true);
+
+      vm.recentFocusOpen = true;
+      await flushPromises();
+      expect(wrapper.find(".query-editor-placeholder-overlay").exists()).toBe(false);
+
+      vm.recentFocusOpen = false;
+      await flushPromises();
+      expect(wrapper.find(".query-editor-placeholder-overlay").exists()).toBe(true);
+    });
+  });
+
+  describe("the Run button once the editor differs from the searched query", () => {
+    const runButton = () => wrapper.find('[data-test="logs-search-bar-refresh-btn"]');
+
+    it("shows the pending state for a typed edit or a loaded recent search, and clears it when they match again", async () => {
+      wrapper = mountSearchBar();
+      await flushPromises();
+      searchObjInstance.data.appliedEditorValue = "service_name='a'";
+      searchObjInstance.data.editorValue = "service_name='a'";
+      await flushPromises();
+      expect(runButton().attributes("data-run-pending")).toBeUndefined();
+
+      searchObjInstance.data.editorValue = "service_name='b'";
+      await flushPromises();
+      expect(runButton().attributes("data-run-pending")).toBe("true");
+      expect(runButton().attributes("aria-label")).toBe("search.runQueryPendingLabel");
+
+      searchObjInstance.data.editorValue = "service_name='a' ";
+      await flushPromises();
+      expect(runButton().attributes("data-run-pending")).toBeUndefined();
+    });
+
+    it("shows no pending state before the first search", async () => {
+      wrapper = mountSearchBar();
+      await flushPromises();
+      searchObjInstance.data.appliedEditorValue = null;
+      searchObjInstance.data.editorValue = "service_name='b'";
+      await flushPromises();
+      expect(runButton().attributes("data-run-pending")).toBeUndefined();
+    });
+  });
+
+  describe("recent-searches dropdown on an edit that empties the editor", () => {
+    it("opens without a refocus when the text is cleared and closes on the next character", async () => {
+      store.state.zoConfig.query_history_enabled = true;
+      wrapper = mountSearchBar();
+      await flushPromises();
+      searchObjInstance.data.editorValue = "service_name='api'";
+      const vm = wrapper.vm as unknown as { recentFocusOpen: boolean };
+      const editor = wrapper.findComponent('[data-test="code-query-editor-stub"]');
+      editor.vm.$emit("focus");
+      await flushPromises();
+      expect(vm.recentFocusOpen).toBe(false);
+
+      editor.vm.$emit("user-edit", true, false);
+      await flushPromises();
+      expect(vm.recentFocusOpen).toBe(true);
+
+      editor.vm.$emit("user-edit", false, true);
+      await flushPromises();
+      expect(vm.recentFocusOpen).toBe(false);
+
+      searchObjInstance.data.editorValue = "";
+      editor.vm.$emit("focus");
+      await flushPromises();
+      expect(vm.recentFocusOpen).toBe(true);
+      vm.recentFocusOpen = false;
+      editor.vm.$emit("user-edit", true, false);
+      await flushPromises();
+      expect(vm.recentFocusOpen).toBe(true);
+      delete store.state.zoConfig.query_history_enabled;
+    });
+
+    it("stays closed when Escape in the list hands focus back to the editor, until the next real focus", async () => {
+      store.state.zoConfig.query_history_enabled = true;
+      wrapper = mountSearchBar();
+      await flushPromises();
+      searchObjInstance.data.editorValue = "";
+      const vm = wrapper.vm as unknown as { recentFocusOpen: boolean };
+      const editor = wrapper.findComponent('[data-test="code-query-editor-stub"]');
+      editor.vm.$emit("focus");
+      await flushPromises();
+      expect(vm.recentFocusOpen).toBe(true);
+
+      const dropdown = wrapper.findComponent({ name: "RecentSearchesFocusDropdown" });
+      dropdown.vm.$emit("update:open", false);
+      dropdown.vm.$emit("dismiss");
+      await flushPromises();
+      expect(vm.recentFocusOpen).toBe(false);
+
+      editor.vm.$emit("focus");
+      await flushPromises();
+      expect(vm.recentFocusOpen).toBe(true);
+      delete store.state.zoConfig.query_history_enabled;
+    });
+  });
 });
diff --git a/web/src/plugins/traces/SearchBar.vue b/web/src/plugins/traces/SearchBar.vue
index 1b63f83351..7c09852a96 100644
--- a/web/src/plugins/traces/SearchBar.vue
+++ b/web/src/plugins/traces/SearchBar.vue
@@ -321,6 +321,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             @on:date-change="updateDateTime"
             @on:timezone-change="updateTimezone"
           />
+          <RecentSearchesButton
+            source="traces"
+            :examples="recentExamples"
+            data-test="traces-search-bar-recent-searches-btn"
+            @run="(entry, when) => emit('recent-restore', entry, when, true)"
+            @load="(entry, when) => emit('recent-restore', entry, when, false)"
+            @view-all="openRecentSearches"
+            @example="applyRecentExample"
+          />
           <div>
             <div class="flex items-center">
               <OButton
@@ -334,23 +343,33 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               >
               <OButton
                 v-else
-                variant="ghost"
+                :variant="showRunQueryPending ? 'pending' : 'ghost'"
                 data-test="logs-search-bar-refresh-btn"
                 data-cy="search-bar-refresh-button"
+                :data-run-pending="showRunQueryPending ? 'true' : undefined"
+                :aria-label="showRunQueryPending ? t('search.runQueryPendingLabel') : undefined"
                 :title="t('search.runQuery')"
-                class="bg-button-primary! text-button-primary-foreground! hover:ring-button-primary/70 h-[1.875rem]! w-[5.875rem]! p-0 px-1! py-0! text-center text-xs! leading-4! font-medium! break-words whitespace-normal [transition:box-shadow_0.3s_ease,_opacity_0.2s_ease] hover:opacity-90 hover:ring-2"
-                :class="
+                class="h-[1.875rem]! w-[5.875rem]! p-0 px-1! py-0! text-center text-xs! leading-4! font-medium! break-words whitespace-normal [transition:box-shadow_0.3s_ease,_opacity_0.2s_ease]"
+                :class="[
                   store.state.zoConfig.auto_query_enabled
                     ? '![border-radius:0.375rem_0_0_0.375rem]'
-                    : 'rounded-default'
-                "
+                    : 'rounded-default',
+                  showRunQueryPending
+                    ? ''
+                    : 'bg-button-primary! text-button-primary-foreground! hover:ring-button-primary/70 hover:opacity-90 hover:ring-2',
+                ]"
                 @click="searchData"
                 :loading="isLoading"
                 :disabled="isLoading"
               >
                 <OTooltip
-                  v-if="searchObj.meta.liveMode && store.state.zoConfig.auto_query_enabled"
-                  :content="t('search.autoRunEnabled')"
+                  v-if="
+                    (searchObj.meta.liveMode && store.state.zoConfig.auto_query_enabled) ||
+                    showRunQueryPending
+                  "
+                  :content="
+                    showRunQueryPending ? t('search.autoRunPendingDot') : t('search.autoRunEnabled')
+                  "
                 />
                 <OIcon
                   v-if="searchObj.meta.liveMode && store.state.zoConfig.auto_query_enabled"
@@ -509,7 +528,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       "
       class="border-border-default flex min-h-0 flex-1 border-b"
     >
-      <div class="relative flex h-full w-full flex-col overflow-hidden">
+      <div
+        ref="queryEditorBoxRef"
+        class="relative flex h-full w-full flex-col overflow-hidden"
+        @keydown.capture="onRecentEditorKeydown"
+      >
         <CodeQueryEditor
           ref="queryEditorRef"
           editor-id="traces-query-editor"
@@ -517,22 +540,45 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :keywords="effectiveKeywords"
           :suggestions="effectiveSuggestions"
           :field-value-resolver="resolveFieldValues"
+          :recent-queries="recentQueries"
           :debounce-time="100"
           :filter-mode="!searchObj.meta.sqlMode"
           language="sql"
           @update:query="updateQueryValue"
+          @user-edit="onRecentEditorEdit"
           @run-query="searchData"
           @focus="onQueryEditorFocus"
           @blur="onQueryEditorBlur"
         />
+        <RecentSearchesFocusDropdown
+          ref="recentFocusRef"
+          v-model:open="recentFocusOpen"
+          source="traces"
+          :anchor="queryEditorBoxRef"
+          :examples="recentExamples"
+          @run="(entry, when) => emit('recent-restore', entry, when, true)"
+          @load="(entry, when) => emit('recent-restore', entry, when, false)"
+          @view-all="openRecentSearches"
+          @example="applyRecentExample"
+          @dismiss="dismissRecentFocus"
+        />
         <div
-          v-if="searchObj.data.editorValue == '' && searchObj.meta.queryEditorPlaceholderFlag"
+          v-if="
+            searchObj.data.editorValue === '' &&
+            searchObj.meta.queryEditorPlaceholderFlag &&
+            !recentFocusOpen
+          "
           class="query-editor-placeholder-overlay pointer-events-none absolute top-0 right-0 bottom-0 left-0 z-1 flex items-start [padding:0.1875rem_0.5rem_0_2.15rem] select-none"
         >
           <span class="query-editor-placeholder-typewriter">{{ traceEditorPlaceholder }}</span>
         </div>
       </div>
     </div>
+    <RecentSearchesDrawer
+      ref="recentDrawerRef"
+      source="traces"
+      @restore="(entry, when, run) => emit('recent-restore', entry, when, run)"
+    />
     <ODialog
       v-model:open="saveViewDialogOpen"
       size="xs"
@@ -630,6 +676,20 @@ import { useMutation, useQuery } from "@tanstack/vue-query";
 import { useOrgId } from "@/composables/query/useOrgId";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
 import savedViewsService from "@/services/saved_views";
+import RecentSearchesButton from "@/components/queryHistory/RecentSearchesButton.vue";
+import RecentSearchesDrawer from "@/components/queryHistory/RecentSearchesDrawer.vue";
+import RecentSearchesFocusDropdown from "@/components/queryHistory/RecentSearchesFocusDropdown.vue";
+import {
+  useRecentSearches,
+  useRecentSearchesList,
+} from "@/composables/queryHistory/useRecentSearches";
+import {
+  recentQueryList,
+  recentsOpenAfterEdit,
+  routeEditorKeyToRecents,
+} from "@/utils/queryHistory/recentSearches";
+import { TRACES_EXAMPLE_QUERIES } from "@/utils/queryHistory/traces";
+import type { HistoryStatus } from "@/services/query_history";
 import {
   savedViewsQuery,
   createSavedViewMutation,
@@ -661,6 +721,9 @@ export default defineComponent({
     SyntaxGuide,
     TracesSavedViewsMenuItems,
     SavedViewsListDialog,
+    RecentSearchesButton,
+    RecentSearchesDrawer,
+    RecentSearchesFocusDropdown,
   },
   emits: [
     "searchdata",
@@ -673,6 +736,7 @@ export default defineComponent({
     "services-catalog-refresh",
     "apply-saved-view",
     "drill-down",
+    "recent-restore",
   ],
   props: {
     fieldValues: {
@@ -718,9 +782,72 @@ export default defineComponent({
       externalErrors: toRef(searchObj.data, "sqlSyntaxErrorRanges"),
     });
 
+    const queryEditorBoxRef = ref<HTMLElement | null>(null);
+    const recentFocusRef = ref<InstanceType<typeof RecentSearchesFocusDropdown> | null>(null);
+    const recentDrawerRef = ref<InstanceType<typeof RecentSearchesDrawer> | null>(null);
+    const recentFocusOpen = ref(false);
+    // A typed edit and a recent search loaded without running both leave the shown results stale until the next run.
+    const showRunQueryPending = computed(() => {
+      const applied: unknown = searchObj.data.appliedEditorValue;
+      if (typeof applied !== "string") return false;
+      return String(searchObj.data.editorValue ?? "").trim() !== applied.trim();
+    });
+    const recentListActive = ref(false);
+    const { enabled: recentSearchesEnabled } = useRecentSearches();
+    const recentList = useRecentSearchesList("traces", recentListActive);
+    const recentQueries = computed(() =>
+      recentSearchesEnabled.value ? recentQueryList(recentList.data.value ?? []) : [],
+    );
+    const recentExamples = computed(() =>
+      searchObj.data.stream.selectedStream?.value ? TRACES_EXAMPLE_QUERIES : [],
+    );
+
+    // Escape in the list hands focus back to the editor, and that focus must not reopen the list.
+    let recentFocusDismissed = false;
+    const dismissRecentFocus = () => {
+      recentFocusDismissed = true;
+      focusEditor();
+    };
+
+    const onRecentEditorEdit = (isBlank = false, wasBlank = false) => {
+      recentFocusDismissed = false;
+      recentFocusOpen.value = recentsOpenAfterEdit(
+        recentFocusOpen.value,
+        wasBlank,
+        recentSearchesEnabled.value && isBlank,
+      );
+    };
+
     const onQueryEditorFocus = () => {
       searchObj.meta.queryEditorPlaceholderFlag = false;
       _sqlOnFocus();
+      if (recentFocusDismissed) {
+        recentFocusDismissed = false;
+        return;
+      }
+      if (!recentSearchesEnabled.value) return;
+      recentListActive.value = true;
+      if (!String(searchObj.data.editorValue ?? "").trim()) recentFocusOpen.value = true;
+    };
+
+    const focusEditor = () => queryEditorRef.value?.focus?.();
+
+    // Capture phase: the editor's Escape binding stops the event, and that binding must still run.
+    const onRecentEditorKeydown = (e: KeyboardEvent) => {
+      if (!recentFocusOpen.value) return;
+      routeEditorKeyToRecents(e, recentFocusRef.value, () => (recentFocusOpen.value = false));
+    };
+
+    const openRecentSearches = (status: HistoryStatus | null = null) => {
+      if (!recentSearchesEnabled.value) return false;
+      recentDrawerRef.value?.show(status);
+      return true;
+    };
+
+    const applyRecentExample = (query: string) => {
+      searchObj.data.editorValue = query;
+      setEditorValue(query);
+      focusEditor();
     };
     const onQueryEditorBlur = async () => {
       searchObj.meta.queryEditorPlaceholderFlag = true;
@@ -1335,6 +1462,20 @@ export default defineComponent({
       queryEditorRef,
       onQueryEditorFocus,
       onQueryEditorBlur,
+      queryEditorBoxRef,
+      recentFocusRef,
+      recentDrawerRef,
+      recentFocusOpen,
+      showRunQueryPending,
+      recentQueries,
+      recentExamples,
+      onRecentEditorEdit,
+      dismissRecentFocus,
+      onRecentEditorKeydown,
+      openRecentSearches,
+      applyRecentExample,
+      focusEditor,
+      emit,
       updateQueryValue,
       updateDateTime,
       downloadLogs,
diff --git a/web/src/services/alerts.ts b/web/src/services/alerts.ts
index 55a7c57673..41c48ac9c5 100644
--- a/web/src/services/alerts.ts
+++ b/web/src/services/alerts.ts
@@ -309,18 +309,6 @@ const alerts = {
     if (query.sort_order) params.append("sort_order", query.sort_order);
     return http().get(`/api/v2/${org_identifier}/alerts/history?${params}`);
   },
-  getOrganizationDeduplicationConfig: (org_identifier: string) => {
-    return http().get(`/api/${org_identifier}/alerts/deduplication/config`);
-  },
-  setOrganizationDeduplicationConfig: (org_identifier: string, data: any) => {
-    return http().post(`/api/${org_identifier}/alerts/deduplication/config`, data);
-  },
-  deleteOrganizationDeduplicationConfig: (org_identifier: string) => {
-    return http().delete(`/api/${org_identifier}/alerts/deduplication/config`);
-  },
-  get_dedup_summary: (org_identifier: string) => {
-    return http().get(`/api/v2/${org_identifier}/alerts/dedup/summary`);
-  },
   // Semantic field groups management
   getSemanticGroups: (org_identifier: string) => {
     return http().get(`/api/${org_identifier}/alerts/deduplication/semantic-groups`);
diff --git a/web/src/services/organizations.queries.ts b/web/src/services/organizations.queries.ts
index 90ea4dce6a..e01720d510 100644
--- a/web/src/services/organizations.queries.ts
+++ b/web/src/services/organizations.queries.ts
@@ -14,7 +14,12 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { mutationOptions, queryOptions } from "@tanstack/vue-query";
-import organizations from "./organizations";
+import organizations, {
+  type BillingGroupMember,
+  type OrgDomainOwnership,
+  type OrgDomainRequest,
+} from "./organizations";
+import billings from "./billings";
 import { organizationKeys } from "./organizations.querykeys";
 import { MEDIUM_STALE_TIME, NORMAL_STALE_TIME } from "@/composables/query/cachePolicy";
 
@@ -79,6 +84,40 @@ export const orgPasscodeQuery = (org: string) =>
     staleTime: NORMAL_STALE_TIME,
   });
 
+export const orgDomainsQuery = (org: string) =>
+  queryOptions({
+    queryKey: organizationKeys.domains(org),
+    queryFn: async (): Promise<OrgDomainOwnership[]> =>
+      (await organizations.list_org_domains(org)).data ?? [],
+    staleTime: NORMAL_STALE_TIME,
+  });
+
+// On the meta org this lists every org's requests.
+export const orgDomainRequestsQuery = (org: string) =>
+  queryOptions({
+    queryKey: organizationKeys.domainRequests(org),
+    queryFn: async (): Promise<OrgDomainRequest[]> =>
+      (await organizations.list_org_domain_requests(org)).data ?? [],
+    staleTime: NORMAL_STALE_TIME,
+  });
+
+export const billingGroupMembersQuery = (org: string) =>
+  queryOptions({
+    queryKey: organizationKeys.billingGroupMembers(org),
+    queryFn: async (): Promise<BillingGroupMember[]> =>
+      (await billings.list_billing_group_members(org)).data ?? [],
+    staleTime: NORMAL_STALE_TIME,
+  });
+
+/** Every org, readable from the meta org only. */
+export const adminOrgsQuery = (org: string) =>
+  queryOptions({
+    queryKey: organizationKeys.adminOrgs(org),
+    queryFn: async (): Promise<{ identifier: string; name: string }[]> =>
+      (await organizations.get_admin_org(org)).data?.data ?? [],
+    staleTime: MEDIUM_STALE_TIME,
+  });
+
 // ── Writes ──────────────────────────────────────────────────────────────────
 
 export const createIngestionTokenMutation = (org: string) =>
@@ -114,5 +153,45 @@ export const updateOrgSettingsMutation = (org: string) =>
     // Not the selected org: domain management writes the meta org.
     mutationFn: (payload: any) => organizations.post_organization_settings(org, payload),
     // Every call site renders its own success and failure toasts.
-    meta: { invalidates: [organizationKeys.settings(org)], silentError: true },
+    meta: {
+      invalidates: [organizationKeys.settings(org)],
+      awaitInvalidation: true,
+      silentError: true,
+    },
+  });
+
+export const linkOrgDomainMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (domain: string) => organizations.link_org_domain(org, domain),
+    meta: { invalidates: [organizationKeys.domains(org)], silentError: true },
+  });
+
+export const unlinkOrgDomainMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (domain: string) => organizations.unlink_org_domain(org, domain),
+    meta: { invalidates: [organizationKeys.domains(org)], silentError: true },
+  });
+
+export const verifyOrgDomainMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (domain: string) => organizations.verify_org_domain(org, domain),
+    meta: { invalidates: [organizationKeys.domains(org)], silentError: true },
+  });
+
+export const raiseOrgDomainRequestMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (domain: string) => organizations.raise_org_domain_request(org, domain),
+    meta: { invalidates: [organizationKeys.domainRequests(org)], silentError: true },
+  });
+
+export const decideOrgDomainRequestMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (vars: { id: string; approve: boolean; reason: string }) =>
+      vars.approve
+        ? organizations.approve_org_domain_request(org, vars.id, vars.reason)
+        : organizations.reject_org_domain_request(org, vars.id, vars.reason),
+    meta: {
+      invalidates: [organizationKeys.domainRequests(org), organizationKeys.domains(org)],
+      silentError: true,
+    },
   });
diff --git a/web/src/services/organizations.querykeys.ts b/web/src/services/organizations.querykeys.ts
index 451ee72531..a21caebf36 100644
--- a/web/src/services/organizations.querykeys.ts
+++ b/web/src/services/organizations.querykeys.ts
@@ -30,5 +30,9 @@ export const organizationKeys = {
     orgKey(org, "organizations", "cleanupTasks", targetOrg),
   ingestionTokens: (org: string) => orgKey(org, "organizations", "ingestionTokens"),
   passcode: (org: string) => orgKey(org, "organizations", "passcode"),
+  domains: (org: string) => orgKey(org, "organizations", "domains"),
+  domainRequests: (org: string) => orgKey(org, "organizations", "domainRequests"),
+  billingGroupMembers: (org: string) => orgKey(org, "organizations", "billingGroupMembers"),
+  adminOrgs: (org: string) => orgKey(org, "organizations", "adminOrgs"),
   mine: () => globalKey("organizations", "mine"),
 };
diff --git a/web/src/services/organizations.ts b/web/src/services/organizations.ts
index 0eed37897a..30a20a036f 100644
--- a/web/src/services/organizations.ts
+++ b/web/src/services/organizations.ts
@@ -16,6 +16,48 @@
 import http from "./http";
 import analytics from "./product_analytics";
 
+// verification_state: 0 pending, 1 verified, 2 failed; failure reason: 0 record missing, 1 value mismatch, 2 DNS failure.
+export interface OrgDomainOwnership {
+  id: string;
+  org_id: string;
+  domain: string;
+  verification_token: string;
+  verification_state: 0 | 1 | 2;
+  verification_failure_reason: 0 | 1 | 2 | null;
+  verified_at: number | null;
+  last_checked_at: number | null;
+  created_at: number;
+  updated_at: number;
+  /** Linked by an approved link request instead of a DNS record, so it is never re-verified. */
+  meta_mapped: boolean;
+}
+
+// status: 0 pending, 1 approved, 2 rejected.
+export interface OrgDomainRequest {
+  id: string;
+  org_id: string;
+  domain: string;
+  created_at: number;
+  updated_at: number;
+  requested_by: string;
+  answered_by: string | null;
+  status: 0 | 1 | 2;
+  reason: string | null;
+}
+
+export interface OrgDomainMapping {
+  domain: string;
+  org_id: string;
+  base_role: string;
+  role_claim_name?: string | null;
+  create_missing_roles: boolean;
+}
+
+export interface BillingGroupMember {
+  member_org_id: string;
+  member_org_name: string;
+}
+
 const organizations = {
   os_list: (
     page_num: number,
@@ -90,6 +132,39 @@ const organizations = {
   post_organization_settings: (orgIdentifier: string, data: any) => {
     return http().post(`/api/${orgIdentifier}/settings`, data);
   },
+  list_org_domains: (orgIdentifier: string) => {
+    return http().get(`/api/${orgIdentifier}/settings/domains`);
+  },
+  link_org_domain: (orgIdentifier: string, domain: string) => {
+    return http().post(`/api/${orgIdentifier}/settings/domains`, { domain });
+  },
+  unlink_org_domain: (orgIdentifier: string, domain: string) => {
+    return http().delete(`/api/${orgIdentifier}/settings/domains/${encodeURIComponent(domain)}`);
+  },
+  verify_org_domain: (orgIdentifier: string, domain: string) => {
+    return http().post(
+      `/api/${orgIdentifier}/settings/domains/verify/${encodeURIComponent(domain)}`,
+      {},
+    );
+  },
+  list_org_domain_requests: (orgIdentifier: string) => {
+    return http().get(`/api/${orgIdentifier}/settings/domains/requests`);
+  },
+  raise_org_domain_request: (orgIdentifier: string, domain: string) => {
+    return http().post(`/api/${orgIdentifier}/settings/domains/requests`, { domain });
+  },
+  approve_org_domain_request: (orgIdentifier: string, id: string, reason: string) => {
+    return http().post(
+      `/api/${orgIdentifier}/settings/domain/request/${encodeURIComponent(id)}/approve`,
+      { reason },
+    );
+  },
+  reject_org_domain_request: (orgIdentifier: string, id: string, reason: string) => {
+    return http().post(
+      `/api/${orgIdentifier}/settings/domain/request/${encodeURIComponent(id)}/reject`,
+      { reason },
+    );
+  },
   get_admin_org: (orgIdentifier: string) => {
     return http().get(`/api/${orgIdentifier}/organizations?page_size=1000000`);
   },
diff --git a/web/src/services/query_history.queries.ts b/web/src/services/query_history.queries.ts
index e90753583e..575c42954e 100644
--- a/web/src/services/query_history.queries.ts
+++ b/web/src/services/query_history.queries.ts
@@ -13,24 +13,35 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { infiniteQueryOptions, mutationOptions } from "@tanstack/vue-query";
-import queryHistory, { type QueryHistoryEntry } from "./query_history";
+import { infiniteQueryOptions, mutationOptions, queryOptions } from "@tanstack/vue-query";
+import queryHistory, {
+  type QueryHistoryClearParams,
+  type QueryHistoryEntry,
+  type QueryHistoryListParams,
+  type QueryHistoryRecordBody,
+} from "./query_history";
 import { queryHistoryKeys } from "./query_history.querykeys";
-import { MEDIUM_STALE_TIME } from "@/composables/query/cachePolicy";
+import { LIVE_STALE_TIME, MEDIUM_STALE_TIME } from "@/composables/query/cachePolicy";
+import { queryClient } from "@/composables/query/queryClient";
+import { POPOVER_ROWS } from "@/utils/queryHistory/recentSearches";
 
 export const QUERY_HISTORY_PAGE_SIZE = 50;
+/** The quick list holds its successful rows plus the newest run, which is pinned when it failed. */
+const RECENT_SEARCHES_CACHED_ROWS = POPOVER_ROWS + 1;
 
-export const queryHistoryQuery = (org: string, starred: boolean, q: string) =>
+const rowsOf = (data: unknown): QueryHistoryEntry[] =>
+  Array.isArray(data) ? (data as QueryHistoryEntry[]) : [];
+
+export const queryHistoryQuery = (org: string, filters: QueryHistoryListParams) =>
   infiniteQueryOptions({
-    queryKey: queryHistoryKeys.list(org, starred, q),
+    queryKey: queryHistoryKeys.list(org, filters),
     queryFn: async ({ pageParam }): Promise<QueryHistoryEntry[]> => {
       const res = await queryHistory.list(org, {
-        ...(starred ? { starred: true } : {}),
-        ...(q ? { q } : {}),
+        ...filters,
         limit: QUERY_HISTORY_PAGE_SIZE,
         offset: pageParam,
       });
-      return Array.isArray(res.data) ? res.data : [];
+      return rowsOf(res.data);
     },
     initialPageParam: 0,
     // A short page is the last one.
@@ -39,12 +50,63 @@ export const queryHistoryQuery = (org: string, starred: boolean, q: string) =>
     staleTime: MEDIUM_STALE_TIME,
   });
 
+// Only the rows the list shows: each entry carries its context, up to 64 KB.
+export const recentSearchesQuery = (org: string, source: string) =>
+  queryOptions({
+    queryKey: queryHistoryKeys.recent(org, source),
+    queryFn: async (): Promise<QueryHistoryEntry[]> => {
+      const [ok, newest] = await Promise.all([
+        queryHistory.list(org, { source, status: "ok", limit: POPOVER_ROWS }),
+        queryHistory.list(org, { source, limit: 1 }),
+      ]);
+      const rows = [...rowsOf(newest.data), ...rowsOf(ok.data)];
+      return rows.filter((row, i) => rows.findIndex((r) => r.id === row.id) === i);
+    },
+    staleTime: LIVE_STALE_TIME,
+  });
+
+/** Failed runs of one page, for the quick list's "N failed" link. */
+export const recentFailedCountQuery = (org: string, source: string) =>
+  queryOptions({
+    queryKey: queryHistoryKeys.list(org, { source, status: "error", count_only: true }),
+    queryFn: async (): Promise<number> => {
+      const res = await queryHistory.count(org, { source, status: "error" });
+      return Number(res.data?.count ?? 0);
+    },
+    staleTime: LIVE_STALE_TIME,
+  });
+
+/** How many entries a clear would delete, counted by the server. */
+export const queryHistoryCountQuery = (org: string, source: string, starred: boolean) =>
+  queryOptions({
+    queryKey: queryHistoryKeys.list(org, { source, starred, count_only: true }),
+    queryFn: async (): Promise<number> => {
+      const res = await queryHistory.count(org, { source, starred });
+      return Number(res.data?.count ?? 0);
+    },
+    staleTime: 0,
+  });
+
+const isEntry = (data: unknown): data is QueryHistoryEntry =>
+  !!data && typeof data === "object" && typeof (data as QueryHistoryEntry).id === "string";
+
 // Never toasted: a failed record must not disturb the run it belongs to.
 export const recordQueryHistoryMutation = (org: string) =>
   mutationOptions({
-    mutationFn: (body: { query: string; context: Record<string, any> }) =>
-      queryHistory.record(org, body),
-    meta: { invalidates: [queryHistoryKeys.all(org)], silentError: true },
+    mutationFn: (body: QueryHistoryRecordBody) => queryHistory.record(org, body),
+    // The editor's autocomplete keeps its list loaded, so the stored run goes straight into it instead of a refetch.
+    onSuccess: (res) => {
+      const entry: unknown = res?.data;
+      if (!isEntry(entry)) return;
+      queryClient.setQueryData<QueryHistoryEntry[]>(
+        queryHistoryKeys.recent(org, entry.source),
+        (rows) =>
+          rows &&
+          [entry, ...rows.filter((r) => r.id !== entry.id)].slice(0, RECENT_SEARCHES_CACHED_ROWS),
+      );
+    },
+    // Marked stale, not refetched: a list in use refetches when it next opens, not on every run.
+    meta: { stales: [queryHistoryKeys.all(org)], silentError: true },
   });
 
 export const starQueryHistoryMutation = (org: string) =>
@@ -54,8 +116,15 @@ export const starQueryHistoryMutation = (org: string) =>
     meta: { invalidates: [queryHistoryKeys.all(org)] },
   });
 
+// The org travels with the call: an Undo-able delete commits after the user may have switched org.
 export const deleteQueryHistoryMutation = (org: string) =>
   mutationOptions({
-    mutationFn: (id: string) => queryHistory.remove(org, id),
+    mutationFn: (vars: { org: string; id: string }) => queryHistory.remove(vars.org, vars.id),
+    meta: { invalidates: [queryHistoryKeys.all(org)] },
+  });
+
+export const clearQueryHistoryMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (params: QueryHistoryClearParams) => queryHistory.clear(org, params),
     meta: { invalidates: [queryHistoryKeys.all(org)] },
   });
diff --git a/web/src/services/query_history.querykeys.ts b/web/src/services/query_history.querykeys.ts
index 49d9f8e30e..33312aeffa 100644
--- a/web/src/services/query_history.querykeys.ts
+++ b/web/src/services/query_history.querykeys.ts
@@ -14,10 +14,12 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { orgKey } from "@/composables/query/keys";
+import type { QueryHistoryListParams } from "./query_history";
 
-/** `all` is the invalidation scope; the list sits beneath it, keyed by its filters. */
+/** `all` is the invalidation scope; every list sits beneath it, keyed by its filters. */
 export const queryHistoryKeys = {
-  all: (org: string) => orgKey(org, "metrics", "queryHistory"),
-  list: (org: string, starred: boolean, q: string) =>
-    orgKey(org, "metrics", "queryHistory", "list", { starred, q }),
+  all: (org: string) => orgKey(org, "queryHistory"),
+  list: (org: string, filters: QueryHistoryListParams) =>
+    orgKey(org, "queryHistory", "list", filters),
+  recent: (org: string, source: string) => orgKey(org, "queryHistory", "recent", source),
 };
diff --git a/web/src/services/query_history.spec.ts b/web/src/services/query_history.spec.ts
index 1d332c22f3..0b24daa569 100644
--- a/web/src/services/query_history.spec.ts
+++ b/web/src/services/query_history.spec.ts
@@ -14,8 +14,11 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { describe, expect, it, beforeEach, vi } from "vitest";
-import queryHistory from "@/services/query_history";
+import queryHistory, { type QueryHistoryEntry } from "@/services/query_history";
+import { queryClient } from "@/composables/query/queryClient";
 import http from "@/services/http";
+import { recordQueryHistoryMutation } from "@/services/query_history.queries";
+import { queryHistoryKeys } from "@/services/query_history.querykeys";
 
 vi.mock("@/services/http", () => ({ default: vi.fn() }));
 
@@ -32,12 +35,17 @@ describe("query_history service", () => {
     (http as any).mockReturnValue(api);
   });
 
-  it("records an entry", async () => {
-    await queryHistory.record("o1", { query: "up", context: { chart_type: "line" } });
-    expect(api.post).toHaveBeenCalledWith("/api/o1/query_history", {
-      query: "up",
-      context: { chart_type: "line" },
-    });
+  it("records a run with its source, key, streams and status", async () => {
+    const body = {
+      source: "logs" as const,
+      query: "level = 'error'",
+      query_key: '[["k8s"],"logs","filter","level = \'error\'",""]',
+      streams: ["k8s"],
+      status: "ok" as const,
+      context: { time: { type: "relative" as const, period: "15m", start_time: 1, end_time: 2 } },
+    };
+    await queryHistory.record("o1", body);
+    expect(api.post).toHaveBeenCalledWith("/api/o1/query_history", body);
   });
 
   it("lists with only the filters that are set", async () => {
@@ -45,8 +53,74 @@ describe("query_history service", () => {
     expect(api.get).toHaveBeenCalledWith("/api/o1/query_history", {
       params: { starred: true, q: "rate" },
     });
-    await queryHistory.list("o1", {});
-    expect(api.get).toHaveBeenLastCalledWith("/api/o1/query_history", { params: {} });
+    await queryHistory.list("o1", {
+      source: "logs,traces",
+      status: "error",
+      stream: "k8s",
+      ran_from: 1,
+      ran_to: 2,
+    });
+    expect(api.get).toHaveBeenLastCalledWith("/api/o1/query_history", {
+      params: { source: "logs,traces", status: "error", stream: "k8s", ran_from: 1, ran_to: 2 },
+    });
+  });
+
+  it("marks recent searches stale after a record instead of refetching them", () => {
+    const meta = recordQueryHistoryMutation("o1").meta;
+    expect(meta?.stales).toEqual([queryHistoryKeys.all("o1")]);
+    expect(meta?.invalidates).toBeUndefined();
+  });
+
+  it("puts a recorded run first in its page's loaded recent list, without a refetch", async () => {
+    const key = queryHistoryKeys.recent("o1", "logs");
+    const old = (id: string) => ({ id, source: "logs" }) as QueryHistoryEntry;
+    queryClient.setQueryData(key, [old("a"), old("b")]);
+    const options = recordQueryHistoryMutation("o1");
+    const stored = { ...old("b"), run_count: 2 };
+    await options.onSuccess?.({ data: stored } as never, {} as never, undefined, {} as never);
+    expect(queryClient.getQueryData<QueryHistoryEntry[]>(key)?.map((r) => r.id)).toEqual([
+      "b",
+      "a",
+    ]);
+    await options.onSuccess?.({ data: "" } as never, {} as never, undefined, {} as never);
+    expect(queryClient.getQueryData<QueryHistoryEntry[]>(key)).toHaveLength(2);
+    const traces = queryHistoryKeys.recent("o1", "traces");
+    await options.onSuccess?.(
+      { data: { id: "t", source: "traces" } } as never,
+      {} as never,
+      undefined,
+      {} as never,
+    );
+    expect(queryClient.getQueryData(traces)).toBeUndefined();
+    queryClient.removeQueries({ queryKey: queryHistoryKeys.all("o1") });
+  });
+
+  it("keeps a recorded run's list to the 8 rows and the pinned run the quick list shows", async () => {
+    const key = queryHistoryKeys.recent("o1", "logs");
+    const old = (id: string) => ({ id, source: "logs" }) as QueryHistoryEntry;
+    queryClient.setQueryData(
+      key,
+      Array.from({ length: 9 }, (_, i) => old(`e${i}`)),
+    );
+    const options = recordQueryHistoryMutation("o1");
+    await options.onSuccess?.({ data: old("new") } as never, {} as never, undefined, {} as never);
+    const ids = queryClient.getQueryData<QueryHistoryEntry[]>(key)?.map((r) => r.id);
+    expect(ids).toEqual(["new", "e0", "e1", "e2", "e3", "e4", "e5", "e6", "e7"]);
+    queryClient.removeQueries({ queryKey: queryHistoryKeys.all("o1") });
+  });
+
+  it("asks the server for a count with the list filters", async () => {
+    await queryHistory.count("o1", { source: "logs", starred: false });
+    expect(api.get).toHaveBeenCalledWith("/api/o1/query_history", {
+      params: { source: "logs", starred: false, count_only: true },
+    });
+  });
+
+  it("clears the caller's history for a scope", async () => {
+    await queryHistory.clear("o1", { source: "logs", include_starred: false });
+    expect(api.delete).toHaveBeenCalledWith("/api/o1/query_history", {
+      params: { source: "logs", include_starred: false },
+    });
   });
 
   it("stars and deletes by id", async () => {
diff --git a/web/src/services/query_history.ts b/web/src/services/query_history.ts
index 1704f33278..47adf07ca5 100644
--- a/web/src/services/query_history.ts
+++ b/web/src/services/query_history.ts
@@ -14,32 +14,88 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import http from "./http";
+import type { TimeQueryParams } from "@/utils/dashboard/urlTimeParams";
+
+export type HistorySource = "logs" | "traces" | "metrics" | "dbm" | "profiles";
+export type HistoryStatus = "ok" | "error";
+
+/** The window a run used; start and end are microseconds. */
+export interface HistoryTime {
+  type: "relative" | "absolute";
+  period?: string;
+  start_time: number;
+  end_time: number;
+}
+
+/** What a page stores to restore a run; the backend never reads it. */
+export interface HistoryContext {
+  page?: Record<string, string>;
+  time?: HistoryTime;
+  error?: string;
+  warning?: string;
+  time_range?: TimeQueryParams;
+  step?: string | null;
+  chart_type?: string;
+  metrics_data?: string;
+}
 
 export interface QueryHistoryEntry {
   id: string;
+  source: HistorySource;
   query: string;
-  context: Record<string, any>;
+  query_key: string | null;
+  streams: string[];
+  context: HistoryContext;
+  status: HistoryStatus;
   starred: boolean;
-  /** Microseconds since the epoch. */
+  run_count: number;
+  /** First run, microseconds since the epoch. */
   created_at: number;
+  /** Latest run, microseconds since the epoch. */
+  updated_at: number;
+}
+
+export interface QueryHistoryRecordBody {
+  source: HistorySource;
+  query: string;
+  query_key: string;
+  streams: string[];
+  status: HistoryStatus;
+  context: HistoryContext;
 }
 
 export interface QueryHistoryListParams {
-  starred?: boolean;
+  /** One source or a comma-separated list. */
+  source?: string;
+  status?: HistoryStatus;
+  stream?: string;
   q?: string;
+  starred?: boolean;
+  ran_from?: number;
+  ran_to?: number;
   limit?: number;
   offset?: number;
+  /** Answer `{ count }` for the filters instead of the entries. */
+  count_only?: boolean;
+}
+
+export interface QueryHistoryClearParams {
+  source?: string;
+  include_starred?: boolean;
 }
 
 const base = (org: string) => `/api/${org}/query_history`;
 const entry = (org: string, id: string) => `${base(org)}/${encodeURIComponent(id)}`;
 
 const queryHistory = {
-  record: (org: string, body: { query: string; context: Record<string, any> }) =>
-    http().post(base(org), body),
+  record: (org: string, body: QueryHistoryRecordBody) => http().post(base(org), body),
   list: (org: string, params: QueryHistoryListParams) => http().get(base(org), { params }),
+  count: (org: string, params: QueryHistoryListParams) =>
+    http().get<{ count: number }>(base(org), { params: { ...params, count_only: true } }),
   star: (org: string, id: string, starred: boolean) => http().patch(entry(org, id), { starred }),
   remove: (org: string, id: string) => http().delete(entry(org, id)),
+  clear: (org: string, params: QueryHistoryClearParams) =>
+    http().delete<{ deleted: number }>(base(org), { params }),
 };
 
 export default queryHistory;
diff --git a/web/src/test/unit/helpers/monacoCaret.ts b/web/src/test/unit/helpers/monacoCaret.ts
new file mode 100644
index 0000000000..c1c1d85c78
--- /dev/null
+++ b/web/src/test/unit/helpers/monacoCaret.ts
@@ -0,0 +1,37 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+export interface CaretBox {
+  left: number;
+  top: number;
+  right: number;
+  bottom: number;
+}
+
+export const FIRST_LINE_CARET: CaretBox = { left: 113, top: 91, right: 115, bottom: 109 };
+
+/** Gives Monaco's caret element an on-screen box, since happy-dom lays nothing out and the recents dropdown opens at the caret. */
+export const placeCaret = (cursor: Element | null, box: CaretBox = FIRST_LINE_CARET) => {
+  if (!cursor) return;
+  cursor.getBoundingClientRect = () =>
+    ({
+      ...box,
+      x: box.left,
+      y: box.top,
+      width: box.right - box.left,
+      height: box.bottom - box.top,
+      toJSON: () => ({}),
+    }) as DOMRect;
+};
diff --git a/web/src/test/unit/helpers/recentLanding.ts b/web/src/test/unit/helpers/recentLanding.ts
new file mode 100644
index 0000000000..ba5af48184
--- /dev/null
+++ b/web/src/test/unit/helpers/recentLanding.ts
@@ -0,0 +1,30 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { vi } from "vitest";
+import type { RouteLocationRaw, Router } from "vue-router";
+
+/** A router whose push lands at once: it writes the pushed history state, as a real navigation does. */
+export const landingRouter = () => {
+  const push = vi.fn((to: RouteLocationRaw) => {
+    const state = typeof to === "object" && "state" in to ? to.state : undefined;
+    window.history.replaceState({ ...(state ?? {}) }, "");
+    return Promise.resolve();
+  });
+  return { router: { push } as unknown as Router, push };
+};
+
+/** Moves to a page without a restore, such as a link, a reload or a second tab's navigation. */
+export const landWithoutRestore = () => window.history.replaceState({}, "");
diff --git a/web/src/test/unit/helpers/store.ts b/web/src/test/unit/helpers/store.ts
index 69dbe0791a..a25243123c 100644
--- a/web/src/test/unit/helpers/store.ts
+++ b/web/src/test/unit/helpers/store.ts
@@ -94,6 +94,7 @@ const store = createStore({
     savedViewDialog: false,
     regionInfo: [],
     zoConfig: {
+      query_history_enabled: true,
       service_account_enabled: true,
       // Enterprise-shaped by default, which is what the synthetics specs were
       // written against. The specs that cover the OSS shape set it to false
diff --git a/web/src/ts/interfaces/alert.ts b/web/src/ts/interfaces/alert.ts
index b8cca26cad..769f1b0977 100644
--- a/web/src/ts/interfaces/alert.ts
+++ b/web/src/ts/interfaces/alert.ts
@@ -50,16 +50,13 @@ export interface Alert {
   context_attributes: { [key: string]: string };
   description: I18nText;
   uuid?: string;
-  deduplication?: {
-    enabled: boolean;
-    fingerprint_fields: string[];
-    time_window_minutes?: number;
-  };
   creates_incident?: boolean;
   /** Send one notification to the firing's destinations when the alert recovers. */
   notify_on_recovery?: boolean;
   /** Seconds the condition must stay clear before the alert recovers. 0 = immediately. */
   keep_firing_for?: number;
+  /** Notify once per state change instead of on every firing evaluation. Enterprise only. */
+  suppress_repeats?: boolean;
 }
 
 // Alert object which is modified in frontend to display in table and form
diff --git a/web/src/types/synthetics.ts b/web/src/types/synthetics.ts
index 2447150d5e..bd8fb1ddf4 100644
--- a/web/src/types/synthetics.ts
+++ b/web/src/types/synthetics.ts
@@ -652,6 +652,19 @@ export interface BrowserCheck {
   tz_offset?: number;
   start?: number; // microseconds, top-level — matches reports pattern
   browserDevices?: { browser: string; device: string }[];
+  /**
+   * Supported browser config fields the form has no control for. Loaded from the
+   * stored config and written back on edit so an unrelated edit cannot reset
+   * them to defaults. Explicit allowlist, never a spread of the stored config
+   * (which may hold secrets/headers). Absent on create: defaults apply there.
+   */
+  browserConfigExtras?: {
+    journey_budget_ms?: number;
+    test_id_attr?: string;
+    runtime?: string;
+    timeout_ms?: number;
+    video?: string;
+  };
   // Alert / retry settings (top-level in API payload)
   retries?: number;
   waitBeforeRetrySecs?: number;
diff --git a/web/src/utils/alerts/alertPayload.ts b/web/src/utils/alerts/alertPayload.ts
index 85b20bcd06..6ce58f19c6 100644
--- a/web/src/utils/alerts/alertPayload.ts
+++ b/web/src/utils/alerts/alertPayload.ts
@@ -63,6 +63,7 @@ export interface PayloadFormData {
   notify_on_recovery?: boolean;
   recovery_destinations?: string[];
   keep_firing_for?: number;
+  suppress_repeats?: boolean;
   /** Feature 2: integer storage id 1..5, or null/undefined when unset. */
   priority?: number | string | null;
   tags?: string[];
@@ -186,6 +187,8 @@ export const getAlertPayload = (formData: PayloadFormData, context: PayloadConte
     ? 0
     : parseInt(formData.keep_firing_for as any, 10) || 0;
   payload.notify_on_recovery = payload.is_real_time ? false : !!formData.notify_on_recovery;
+  // The API refuses the switch on a realtime alert, which keeps no state to compare against.
+  payload.suppress_repeats = payload.is_real_time ? false : !!formData.suppress_repeats;
   // Dropped with the switch off, or the API refuses a list nothing would use.
   payload.recovery_destinations = payload.notify_on_recovery
     ? (formData.recovery_destinations ?? [])
diff --git a/web/src/utils/alerts/alertTerraform.spec.ts b/web/src/utils/alerts/alertTerraform.spec.ts
index 4e02c86f28..4fbcadd828 100644
--- a/web/src/utils/alerts/alertTerraform.spec.ts
+++ b/web/src/utils/alerts/alertTerraform.spec.ts
@@ -146,7 +146,7 @@ describe("alertsToTerraform", () => {
     expect(hcl).not.toContain("offSet");
   });
 
-  it("renders promql and deduplication blocks", () => {
+  it("renders promql blocks and ignores a legacy deduplication field", () => {
     const { hcl } = alertsToTerraform([
       {
         ...sqlAlert,
@@ -166,8 +166,8 @@ describe("alertsToTerraform", () => {
     expect(hcl).toContain('value    = "0.9"');
     expect(hcl).toContain("promql_warning_value = 0.7");
     expect(hcl).toContain("promql_multi_alert   = true");
-    expect(hcl).toContain('fingerprint_fields  = ["instance"]');
-    expect(hcl).toContain("time_window_minutes = 30");
+    expect(hcl).not.toContain("deduplication");
+    expect(hcl).not.toContain("fingerprint_fields");
   });
 
   it("drops the trigger-side gate on an SLO alert, which the provider rejects", () => {
diff --git a/web/src/utils/alerts/alertTerraform.ts b/web/src/utils/alerts/alertTerraform.ts
index d322d406ea..bad4076077 100644
--- a/web/src/utils/alerts/alertTerraform.ts
+++ b/web/src/utils/alerts/alertTerraform.ts
@@ -38,7 +38,6 @@ import {
   attr,
   block,
   boolWhen,
-  bool,
   document,
   isFilled,
   list,
@@ -178,16 +177,6 @@ function triggerConditionBlock(source: unknown, query: Record<string, unknown>):
   ]);
 }
 
-function deduplicationBlock(source: unknown): Node[] {
-  if (!source || typeof source !== "object") return [];
-  const d = source as Record<string, unknown>;
-  return block("deduplication", [
-    ...attr("enabled", bool(d.enabled)),
-    ...attr("fingerprint_fields", list(d.fingerprint_fields)),
-    ...attr("time_window_minutes", num(d.time_window_minutes)),
-  ]);
-}
-
 /** Anomaly-detection configs and truncated payloads have no provider resource. */
 function unsupportedReason(alert: Record<string, unknown>): TerraformUnsupportedReason | null {
   if (alert.alert_type === "anomaly_detection") return "anomaly";
@@ -229,7 +218,6 @@ function alertResource(
     ...attr("workflows", list(alert.workflows)),
     ...queryConditionBlock(alert.query_condition, INDENT, dropped),
     ...triggerConditionBlock(alert.trigger_condition, query),
-    ...deduplicationBlock(alert.deduplication),
   ];
 
   return resourceBlock("openobserve_alert", label, nodes);
diff --git a/web/src/utils/alerts/prefill/fromPanel.spec.ts b/web/src/utils/alerts/prefill/fromPanel.spec.ts
index 31b8592972..dae9dd4cfe 100644
--- a/web/src/utils/alerts/prefill/fromPanel.spec.ts
+++ b/web/src/utils/alerts/prefill/fromPanel.spec.ts
@@ -783,4 +783,9 @@ describe("buildPrefillFromPanel — a formula query", () => {
     expect(p.streamName).toBe("http_requests_total");
     expect(p.streamCandidates).toBeUndefined();
   });
+
+  it("alerts on a logs panel's rows", () => {
+    const logs = buildPrefillFromPanel(sqlPanel({ panelType: "logs" }), makeId);
+    expect(logs.warnings.map((w) => w.key)).not.toContain("unsupportedPanelType");
+  });
 });
diff --git a/web/src/utils/autoName.ts b/web/src/utils/autoName.ts
index 12584731d7..208e3bac19 100644
--- a/web/src/utils/autoName.ts
+++ b/web/src/utils/autoName.ts
@@ -85,7 +85,12 @@ interface PanelAutoNameInput {
 const FIELDLESS_CHART_TYPES = ["markdown", "html", "custom_chart"];
 
 /** Chart types whose stream does not describe what they show, so no generated name beats a stream one. */
-export const NO_AUTO_NAME_TYPES: readonly string[] = ["node-graph", "alert-list", "flame-graph"];
+export const NO_AUTO_NAME_TYPES: readonly string[] = [
+  "node-graph",
+  "alert-list",
+  "flame-graph",
+  "logs",
+];
 
 /** Time bucketing is HOW a chart is drawn, not WHAT it measures. */
 const TIME_AGGREGATIONS = ["histogram", "date_bin"];
diff --git a/web/src/utils/dashboard/boxplotStats.ts b/web/src/utils/dashboard/boxplotStats.ts
new file mode 100644
index 0000000000..0c56846282
--- /dev/null
+++ b/web/src/utils/dashboard/boxplotStats.ts
@@ -0,0 +1,35 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+/** The five-number summary and sample count a box plot builder query computes per category. */
+export const BOXPLOT_STATS = [
+  { key: "low", column: "min", sql: (value: string) => `min(${value})` },
+  { key: "q1", column: "q1", sql: (value: string) => `approx_percentile_cont(${value}, 0.25)` },
+  {
+    key: "median",
+    column: "median",
+    sql: (value: string) => `approx_percentile_cont(${value}, 0.5)`,
+  },
+  { key: "q3", column: "q3", sql: (value: string) => `approx_percentile_cont(${value}, 0.75)` },
+  { key: "high", column: "max", sql: (value: string) => `max(${value})` },
+  { key: "count", column: "count", sql: (value: string) => `count(${value})` },
+] as const;
+
+export type BoxplotStatKey = (typeof BOXPLOT_STATS)[number]["key"];
+
+export const boxplotStatAlias = (alias: string, column: string) => `${alias}_${column}`;
+
+export const boxplotStatAliases = (alias: string) =>
+  BOXPLOT_STATS.map((stat) => boxplotStatAlias(alias, stat.column));
diff --git a/web/src/utils/dashboard/chartTypeGroups.ts b/web/src/utils/dashboard/chartTypeGroups.ts
index ec2df6b2c6..b0e5806e38 100644
--- a/web/src/utils/dashboard/chartTypeGroups.ts
+++ b/web/src/utils/dashboard/chartTypeGroups.ts
@@ -35,13 +35,13 @@ export const isRawValueChart = (type: unknown): boolean =>
 export const DISTRIBUTION_ROW_LIMIT = 10000;
 
 /** Panel types drawn as HTML by their own renderer instead of an ECharts option. */
-export const HTML_PANEL_TYPES: readonly string[] = ["alert-list", "flame-graph"];
+export const HTML_PANEL_TYPES: readonly string[] = ["alert-list", "flame-graph", "logs"];
 
 export const isHtmlPanel = (type: unknown): boolean =>
   typeof type === "string" && HTML_PANEL_TYPES.includes(type);
 
 /** HTML panel types that read the rows of a hand-written SQL query; the builder cannot express them. */
-export const CUSTOM_SQL_PANEL_TYPES: readonly string[] = ["flame-graph"];
+export const CUSTOM_SQL_PANEL_TYPES: readonly string[] = ["flame-graph", "logs"];
 
 export const isCustomSqlPanel = (type: unknown): boolean =>
   typeof type === "string" && CUSTOM_SQL_PANEL_TYPES.includes(type);
diff --git a/web/src/utils/dashboard/configUtils.spec.ts b/web/src/utils/dashboard/configUtils.spec.ts
index 7fba3be98b..584044f134 100644
--- a/web/src/utils/dashboard/configUtils.spec.ts
+++ b/web/src/utils/dashboard/configUtils.spec.ts
@@ -1357,7 +1357,7 @@ describe("configUtils", () => {
   });
 
   describe("shouldShowAxisLabelConfig", () => {
-    const supportedTypes = ["area", "area-stacked", "bar", "line", "scatter", "stacked"];
+    const supportedTypes = ["area", "area-stacked", "bar", "line", "scatter", "stacked", "boxplot"];
     const unsupportedTypes = [
       "h-bar",
       "h-stacked",
@@ -1691,6 +1691,28 @@ describe("configUtils", () => {
       expect(shouldShowAxisConfig(panel("node-graph"))).toBe(false);
     });
   });
+
+  describe("box plot", () => {
+    const panel = {
+      data: {
+        type: "boxplot",
+        queries: [{ config: {} }],
+        config: {
+          show_legends: true,
+          legends_position: "right",
+          legends_type: "plain",
+          trellis: { layout: null },
+        },
+      },
+    };
+
+    it("keeps gridlines but has no legend or axis width", () => {
+      expect(shouldShowGridlines(panel)).toBe(true);
+      expect(shouldShowLegendsToggle(panel)).toBe(false);
+      expect(shouldShowLegendPosition(panel)).toBe(false);
+      expect(shouldShowAxisConfig(panel)).toBe(false);
+    });
+  });
 });
 
 describe("pruneDependentOptions", () => {
diff --git a/web/src/utils/dashboard/configUtils.ts b/web/src/utils/dashboard/configUtils.ts
index 40f79661d3..6119f65e02 100644
--- a/web/src/utils/dashboard/configUtils.ts
+++ b/web/src/utils/dashboard/configUtils.ts
@@ -7,9 +7,10 @@ import { isRowTimeline } from "./chartTypeGroups";
 // These draw no axes and no legend.
 const NO_AXIS_TYPES: string[] = ["bar-gauge", "treemap", "sunburst", "funnel", "node-graph"];
 // One series per panel, so a legend has nothing to tell apart.
-const NO_LEGEND_TYPES: string[] = [...NO_AXIS_TYPES];
+const NO_LEGEND_TYPES: string[] = [...NO_AXIS_TYPES, "boxplot"];
 // These lay out their own legend and axes, so the shared legend layout and axis width do not apply.
 const OWN_LAYOUT_TYPES: string[] = [
+  "boxplot",
   "bar-gauge",
   "hostmap",
   "distribution",
@@ -312,7 +313,7 @@ export const shouldShowCartesianAxisConfig = (dashboardPanelData: any): boolean
  * @returns boolean indicating if axis label config should be displayed
  */
 export const shouldShowAxisLabelConfig = (dashboardPanelData: any): boolean => {
-  return ["area", "area-stacked", "bar", "line", "scatter", "stacked"].includes(
+  return ["area", "area-stacked", "bar", "line", "scatter", "stacked", "boxplot"].includes(
     dashboardPanelData.data.type,
   );
 };
diff --git a/web/src/utils/dashboard/convertBoxplotData.spec.ts b/web/src/utils/dashboard/convertBoxplotData.spec.ts
new file mode 100644
index 0000000000..cc9dbe70c6
--- /dev/null
+++ b/web/src/utils/dashboard/convertBoxplotData.spec.ts
@@ -0,0 +1,313 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import { convertPanelData } from "./convertPanelData";
+import { buildSQLChartQuery } from "./dashboardAutoQueryBuilder";
+import {
+  boxStats,
+  boxplotDrilldownSeries,
+  boxplotDrilldownTime,
+  quantile,
+} from "./convertBoxplotData";
+
+vi.mock("./convertCustomChartData", () => ({
+  runJavaScriptCode: vi.fn(),
+  validateUserCode: vi.fn(() => null),
+}));
+
+const store = {
+  state: {
+    theme: "light",
+    timezone: "UTC",
+    zoConfig: { timestamp_column: "_timestamp", max_dashboard_series: 1000 },
+    selectedOrganization: { identifier: "default" },
+  },
+};
+
+const field = (alias: string, column: string, functionName: string | null = null) => ({
+  label: "",
+  alias,
+  column,
+  functionName,
+  args: [{ type: "field", value: { field: column } }],
+  isDerived: false,
+  havingConditions: [],
+});
+
+const panel = (config: Record<string, any> = {}, x = [field("x_axis_1", "service")]) => ({
+  id: "p",
+  type: "boxplot",
+  queryType: "sql",
+  queries: [
+    {
+      query: "",
+      customQuery: false,
+      fields: {
+        stream: "demo_app",
+        stream_type: "logs",
+        x,
+        y: [{ ...field("y_axis_1", "latency_ms"), label: "Latency" }],
+        z: [],
+        breakdown: [],
+        filter: { filterType: "group", logicalOperator: "AND", conditions: [] },
+      },
+      config: { limit: 0 },
+      joins: [],
+    },
+  ],
+  config: { show_legends: true, unit: "default", decimals: 0, ...config },
+});
+
+const convert = async (schema: any, data: any[], width = 800) =>
+  (await convertPanelData(
+    schema,
+    data,
+    store,
+    { value: { offsetWidth: width, offsetHeight: 400 } },
+    { value: null },
+    { value: [] },
+    { queries: [] },
+    { height: "400px" },
+    { value: [] },
+    false,
+  )) as any;
+
+const values = [1, 2, 3, 4, 5, 6, 7, 8, 100];
+const rows = [
+  ...values.map((value) => ({ x_axis_1: "web", y_axis_1: value })),
+  { x_axis_1: "api", y_axis_1: 10 },
+  { x_axis_1: "api", y_axis_1: 20 },
+  { x_axis_1: "api", y_axis_1: null },
+];
+
+describe("box plot", () => {
+  it("computes each category's summary in SQL over every matching row", () => {
+    const schema = panel();
+    const build = () =>
+      buildSQLChartQuery({
+        queryData: schema.queries[0],
+        chartType: "boxplot",
+        dashboardPanelData: { data: schema, meta: {} },
+      });
+    expect(build()).toBe(
+      'SELECT service as "x_axis_1", min(latency_ms) as "y_axis_1_min", ' +
+        'approx_percentile_cont(latency_ms, 0.25) as "y_axis_1_q1", ' +
+        'approx_percentile_cont(latency_ms, 0.5) as "y_axis_1_median", ' +
+        'approx_percentile_cont(latency_ms, 0.75) as "y_axis_1_q3", ' +
+        'max(latency_ms) as "y_axis_1_max", count(latency_ms) as "y_axis_1_count" ' +
+        'FROM "demo_app"  GROUP BY "x_axis_1" LIMIT 10000',
+    );
+    schema.queries[0].config.limit = 500;
+    schema.queries[0].fields.x[0] = { ...schema.queries[0].fields.x[0], sortBy: "ASC" };
+    expect(build()).toMatch(/GROUP BY "x_axis_1" ORDER BY "x_axis_1" ASC LIMIT 500$/);
+  });
+
+  it("summarises the whole stream in one row without an x field", () => {
+    const schema = panel({}, []);
+    expect(
+      buildSQLChartQuery({
+        queryData: schema.queries[0],
+        chartType: "boxplot",
+        dashboardPanelData: { data: schema, meta: {} },
+      }),
+    ).toMatch(/^SELECT min\(latency_ms\) as "y_axis_1_min", .* FROM "demo_app"\s*$/);
+  });
+
+  it("interpolates quantiles linearly", () => {
+    expect(quantile([1, 2, 3, 4], 0.5)).toBe(2.5);
+    expect(quantile([1, 2, 3, 4], 0.25)).toBe(1.75);
+    expect(quantile([7], 0.75)).toBe(7);
+  });
+
+  it("min-max whiskers reach every value and split off no outliers", () => {
+    expect(boxStats(values, "minmax")).toEqual({
+      low: 1,
+      q1: 3,
+      median: 5,
+      q3: 7,
+      high: 100,
+      count: 9,
+      outliers: [],
+    });
+  });
+
+  it("iqr whiskers stop inside the 1.5 IQR fences and the rest are outliers", () => {
+    expect(boxStats(values, "iqr")).toMatchObject({ low: 1, high: 8, outliers: [100] });
+  });
+
+  it("draws one box per category in name order, min-max by default", async () => {
+    const out = await convert(panel(), [rows]);
+    const [box, ...rest] = out.options.series;
+    expect(out.chartType).toBe("boxplot");
+    expect(rest).toEqual([]);
+    expect(out.options.xAxis.data).toEqual(["api", "web"]);
+    expect(box.type).toBe("boxplot");
+    expect(box.data).toEqual([
+      [10, 12.5, 15, 17.5, 20],
+      [1, 3, 5, 7, 100],
+    ]);
+  });
+
+  it("labels every category, tilting and truncating only when they crowd the axis", async () => {
+    const services = ["auth", "cart", "checkout", "inventory", "payments", "search"];
+    const many = services.flatMap((name) => [
+      { x_axis_1: name, y_axis_1: 1 },
+      { x_axis_1: name, y_axis_1: 3 },
+    ]);
+    const roomy = (await convert(panel(), [many], 1200)).options.xAxis.axisLabel;
+    expect(roomy).toMatchObject({ interval: 0, rotate: 0 });
+    expect(roomy.hideOverlap).toBeUndefined();
+    const crowded = (await convert(panel(), [many], 400)).options.xAxis.axisLabel;
+    expect(crowded).toMatchObject({ interval: 0, rotate: 45, width: 120, overflow: "truncate" });
+    const chosen = (
+      await convert(panel({ axis_label_rotate: 30, axis_label_truncate_width: 60 }), [many], 400)
+    ).options.xAxis.axisLabel;
+    expect(chosen).toMatchObject({ interval: 0, rotate: 30, width: 60 });
+  });
+
+  it("keeps adjacent y-axis ticks distinct after unit rounding, and exact ticks unchanged", async () => {
+    const tick = (await convert(panel({ unit: "milliseconds", decimals: 0 }), [rows])).options.yAxis
+      .axisLabel.formatter;
+    expect(tick(1000)).toBe("1s");
+    expect(tick(1200)).toBe("1.2s");
+    expect(tick(800)).toBe("800ms");
+  });
+
+  it("adds an outlier scatter series in iqr mode", async () => {
+    const out = await convert(panel({ boxplot_whisker: "iqr" }), [rows]);
+    expect(out.options.series[0].data[1]).toEqual([1, 3, 5, 7, 8]);
+    expect(out.options.series[1]).toMatchObject({ type: "scatter", data: [[1, 100]] });
+  });
+
+  it("names the single box after the y field when there is no x field", async () => {
+    const out = await convert(panel({}, []), [rows]);
+    expect(out.options.xAxis.data).toEqual(["Latency"]);
+    expect(out.options.series[0].data).toHaveLength(1);
+  });
+
+  it("draws one box per time bucket from the builder's SQL summary rows", async () => {
+    const summary = (
+      bucket: string,
+      low: number,
+      q1: number,
+      median: number,
+      q3: number,
+      high: number,
+    ) => ({
+      x_axis_1: bucket,
+      y_axis_1_min: low,
+      y_axis_1_q1: q1,
+      y_axis_1_median: median,
+      y_axis_1_q3: q3,
+      y_axis_1_max: high,
+      y_axis_1_count: 1000,
+    });
+    const buckets = [
+      summary("2026-10-01T00:00:00", 1, 10, 20, 30, 90),
+      summary("2026-10-01T01:00:00", 2, 12, 22, 32, 40),
+      summary("2026-10-01T02:00:00", 3, 14, 24, 34, 45),
+    ];
+    const minmax = await convert(panel(), [buckets]);
+    expect(minmax.options.xAxis.data).toHaveLength(3);
+    expect(minmax.options.series[0].data[0]).toEqual([1, 10, 20, 30, 90]);
+    const iqr = await convert(panel({ boxplot_whisker: "iqr" }), [buckets]);
+    expect(iqr.options.series[0].data[0]).toEqual([1, 10, 20, 30, 60]);
+    expect(iqr.options.series).toHaveLength(1);
+  });
+
+  it("shows time-bucket categories in the dashboard timezone", async () => {
+    const bucketRows = [
+      { x_axis_1: "2026-10-01T05:00:00", y_axis_1: 10 },
+      { x_axis_1: "2026-10-01T05:00:00", y_axis_1: 20 },
+    ];
+    const schema = panel({}, [field("x_axis_1", "_timestamp", "histogram")]);
+    schema.queries[0].customQuery = true;
+    const zoned = await convertPanelData(
+      schema,
+      [bucketRows],
+      { state: { ...store.state, timezone: "Asia/Kolkata" } },
+      { value: { offsetWidth: 800, offsetHeight: 400 } },
+      { value: null },
+      { value: [] },
+      { queries: [] },
+      { height: "400px" },
+      { value: [] },
+      false,
+    );
+    expect((zoned as any).options.xAxis.data).toEqual(["2026-10-01 10:30:00"]);
+    const plain = await convert(panel(), [[{ x_axis_1: "api", y_axis_1: 5 }]]);
+    expect(plain.options.xAxis.data).toEqual(["api"]);
+  });
+
+  it("draws only query 1, so a second query cannot merge into its boxes", async () => {
+    const schema: any = panel();
+    schema.queries.push({ ...schema.queries[0] });
+    const result = await convert(schema, [
+      [{ x_axis_1: "api", y_axis_1: 10 }],
+      [{ x_axis_1: "api", y_axis_1: 999 }],
+    ]);
+    expect(result.options.xAxis.data).toEqual(["api"]);
+    expect(result.options.series[0].data).toEqual([[10, 10, 10, 10, 10]]);
+  });
+
+  it("lists the quartiles in the box tooltip with the panel unit", async () => {
+    const out = await convert(panel({ unit: "milliseconds", boxplot_whisker: "iqr" }), [rows]);
+    const text = out.options.tooltip.formatter({ seriesType: "boxplot", dataIndex: 1 });
+    expect(text).toContain("<strong>web</strong>");
+    expect(text).toContain("Upper whisker: 8ms");
+    expect(text).toContain("Median: 5ms");
+    expect(text).toContain("Samples: 9");
+  });
+
+  it("hands a drilldown the clicked category with the median or outlier value", async () => {
+    const { options } = await convert(panel({ boxplot_whisker: "iqr" }), [rows]);
+    expect(boxplotDrilldownSeries(options, { seriesType: "boxplot", dataIndex: 1 })).toEqual({
+      __name: "web",
+      __value: 5,
+      __axisValue: "web",
+    });
+    expect(boxplotDrilldownSeries(options, { seriesType: "scatter", data: [1, 100] })).toEqual({
+      __name: "web",
+      __value: 100,
+      __axisValue: "web",
+    });
+  });
+
+  it("draws nothing without numeric rows", async () => {
+    expect((await convert(panel(), [[{ x_axis_1: "a", y_axis_1: "x" }]])).options.series).toEqual(
+      [],
+    );
+  });
+});
+
+describe("boxplotDrilldownTime", () => {
+  const options = {
+    xAxis: { data: ["2026-10-30 10:00:00"] },
+    series: [{ data: [[1, 2, 3, 4, 5]] }],
+  };
+  const params = { seriesType: "boxplot", dataIndex: 0, value: [0, 1, 2, 3, 4, 5] };
+  const panel = (functionName: string | null) => ({
+    queries: [{ fields: { x: [{ alias: "x_axis_1", functionName }] } }],
+  });
+
+  it("opens a time-bucket box at its bucket", () => {
+    expect(boxplotDrilldownTime(panel("histogram"), options, params)).toBe("2026-10-30 10:00:00");
+  });
+
+  it("keeps the panel range for a plain category, never the box's minimum", () => {
+    expect(boxplotDrilldownTime(panel(null), options, params)).toBeNull();
+  });
+});
diff --git a/web/src/utils/dashboard/convertBoxplotData.ts b/web/src/utils/dashboard/convertBoxplotData.ts
new file mode 100644
index 0000000000..13943b55dd
--- /dev/null
+++ b/web/src/utils/dashboard/convertBoxplotData.ts
@@ -0,0 +1,332 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { format as echartsFormat } from "echarts/core";
+import { gt, raw } from "@/types/i18n";
+import { chartColor } from "@/utils/chartTheme";
+import { escapeHtml } from "@/utils/html";
+import { addCommasToNumber } from "@/utils/formatters";
+import { formatAxisTickValue } from "./axisTickFormat";
+import { getDataValue } from "./aliasUtils";
+import { getGridLineStyle, getSeriesColor } from "./colorPalette";
+import { formatUnitValue, getUnitValue } from "./convertDataIntoUnitValue";
+import { getFieldLabel } from "./fieldLabel";
+import { BOXPLOT_STATS, boxplotStatAlias, type BoxplotStatKey } from "./boxplotStats";
+import { parseTimestampValue } from "./tableConfigUtils";
+import { echartsPaletteColor } from "./thresholds";
+
+export const BOXPLOT_WHISKERS = ["minmax", "iqr"] as const;
+export const DEFAULT_BOXPLOT_WHISKER = "minmax";
+// Tukey fences: a value further than this many interquartile ranges past a quartile is an outlier.
+const IQR_FENCE = 1.5;
+const LABEL_CHAR_WIDTH = 7;
+// Room the y-axis labels and grid padding take from the plot width.
+const Y_AXIS_ALLOWANCE = 80;
+const CROWDED_ROTATION = 45;
+const CROWDED_WIDTH = 120;
+const FALLBACK_PANEL_WIDTH = 800;
+const TIME_BUCKET_FUNCTIONS = new Set(["histogram", "date_bin"]);
+
+/** Five-number summary of one category; outliers are only split off in iqr mode. */
+export interface BoxStats {
+  low: number;
+  q1: number;
+  median: number;
+  q3: number;
+  high: number;
+  count: number;
+  outliers: number[];
+}
+
+const toNumber = (value: unknown): number | null => {
+  if (value === null || value === undefined || value === "" || typeof value === "boolean") {
+    return null;
+  }
+  const numeric = Number(value);
+  return Number.isFinite(numeric) ? numeric : null;
+};
+
+/** Linear-interpolated quantile of sorted values, the same method as numpy's default. */
+export const quantile = (sorted: number[], q: number): number => {
+  if (!sorted.length) return NaN;
+  const position = (sorted.length - 1) * q;
+  const lower = Math.floor(position);
+  const upper = Math.ceil(position);
+  return sorted[lower] + (sorted[upper] - sorted[lower]) * (position - lower);
+};
+
+/** Quartiles and whiskers of the values; iqr whiskers stop at the last value inside the fences. */
+export const boxStats = (values: number[], whisker: string): BoxStats | null => {
+  if (!values.length) return null;
+  const sorted = [...values].sort((a, b) => a - b);
+  const q1 = quantile(sorted, 0.25);
+  const median = quantile(sorted, 0.5);
+  const q3 = quantile(sorted, 0.75);
+  if (whisker !== "iqr") {
+    return {
+      low: sorted[0],
+      q1,
+      median,
+      q3,
+      high: sorted[sorted.length - 1],
+      count: sorted.length,
+      outliers: [],
+    };
+  }
+  const spread = (q3 - q1) * IQR_FENCE;
+  const inside = sorted.filter((value) => value >= q1 - spread && value <= q3 + spread);
+  return {
+    low: inside[0] ?? q1,
+    q1,
+    median,
+    q3,
+    high: inside[inside.length - 1] ?? q3,
+    count: sorted.length,
+    outliers: sorted.filter((value) => value < q1 - spread || value > q3 + spread),
+  };
+};
+
+interface BoxGroup {
+  name: string;
+  values: number[];
+  summary?: Record<BoxplotStatKey, number>;
+}
+
+const byName = (a: BoxGroup, b: BoxGroup) =>
+  a.name.localeCompare(b.name, undefined, { numeric: true });
+
+/** The SQL-computed summary of a builder row, or null when the row carries raw values instead. */
+const rowSummary = (row: any, alias: string): Record<BoxplotStatKey, number> | null => {
+  const entries = BOXPLOT_STATS.map(
+    (stat) =>
+      [stat.key, toNumber(getDataValue(row, boxplotStatAlias(alias, stat.column)))] as const,
+  );
+  if (entries.some(([, value]) => value === null)) return null;
+  return Object.fromEntries(entries) as Record<BoxplotStatKey, number>;
+};
+
+/** Raw y values (or a builder query's per-category summary) per x value of query 1; without an x field everything lands in one box named after the y field. */
+export const boxplotGroups = (panelSchema: any, data: any[], timezone = "UTC"): BoxGroup[] => {
+  const groups = new Map<string, BoxGroup>();
+  // One query per box plot: boxes from several queries would collide on shared category names.
+  const query = panelSchema?.queries?.[0];
+  const rows = data?.[0];
+  const field = query?.fields?.y?.[0];
+  const category = query?.fields?.x?.[0];
+  if (!Array.isArray(rows) || !field || query?.config?.hide) return [];
+  const label = getFieldLabel(field, panelSchema?.config, query?.customQuery) || field?.alias || "";
+  const isTimeBucket = TIME_BUCKET_FUNCTIONS.has(category?.functionName);
+  const categoryName = (value: unknown) => {
+    if (isTimeBucket) return parseTimestampValue(value, timezone) ?? String(value ?? "");
+    return String(value ?? "");
+  };
+  rows.forEach((row: any) => {
+    const name = category ? categoryName(getDataValue(row, category.alias)) : label;
+    const summary = query?.customQuery ? null : rowSummary(row, field.alias);
+    const value = summary ? null : toNumber(getDataValue(row, field.alias));
+    if (!summary && value === null) return;
+    if (!groups.has(name)) groups.set(name, { name, values: [] });
+    const group = groups.get(name)!;
+    if (summary) group.summary ??= summary;
+    else group.values.push(value!);
+  });
+  return [...groups.values()].sort(byName);
+};
+
+/** Box from a builder query's SQL summary; the raw values never reach the browser, so iqr whiskers stop at the fences and no outliers are drawn. */
+export const summaryBoxStats = (
+  summary: Record<BoxplotStatKey, number>,
+  whisker: string,
+): BoxStats => {
+  const { low, q1, median, q3, high, count } = summary;
+  if (whisker !== "iqr") return { low, q1, median, q3, high, count, outliers: [] };
+  const spread = (q3 - q1) * IQR_FENCE;
+  return {
+    low: Math.max(low, q1 - spread),
+    q1,
+    median,
+    q3,
+    high: Math.min(high, q3 + spread),
+    count,
+    outliers: [],
+  };
+};
+
+const seriesName = (panelSchema: any): string => {
+  const query = panelSchema?.queries?.[0];
+  const field = query?.fields?.y?.[0];
+  return getFieldLabel(field, panelSchema?.config, query?.customQuery) || field?.alias || "";
+};
+
+/** Shows every category; crowded labels tilt and truncate, unless the panel sets its own rotation or width. */
+export const categoryLabelLayout = (names: string[], panelWidth: number, config: any) => {
+  const slot = Math.max(panelWidth - Y_AXIS_ALLOWANCE, 40) / Math.max(names.length, 1);
+  const longest = Math.max(0, ...names.map((name) => String(name).length)) * LABEL_CHAR_WIDTH;
+  const crowded = longest + 8 > slot;
+  const rotate = Number(config?.axis_label_rotate) || (crowded ? CROWDED_ROTATION : 0);
+  const width = Number(config?.axis_label_truncate_width) || (crowded ? CROWDED_WIDTH : undefined);
+  return { interval: 0, rotate, width, overflow: "truncate" as const };
+};
+
+/** Converts SQL rows into a box plot: one box per x value, from the builder's per-category summary or a custom query's raw values. */
+export const convertBoxplotData = (
+  panelSchema: any,
+  data: any,
+  store: any,
+  chartPanelRef?: any,
+) => {
+  const config = panelSchema?.config ?? {};
+  const whisker = config.boxplot_whisker === "iqr" ? "iqr" : DEFAULT_BOXPLOT_WHISKER;
+  const groups = boxplotGroups(
+    panelSchema,
+    Array.isArray(data) ? data : [],
+    store?.state?.timezone,
+  );
+  const stats = groups.map((group) =>
+    group.summary ? summaryBoxStats(group.summary, whisker) : boxStats(group.values, whisker)!,
+  );
+  if (!stats.length) return { options: { series: [] }, extras: { panelId: panelSchema?.id } };
+
+  const theme = store?.state?.theme;
+  const name = seriesName(panelSchema);
+  const color =
+    getSeriesColor(
+      config.color ?? null,
+      name,
+      [],
+      0,
+      0,
+      theme,
+      config.color?.colorBySeries,
+      config,
+    ) ?? echartsPaletteColor(0);
+  const format = (value: unknown) =>
+    formatUnitValue(getUnitValue(value, config.unit, config.unit_custom, config.decimals));
+  const lowLabel =
+    whisker === "iqr"
+      ? gt("dashboard.utils.boxplotLowerWhisker")
+      : gt("dashboard.utils.boxplotMin");
+  const highLabel =
+    whisker === "iqr"
+      ? gt("dashboard.utils.boxplotUpperWhisker")
+      : gt("dashboard.utils.boxplotMax");
+  const boxTooltip = (index: number) => {
+    const box = stats[index];
+    const rows: [string, string][] = [
+      [highLabel, format(box.high)],
+      [raw("Q3"), format(box.q3)],
+      [gt("dashboard.utils.boxplotMedian"), format(box.median)],
+      [raw("Q1"), format(box.q1)],
+      [lowLabel, format(box.low)],
+      [gt("dashboard.utils.boxplotSamples"), addCommasToNumber(box.count)],
+    ];
+    return [
+      `<strong>${escapeHtml(groups[index].name)}</strong>`,
+      ...rows.map(([label, value]) => `${escapeHtml(label)}: ${escapeHtml(value)}`),
+    ].join("<br/>");
+  };
+
+  const series: any[] = [
+    {
+      type: "boxplot",
+      name,
+      itemStyle: {
+        color: chartColor("--color-surface-base"),
+        borderColor: color,
+        borderWidth: 1.5,
+      },
+      emphasis: { itemStyle: { borderWidth: 2 } },
+      data: stats.map((box) => [box.low, box.q1, box.median, box.q3, box.high]),
+    },
+  ];
+  const outliers = stats.flatMap((box, index) => box.outliers.map((value) => [index, value]));
+  if (outliers.length) {
+    series.push({
+      type: "scatter",
+      name: gt("dashboard.utils.boxplotOutlier"),
+      symbolSize: 6,
+      itemStyle: { color, opacity: 0.7 },
+      data: outliers,
+    });
+  }
+
+  const options = {
+    backgroundColor: "transparent",
+    grid: { containLabel: true, left: 8, right: 16, top: 16, bottom: 8 },
+    tooltip: {
+      show: true,
+      trigger: "item",
+      appendToBody: true,
+      className: "o2-echarts-tooltip",
+      textStyle: { color: chartColor("--color-tooltip-text"), fontSize: 12 },
+      backgroundColor: chartColor("--color-tooltip-bg"),
+      borderColor: chartColor("--color-tooltip-border"),
+      formatter: (params: any) => {
+        if (params?.seriesType === "boxplot") return boxTooltip(params.dataIndex);
+        const [index, value] = params?.value ?? [];
+        return `${echartsFormat.getTooltipMarker(params?.color)}${escapeHtml(groups[index]?.name ?? "")} · ${escapeHtml(params?.seriesName ?? "")}: <strong>${escapeHtml(format(value))}</strong>`;
+      },
+    },
+    xAxis: {
+      type: "category",
+      data: groups.map((group) => group.name),
+      boundaryGap: true,
+      axisLabel: {
+        ...categoryLabelLayout(
+          groups.map((group) => group.name),
+          chartPanelRef?.value?.offsetWidth || FALLBACK_PANEL_WIDTH,
+          config,
+        ),
+        color: chartColor("--color-text-secondary"),
+      },
+      splitLine: { show: false },
+    },
+    yAxis: {
+      type: "value",
+      scale: true,
+      axisLabel: {
+        color: chartColor("--color-text-secondary"),
+        formatter: (value: number) =>
+          formatAxisTickValue(value, config.unit, config.unit_custom, config.decimals),
+      },
+      splitLine: {
+        show: config.show_gridlines !== false,
+        lineStyle: getGridLineStyle(theme),
+      },
+    },
+    series,
+  };
+  return { options, extras: { panelId: panelSchema?.id } };
+};
+
+/** Drilldown series variables of a box (its category and median) or an outlier point (its category and value). */
+export const boxplotDrilldownSeries = (options: any, params: any) => {
+  const categories: unknown[] = options?.xAxis?.data ?? [];
+  if (params?.seriesType === "boxplot") {
+    const category = categories[params?.dataIndex];
+    const box = options?.series?.[0]?.data?.[params?.dataIndex] ?? [];
+    return { __name: category, __value: box[2], __axisValue: category };
+  }
+  const category = categories[params?.data?.[0]];
+  return { __name: category, __value: params?.data?.[1], __axisValue: category };
+};
+
+/** The time a logs drilldown starts at: a time-bucket box's category, or null to keep the panel range, since a box's value[0] is never a time. */
+export const boxplotDrilldownTime = (panelSchema: any, options: any, params: any) => {
+  if (!TIME_BUCKET_FUNCTIONS.has(panelSchema?.queries?.[0]?.fields?.x?.[0]?.functionName)) {
+    return null;
+  }
+  return boxplotDrilldownSeries(options, params).__axisValue ?? null;
+};
diff --git a/web/src/utils/dashboard/convertHostmapData.ts b/web/src/utils/dashboard/convertHostmapData.ts
index 3143245497..cfb5df7bd3 100644
--- a/web/src/utils/dashboard/convertHostmapData.ts
+++ b/web/src/utils/dashboard/convertHostmapData.ts
@@ -23,7 +23,7 @@ import { getDataValue } from "./aliasUtils";
 import { getContrastColor } from "./chartColorUtils";
 import { getSeriesColor, shadeColor } from "./colorPalette";
 import { buildPromqlSeriesNames } from "./promql/shared/legendBuilder";
-import { legendFallbackOf } from "./promql/formula";
+import { legendExprOf, legendFallbackOf } from "./promql/formula";
 import {
   buildValueMappingCache,
   formatNumericValue,
@@ -228,6 +228,7 @@ export const promqlHostmapEntities = (
       metrics: (entry?.result ?? []).map((m: any) => m?.metric).filter(Boolean),
       template: panelSchema.queries?.[queryIndexOf(index)]?.config?.promql_legend,
       fallback: legendFallbackOf(panelSchema.queries, queryIndexOf(index)),
+      expr: legendExprOf(panelSchema.queries, metadata, queryIndexOf(index)),
     })),
     getCachedSemanticGroups(store?.state?.selectedOrganization?.identifier ?? "") ?? [],
   );
diff --git a/web/src/utils/dashboard/convertLogsPanelData.spec.ts b/web/src/utils/dashboard/convertLogsPanelData.spec.ts
new file mode 100644
index 0000000000..355bfe1eb8
--- /dev/null
+++ b/web/src/utils/dashboard/convertLogsPanelData.spec.ts
@@ -0,0 +1,171 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import { convertPanelData } from "./convertPanelData";
+import { convertLogsPanelData, resolveLogsFields, toEpochMillis } from "./convertLogsPanelData";
+
+vi.mock("./convertCustomChartData", () => ({
+  runJavaScriptCode: vi.fn(),
+  validateUserCode: vi.fn(() => null),
+}));
+
+const store = {
+  state: {
+    theme: "light",
+    timezone: "UTC",
+    zoConfig: { timestamp_column: "_timestamp", max_dashboard_series: 1000 },
+    selectedOrganization: { identifier: "default" },
+  },
+};
+
+const convert = async (schema: any, data: any[]) =>
+  (await convertPanelData(
+    schema,
+    data,
+    store,
+    { value: { offsetWidth: 800, offsetHeight: 400 } },
+    { value: null },
+    { value: [] },
+    { queries: [] },
+    { height: "400px" },
+    { value: [] },
+    false,
+  )) as any;
+
+const panel = (config: Record<string, any> = {}, query = 'SELECT * FROM "demo_app"') => ({
+  id: "p",
+  type: "logs",
+  queryType: "sql",
+  queries: [{ query, customQuery: true, fields: { x: [], y: [] }, config: {} }],
+  config,
+});
+
+// Rows as the local backend returns them for SELECT * FROM "demo_app" ORDER BY _timestamp DESC.
+const rows = [
+  {
+    _timestamp: 1793057797456037,
+    level: "error",
+    message: "upstream inventory failed: timeout after 103ms",
+    payload: '{"user":"u278","cart_items":5}',
+    status: 200,
+  },
+  {
+    _timestamp: 1793057797456039,
+    level: "info",
+    message: "GET /api/search/update 26ms",
+    payload: '{"user":"u138","cart_items":5}',
+    status: 200,
+  },
+  {
+    _timestamp: 1793057797456038,
+    level: "warn",
+    message: "GET /api/inventory/list 323ms",
+    payload: '{"user":"u494","cart_items":8}',
+    status: 200,
+  },
+];
+
+describe("convertLogsPanelData", () => {
+  it("is routed by convertPanelData and orders newest first with no config", async () => {
+    const result = await convert(panel(), [rows]);
+    expect(result.chartType).toBe("logs");
+    expect(result.rows.map((row: any) => row.level)).toEqual(["info", "warning", "error"]);
+    expect(result.fields).toEqual({ time: "_timestamp", level: "level", message: "message" });
+    expect(Math.floor(result.rows[0].time)).toBe(Date.parse("2026-10-26T23:36:37.456Z"));
+    expect(result.rows[0].source).toBe(rows[1]);
+  });
+
+  it("orders oldest first when logs_order is oldest", async () => {
+    const result = await convert(panel({ logs_order: "oldest" }), [rows]);
+    expect(result.rows.map((row: any) => row.level)).toEqual(["error", "warning", "info"]);
+  });
+
+  it("gives every row a unique key even when timestamps repeat", async () => {
+    const same = rows.map((row) => ({ ...row, _timestamp: 1 }));
+    const result = await convert(panel(), [same]);
+    expect(new Set(result.rows.map((row: any) => row.key)).size).toBe(3);
+  });
+
+  it("reads the configured columns, whatever they are called", () => {
+    const custom = [{ ts: "2026-10-27T03:36:37Z", lvl: "WARN", body_text: "disk 91% full" }];
+    const result = convertLogsPanelData(
+      panel({ logs_time_field: "ts", logs_level_field: "lvl", logs_message_field: "body_text" }),
+      [custom],
+      store,
+    );
+    expect(result.fields).toEqual({ time: "ts", level: "lvl", message: "body_text" });
+    expect(result.rows[0]).toMatchObject({
+      level: "warning",
+      time: Date.parse("2026-10-27T03:36:37Z"),
+    });
+  });
+
+  it("marks a configured level column with no value as unknown", () => {
+    const result = convertLogsPanelData(
+      panel({ logs_level_field: "lvl" }),
+      [[{ msg: "x" }]],
+      store,
+    );
+    expect(result.rows[0].level).toBe("unknown");
+  });
+
+  it("leaves the message field unset when no message column exists", () => {
+    const result = convertLogsPanelData(panel(), [[{ _timestamp: 1, code: 7 }]], store);
+    expect(result.fields.message).toBeNull();
+    expect(result.rows[0].source).toEqual({ _timestamp: 1, code: 7 });
+  });
+
+  it("detects well-known names in order of preference", () => {
+    expect(
+      resolveLogsFields({}, [{ timestamp: 1, severity: "info", msg: "a", log: "b" }], "_timestamp"),
+    ).toEqual({ time: "timestamp", level: "severity", message: "msg" });
+  });
+
+  it("returns no rows for an empty or missing result", async () => {
+    expect((await convert(panel(), [[]])).rows).toEqual([]);
+    expect(convertLogsPanelData(panel(), undefined, store).rows).toEqual([]);
+  });
+
+  it("reads the first visible query", () => {
+    const schema = {
+      ...panel(),
+      queries: [
+        { query: "a", customQuery: true, fields: {}, config: { hide: true } },
+        { query: "b", customQuery: true, fields: {}, config: {} },
+      ],
+    };
+    const result = convertLogsPanelData(
+      schema,
+      [[{ message: "hidden" }], [{ message: "shown" }]],
+      store,
+    );
+    expect(result.rows.map((row) => row.source.message)).toEqual(["shown"]);
+  });
+});
+
+describe("toEpochMillis", () => {
+  it("reads seconds, milliseconds, microseconds, nanoseconds and date strings", () => {
+    const ms = 1793057797456;
+    expect(toEpochMillis(ms / 1000)).toBe(ms);
+    expect(toEpochMillis(ms)).toBe(ms);
+    expect(toEpochMillis(ms * 1000)).toBe(ms);
+    expect(toEpochMillis(ms * 1e6)).toBe(ms);
+    expect(toEpochMillis(String(ms * 1000))).toBe(ms);
+    expect(toEpochMillis("2026-10-27 03:36:37")).toBe(Date.UTC(2026, 9, 27, 3, 36, 37));
+    expect(toEpochMillis("not a date")).toBeNull();
+    expect(toEpochMillis(null)).toBeNull();
+  });
+});
diff --git a/web/src/utils/dashboard/convertLogsPanelData.ts b/web/src/utils/dashboard/convertLogsPanelData.ts
new file mode 100644
index 0000000000..ad0a25829c
--- /dev/null
+++ b/web/src/utils/dashboard/convertLogsPanelData.ts
@@ -0,0 +1,118 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import {
+  resolveLogSeverity,
+  resolveSeverityFieldValue,
+  SEVERITY_MESSAGE_FIELDS,
+  SEVERITY_TIER1_FIELDS,
+  type LogSeverityLevel,
+} from "@/utils/logs/statusParser";
+
+export const LOGS_ORDERS = ["newest", "oldest"] as const;
+export type LogsOrder = (typeof LOGS_ORDERS)[number];
+export const DEFAULT_LOGS_ORDER: LogsOrder = "newest";
+
+/** One log line; `source` is the row exactly as the query returned it. */
+export interface LogsPanelRow {
+  key: string;
+  time: number | null;
+  level: LogSeverityLevel;
+  source: Record<string, unknown>;
+}
+
+export interface LogsPanelFields {
+  time: string | null;
+  level: string | null;
+  message: string | null;
+}
+
+export interface LogsPanelData {
+  rows: LogsPanelRow[];
+  fields: LogsPanelFields;
+}
+
+const setField = (value: unknown): string | null =>
+  typeof value === "string" && value.trim() ? value.trim() : null;
+
+const firstPresent = (rows: Record<string, unknown>[], names: readonly string[]): string | null => {
+  const sample = rows.slice(0, 50);
+  for (const name of names) {
+    if (sample.some((row) => row?.[name] !== undefined && row?.[name] !== null)) return name;
+  }
+  return null;
+};
+
+/** Epoch numbers in s, ms, µs or ns and date strings, as milliseconds. */
+export const toEpochMillis = (value: unknown): number | null => {
+  if (value === null || value === undefined || value === "") return null;
+  if (typeof value === "number" || (typeof value === "string" && /^\d+(\.\d+)?$/.test(value))) {
+    const numeric = Number(value);
+    if (!Number.isFinite(numeric)) return null;
+    if (numeric > 1e17) return numeric / 1e6;
+    if (numeric > 1e14) return numeric / 1e3;
+    if (numeric > 1e11) return numeric;
+    return numeric * 1e3;
+  }
+  if (typeof value === "string") {
+    const parsed = Date.parse(value.includes("T") || value.endsWith("Z") ? value : `${value}Z`);
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+  return null;
+};
+
+/** The time, level and message columns: the configured ones, else the first well-known name the rows carry. */
+export const resolveLogsFields = (
+  config: any,
+  rows: Record<string, unknown>[],
+  timestampColumn: string,
+): LogsPanelFields => ({
+  time: setField(config?.logs_time_field) ?? firstPresent(rows, [timestampColumn, "timestamp"]),
+  level: setField(config?.logs_level_field) ?? firstPresent(rows, SEVERITY_TIER1_FIELDS),
+  message: setField(config?.logs_message_field) ?? firstPresent(rows, SEVERITY_MESSAGE_FIELDS),
+});
+
+const levelOf = (row: Record<string, unknown>, field: string | null): LogSeverityLevel => {
+  if (!field) return resolveLogSeverity(row).level;
+  const value = row?.[field];
+  if (value === null || value === undefined || value === "") return "unknown";
+  // A configured column of any name is read as a level column, so `lvl` = "warn" still colours.
+  return (
+    resolveSeverityFieldValue("level", value)?.level ??
+    resolveSeverityFieldValue(field, value)?.level ??
+    "unknown"
+  );
+};
+
+/** Log lines from the first visible query's rows, ordered by time per `logs_order`. */
+export const convertLogsPanelData = (panelSchema: any, data: any, store: any): LogsPanelData => {
+  const queryIndex = (panelSchema?.queries ?? []).findIndex((query: any) => !query?.config?.hide);
+  const raw = Array.isArray(data?.[Math.max(queryIndex, 0)]) ? data[Math.max(queryIndex, 0)] : [];
+  const source = raw.filter((row: unknown) => row && typeof row === "object");
+  const timestampColumn = store?.state?.zoConfig?.timestamp_column || "_timestamp";
+  const fields = resolveLogsFields(panelSchema?.config, source, timestampColumn);
+  const rows: LogsPanelRow[] = source.map((row: Record<string, unknown>, index: number) => {
+    const time = fields.time ? toEpochMillis(row[fields.time]) : null;
+    return { key: String(index), time, level: levelOf(row, fields.level), source: row };
+  });
+  const stored = panelSchema?.config?.logs_order;
+  const order: LogsOrder = LOGS_ORDERS.includes(stored) ? stored : DEFAULT_LOGS_ORDER;
+  const direction = order === "newest" ? -1 : 1;
+  rows.sort((a, b) => {
+    if (a.time === null || b.time === null) return a.time === null ? (b.time === null ? 0 : 1) : -1;
+    return (a.time - b.time) * direction;
+  });
+  return { rows, fields };
+};
diff --git a/web/src/utils/dashboard/convertPanelData.ts b/web/src/utils/dashboard/convertPanelData.ts
index d1d262065f..949d16533d 100644
--- a/web/src/utils/dashboard/convertPanelData.ts
+++ b/web/src/utils/dashboard/convertPanelData.ts
@@ -39,6 +39,8 @@ import { convertSunburstData } from "./convertSunburstData";
 import { convertFunnelData } from "./convertFunnelData";
 import { convertNodeGraphData } from "./convertNodeGraphData";
 import { convertFlameGraphPanelData } from "./convertFlameGraphPanelData";
+import { convertBoxplotData } from "./convertBoxplotData";
+import { convertLogsPanelData } from "./convertLogsPanelData";
 import { convertHostmapData } from "./convertHostmapData";
 /**
  * Converts panel data based on the panel schema and data.
@@ -214,6 +216,18 @@ export const convertPanelData = async (
         ...convertFlameGraphPanelData(panelSchema, data),
       };
     }
+    case "boxplot": {
+      return {
+        chartType: panelSchema.type,
+        ...convertBoxplotData(panelSchema, data, store, chartPanelRef),
+      };
+    }
+    case "logs": {
+      return {
+        chartType: panelSchema.type,
+        ...convertLogsPanelData(panelSchema, data, store),
+      };
+    }
     case "table": {
       // Check if PromQL query type
       if (panelSchema?.queryType == "promql") {
diff --git a/web/src/utils/dashboard/convertPromQLData.formulaLegend.spec.ts b/web/src/utils/dashboard/convertPromQLData.formulaLegend.spec.ts
index 1f7a38225b..376c3041a2 100644
--- a/web/src/utils/dashboard/convertPromQLData.formulaLegend.spec.ts
+++ b/web/src/utils/dashboard/convertPromQLData.formulaLegend.spec.ts
@@ -74,7 +74,10 @@ describe("convertPromQLData legend for label-less series", () => {
     ]);
   });
 
-  it("keeps a formula-free panel's names unchanged", async () => {
-    expect(await legendOf([{ ref: "A" }, { ref: "B" }])).toEqual(["{}", "{}"]);
+  it("names a formula-free panel's label-less series after its query", async () => {
+    expect(await legendOf([{ ref: "A" }, { ref: "B" }])).toEqual([
+      "sum(rate(x[5m]))",
+      "sum(rate(x[5m]))",
+    ]);
   });
 });
diff --git a/web/src/utils/dashboard/convertPromQLData.ts b/web/src/utils/dashboard/convertPromQLData.ts
index 4e72cedee2..147b4c8dd6 100644
--- a/web/src/utils/dashboard/convertPromQLData.ts
+++ b/web/src/utils/dashboard/convertPromQLData.ts
@@ -83,12 +83,16 @@ import {
   gaugeOverrideTooltip,
 } from "./seriesOverrides";
 import { applyChartStyleOptions } from "./seriesStyleOverrides";
-import { buildPromqlSeriesNames, getLegendPosition } from "./promql/shared/legendBuilder";
+import {
+  buildPromqlSeriesNames,
+  getLegendPosition,
+  labelFreeName,
+} from "./promql/shared/legendBuilder";
 import { getCachedSemanticGroups } from "@/utils/semanticGroupsCache";
 import { getPropsByChartTypeForSeries, getSeriesItemOpacity } from "./promqlChartSeriesProps";
 import { applyMeasuredYAxisLeftInset } from "./chartDimensionUtils";
 import { buildSeriesMarkLine } from "./promql/shared/markLines";
-import { legendFallbackOf } from "@/utils/dashboard/promql/formula";
+import { legendExprOf, legendFallbackOf } from "@/utils/dashboard/promql/formula";
 import { sortTooltipParams } from "./tooltipSort";
 import { fitStackedAxisBounds, stackTotalRows } from "./stackTotals";
 
@@ -179,6 +183,7 @@ const buildPromQLMetricCell = (
   panelSchema: MetricPanelSchema,
   seriesOverrides: ReturnType<typeof createSeriesOverrideLookup>,
   colors: MetricCellColors,
+  expr?: string,
 ): { cell: PromQLMetricCell; sparkline: MetricSparkline | null } => {
   const values = [...(metric?.values ?? (metric?.value ? [metric.value] : []))].sort(
     (a, b) => a[0] - b[0],
@@ -227,8 +232,12 @@ const buildPromQLMetricCell = (
       _metricName: name,
       _metricRaw: value,
       _metricRawValue: values.length > 0 ? value : null,
-      // A label-less result is named by its label dump "{}", which names nothing.
-      _metricStatName: label === "{}" ? "" : label,
+      // A label-less result is named by "{}" or its query text; under a single
+      // stat value that repeats the query, so it is left unnamed.
+      _metricStatName:
+        label === "{}" || (label === name && name === labelFreeName(metric?.metric, expr))
+          ? ""
+          : label,
       _metricSparkData: sparkline?.data ?? null,
       _metricSparkConfig: sparkline?.resolved ?? null,
     },
@@ -1058,6 +1067,7 @@ export const convertPromQLData = async (
       metrics: (it?.result ?? []).map((m: any) => m?.metric).filter(Boolean),
       template: panelSchema.queries?.[parentQueryIndex[index]]?.config?.promql_legend,
       fallback: legendFallbackOf(panelSchema.queries, parentQueryIndex[index]),
+      expr: legendExprOf(panelSchema.queries, metadata, parentQueryIndex[index]),
     })),
     getCachedSemanticGroups(store?.state?.selectedOrganization?.identifier ?? "") ?? [],
   );
@@ -1410,6 +1420,7 @@ export const convertPromQLData = async (
               panelSchema,
               seriesOverrides,
               metricColors,
+              legendExprOf(panelSchema.queries, metadata, parentQueryIndex[index]),
             ),
           );
       }
diff --git a/web/src/utils/dashboard/convertStateTimelineData.ts b/web/src/utils/dashboard/convertStateTimelineData.ts
index 7858c1b077..26a2a60ec5 100644
--- a/web/src/utils/dashboard/convertStateTimelineData.ts
+++ b/web/src/utils/dashboard/convertStateTimelineData.ts
@@ -26,7 +26,7 @@ import { getContrastColor } from "./chartColorUtils";
 import { getColorPalette, getGridLineStyle, getSeriesHash } from "./colorPalette";
 import { formatDate } from "./dateTimeUtils";
 import { buildPromqlSeriesNames } from "./promql/shared/legendBuilder";
-import { legendFallbackOf } from "./promql/formula";
+import { legendExprOf, legendFallbackOf } from "./promql/formula";
 import { buildValueMappingCache, lookupValueMappingFull } from "./tableConfigUtils";
 import { normalizeThresholds, resolveStepValues, stepColorFor } from "./thresholds";
 import { getAnnotationsData } from "./getAnnotationsData";
@@ -267,6 +267,7 @@ const promqlRows = (
       metrics: (entry?.result ?? []).map((m: any) => m?.metric).filter(Boolean),
       template: panelSchema.queries?.[queryIndexOf(index)]?.config?.promql_legend,
       fallback: legendFallbackOf(panelSchema.queries, queryIndexOf(index)),
+      expr: legendExprOf(panelSchema.queries, metadata, queryIndexOf(index)),
     })),
     getCachedSemanticGroups(store?.state?.selectedOrganization?.identifier ?? "") ?? [],
   );
diff --git a/web/src/utils/dashboard/dashboardAutoQueryBuilder.spec.ts b/web/src/utils/dashboard/dashboardAutoQueryBuilder.spec.ts
index 3838d1d804..629a3f6fa5 100644
--- a/web/src/utils/dashboard/dashboardAutoQueryBuilder.spec.ts
+++ b/web/src/utils/dashboard/dashboardAutoQueryBuilder.spec.ts
@@ -2182,6 +2182,81 @@ describe("dashboardAutoQueryBuilder", () => {
       expect(result).toContain("country");
       expect(result).toContain("name_alias");
     });
+
+    describe("WHERE clause with skipped conditions (issue 16022)", () => {
+      const cond = (operator: string, value: any, extra: any = {}) => ({
+        type: "condition",
+        values: [],
+        column: { field: "country", streamAlias: null },
+        operator,
+        value,
+        logicalOperator: "AND",
+        filterType: "condition",
+        ...extra,
+      });
+      const setConditions = (conditions: any[]) => {
+        mockDashboardPanelData.data.queries[0].fields.filter.conditions = conditions;
+      };
+
+      it("keeps a <> '' parsed from SQL and leaves no trailing AND", () => {
+        setConditions([cond("Is Not Null", null), cond("<>", "", { emptyLiteral: true })]);
+        expect(mapChart(mockDashboardPanelData)).toContain(
+          "WHERE country IS NOT NULL AND country <> '' GROUP BY",
+        );
+      });
+
+      it("keeps a lone <> '' parsed from SQL", () => {
+        setConditions([cond("<>", "", { emptyLiteral: true })]);
+        expect(mapChart(mockDashboardPanelData)).toContain("WHERE country <> '' GROUP BY");
+      });
+
+      it("keeps = '' parsed from SQL on a non-string column", () => {
+        setConditions([
+          { ...cond("=", "", { emptyLiteral: true }), column: { field: "id", streamAlias: null } },
+        ]);
+        expect(mapChart(mockDashboardPanelData)).toContain("WHERE id = '' GROUP BY");
+      });
+
+      it("skips an empty value not entered yet without a trailing AND", () => {
+        setConditions([cond("Is Not Null", null), cond("=", "")]);
+        const result = mapChart(mockDashboardPanelData);
+        expect(result).toContain("WHERE country IS NOT NULL GROUP BY");
+        expect(result).not.toMatch(/AND\s+GROUP BY/);
+      });
+
+      it("drops the WHERE clause when every condition is empty", () => {
+        setConditions([cond("=", "")]);
+        expect(mapChart(mockDashboardPanelData)).not.toContain("WHERE");
+      });
+
+      it("keeps each condition's own operator when a middle one is skipped", () => {
+        setConditions([
+          cond("=", "a"),
+          cond("=", ""),
+          { ...cond("=", "b"), logicalOperator: "OR" },
+        ]);
+        expect(mapChart(mockDashboardPanelData)).toContain(
+          "WHERE country = 'a' OR country = 'b' GROUP BY",
+        );
+      });
+
+      it("keeps each condition's own operator inside a group", () => {
+        setConditions([
+          {
+            filterType: "group",
+            logicalOperator: "AND",
+            conditions: [
+              cond("=", "a"),
+              { ...cond("=", ""), logicalOperator: "AND" },
+              { ...cond("=", "b"), logicalOperator: "OR" },
+            ],
+          },
+        ]);
+        expect(mapChart(mockDashboardPanelData)).toContain(
+          "WHERE (country = 'a' OR country = 'b') GROUP BY",
+        );
+      });
+    });
   });
 
   describe("geoMapChart", () => {
diff --git a/web/src/utils/dashboard/dashboardAutoQueryBuilder.ts b/web/src/utils/dashboard/dashboardAutoQueryBuilder.ts
index 78a5dc20b3..132d15988a 100644
--- a/web/src/utils/dashboard/dashboardAutoQueryBuilder.ts
+++ b/web/src/utils/dashboard/dashboardAutoQueryBuilder.ts
@@ -2,6 +2,7 @@ import { splitQuotedString, escapeSingleQuotes } from "@/utils/zincutils";
 import functionValidation from "@/components/dashboards/addPanel/dynamicFunction/functionValidation.json";
 import { DEFAULT_CAST_TARGET_TYPE, isCastTargetType } from "@/utils/dashboard/castSuggestion";
 import { DISTRIBUTION_ROW_LIMIT, isRawValueChart } from "@/utils/dashboard/chartTypeGroups";
+import { BOXPLOT_STATS, boxplotStatAlias } from "@/utils/dashboard/boxplotStats";
 import {
   heatmapYBucketError,
   heatmapYBucketing,
@@ -363,6 +364,8 @@ export function buildSQLChartQuery(config: {
     return "";
   }
 
+  if (chartType === "boxplot") return buildBoxplotStatsQuery(queryData, dashboardPanelData);
+
   const stream = queryData.fields.stream;
   const streamAlias = queryData?.joins?.length ? stream : "";
 
@@ -504,6 +507,40 @@ export function buildSQLChartQuery(config: {
   return query;
 }
 
+/** Double-quotes a stored identifier; an imported dashboard's alias or stream must not reach the SQL as syntax. */
+const quoteIdentifier = (name: unknown): string => `"${String(name).replace(/"/g, '""')}"`;
+
+/** A box plot's builder query: the y field's five-number summary per x category, over every matching row. */
+function buildBoxplotStatsQuery(queryData: any, dashboardPanelData: any): string {
+  const stream = queryData.fields.stream;
+  const streamAlias = queryData?.joins?.length ? stream : "";
+  const valueField = queryData.fields.y.find((field: any) => !field?.isDerived);
+  const value = valueField ? buildSQLQueryFromInput(valueField, streamAlias) : "";
+  if (!value) return "";
+  const category = queryData.fields.x.find((field: any) => !field?.isDerived);
+  const categorySql = category ? buildSQLQueryFromInput(category, streamAlias) : "";
+  const categoryAlias = categorySql ? quoteIdentifier(category.alias) : "";
+  const categoryExpr = categorySql ? `${categorySql} as ${categoryAlias}` : "";
+  const stats = BOXPLOT_STATS.map(
+    (stat) =>
+      `${stat.sql(value)} as ${quoteIdentifier(boxplotStatAlias(valueField.alias, stat.column))}`,
+  );
+
+  let query = `SELECT ${[categoryExpr, ...stats].filter(Boolean).join(", ")}`;
+  query += ` FROM ${quoteIdentifier(stream)} ${buildSQLJoinsFromInput(queryData.joins, streamAlias)}`;
+  query += buildWhereClause(queryData.fields.filter.conditions, dashboardPanelData);
+  if (categoryExpr) {
+    query += ` GROUP BY ${categoryAlias}`;
+    const direction = String(category.sortBy ?? "").toUpperCase();
+    if (["ASC", "DESC"].includes(direction)) query += ` ORDER BY ${categoryAlias} ${direction}`;
+  }
+  // A high-cardinality category must not return more boxes than a panel can draw.
+  const limit =
+    queryData.config.limit > 0 ? queryData.config.limit : categoryExpr ? DISTRIBUTION_ROW_LIMIT : 0;
+  if (limit) query += ` LIMIT ${limit}`;
+  return query;
+}
+
 /** The bucketed y SELECT expression and range condition for a heatmap whose y is a numeric column, "reject" when the settings must not run, or null when bucketing is off. */
 function heatmapYBucketPlan(
   config: { queryData: any; dashboardPanelData: any },
@@ -658,22 +695,8 @@ export const buildCondition = (condition: any, dashboardPanelData: any) => {
     : "";
 
   if (condition.filterType === "group") {
-    const groupConditions = condition.conditions
-      .map((condition: any) => buildCondition(condition, dashboardPanelData))
-      .filter(Boolean);
-    const logicalOperators = condition.conditions
-      .map((c: any) => c.logicalOperator)
-      .filter(Boolean);
-
-    let groupQuery = "";
-    groupConditions.forEach((c: any, index: any) => {
-      if (index > 0) {
-        groupQuery += ` ${logicalOperators[index]} `;
-      }
-      groupQuery += c;
-    });
-
-    return groupConditions.length ? `(${groupQuery})` : "";
+    const groupQuery = joinConditions(condition.conditions, dashboardPanelData);
+    return groupQuery ? `(${groupQuery})` : "";
   } else if (condition.type === "list" && condition.values?.length > 0) {
     const fieldRef = streamAlias
       ? `${streamAlias}.${condition.column.field}`
@@ -740,7 +763,11 @@ export const buildCondition = (condition: any, dashboardPanelData: any) => {
         condition.column,
         dashboardPanelData,
       )})`;
-    } else if (condition.value != null && condition.value !== "") {
+    } else if (
+      (condition.value != null && condition.value !== "") ||
+      // `x <> ''` parsed from SQL is a real filter, unlike a value not entered yet
+      (condition.emptyLiteral && condition.value === "" && ["=", "<>"].includes(condition.operator))
+    ) {
       const fieldRef = streamAlias
         ? `${streamAlias}.${condition.column.field}`
         : condition.column.field;
@@ -752,11 +779,12 @@ export const buildCondition = (condition: any, dashboardPanelData: any) => {
         case ">":
         case "<=":
         case ">=":
-          selectFilter += `${condition.operator} ${formatValue(
-            condition.value,
-            condition.column,
-            dashboardPanelData,
-          )}`;
+          // formatValue leaves "" unquoted on a non-string column
+          selectFilter += `${condition.operator} ${
+            condition.value === ""
+              ? "''"
+              : formatValue(condition.value, condition.column, dashboardPanelData)
+          }`;
           break;
         case "Not Contains":
           selectFilter += `NOT LIKE '%${escapeSingleQuotes(condition.value)}%'`;
@@ -788,27 +816,28 @@ export const buildCondition = (condition: any, dashboardPanelData: any) => {
  * @returns {string} - the WHERE clause as a string.
  */
 const buildWhereClause = (filterData: any, dashboardPanelData: any) => {
-  const whereConditions = filterData
-    ?.map((condition: any) => buildCondition(condition, dashboardPanelData))
-    ?.filter(Boolean);
-
-  const logicalOperators = filterData.map((it: any) => it.logicalOperator);
-  if (whereConditions.length > 0) {
-    return ` WHERE ${whereConditions
-      .map((cond: any, index: any) => {
-        const logicalOperator =
-          index < logicalOperators.length && logicalOperators[index + 1]
-            ? logicalOperators[index + 1]
-            : "";
-
-        return index < logicalOperators.length ? `${cond} ${logicalOperator}` : cond;
-      })
-      .join(" ")}`;
-  }
-
-  return "";
+  const whereQuery = joinConditions(filterData, dashboardPanelData);
+  return whereQuery ? ` WHERE ${whereQuery}` : "";
 };
 
+/**
+ * Join conditions with their logical operators. A condition's logicalOperator
+ * joins it to the condition before it, so each condition is paired with its own
+ * operator before empty ones are dropped; dropping first shifts the operators
+ * and can leave a trailing AND.
+ */
+const joinConditions = (conditions: any[], dashboardPanelData: any): string =>
+  (conditions ?? [])
+    .map((condition: any) => ({
+      sql: buildCondition(condition, dashboardPanelData),
+      logicalOperator: condition?.logicalOperator || "AND",
+    }))
+    .filter((part: any) => part.sql)
+    .map((part: any, index: number) =>
+      index === 0 ? part.sql : `${part.logicalOperator} ${part.sql}`,
+    )
+    .join(" ");
+
 export const mapChart = (dashboardPanelData: any) => {
   const queryData = dashboardPanelData.data.queries[dashboardPanelData.layout.currentQueryIndex];
   const { name, value_for_maps } = queryData.fields;
diff --git a/web/src/utils/dashboard/defaultFields.spec.ts b/web/src/utils/dashboard/defaultFields.spec.ts
index 8e40ad4b73..e8061fad54 100644
--- a/web/src/utils/dashboard/defaultFields.spec.ts
+++ b/web/src/utils/dashboard/defaultFields.spec.ts
@@ -348,4 +348,45 @@ describe("defaultFields", () => {
       });
     });
   });
+
+  describe("buildDefaultBuilderFields for box plot", () => {
+    const logsSchema = [{ name: "logs", schema: [{ name: "_timestamp" }] }];
+
+    it("seeds nothing without a numeric column", () => {
+      expect(buildDefaultBuilderFields("boxplot", "logs", logsSchema, "logs")).toEqual({
+        x: [],
+        y: [],
+      });
+    });
+
+    it("starts from the first numeric column that is not a timestamp", () => {
+      const schema = [
+        {
+          name: "demo_app",
+          schema: [
+            { name: "_timestamp", type: "Int64" },
+            { name: "ts", type: "Int64" },
+            { name: "host", type: "Utf8" },
+            { name: "enabled", type: "Boolean" },
+            { name: "latency_ms", type: "Float64" },
+            { name: "bytes", type: "Int64" },
+          ],
+        },
+        { name: "other", schema: [{ name: "first", type: "Int64" }] },
+      ];
+      const { x, y } = buildDefaultBuilderFields("boxplot", "logs", schema, "demo_app", "ts");
+      expect(x).toEqual([]);
+      expect(y).toHaveLength(1);
+      expect(y[0]).toMatchObject({
+        alias: "y_axis_1",
+        column: "latency_ms",
+        functionName: null,
+        args: [{ type: "field", value: { field: "latency_ms" } }],
+      });
+      expect(firstNumericField(schema, "other")).toBe("first");
+      expect(
+        firstNumericField([{ name: "s", schema: [{ name: "_timestamp", type: "Int64" }] }]),
+      ).toBeNull();
+    });
+  });
 });
diff --git a/web/src/utils/dashboard/defaultFields.ts b/web/src/utils/dashboard/defaultFields.ts
index da987e18a3..bb6c327a83 100644
--- a/web/src/utils/dashboard/defaultFields.ts
+++ b/web/src/utils/dashboard/defaultFields.ts
@@ -159,6 +159,7 @@ export const SKIP_SEED_TYPES = [
   "heatmap",
   "alert-list",
   "flame-graph",
+  "logs",
 ];
 
 /**
@@ -193,6 +194,11 @@ export const buildDefaultBuilderFields = (
   if (chartType === "sunburst") return { x: [], y };
   // One stage per label, so a time bucket is not a useful default label.
   if (chartType === "funnel") return { x: [], y };
+  // A box plot summarises a numeric column, so it starts from one, never a count or the timestamp.
+  if (chartType === "boxplot") {
+    const column = firstNumericField(groupedFields, streamName, timestampColumn);
+    return { x: [], y: column ? [rawValueYField(column)] : [] };
+  }
   // A time bucket is not an entity; the user picks the entity field.
   if (chartType === "hostmap") return { x: [], y };
   return { x, y };
diff --git a/web/src/utils/dashboard/panelValidation.spec.ts b/web/src/utils/dashboard/panelValidation.spec.ts
index a7e3cacc08..334c3d8b9b 100644
--- a/web/src/utils/dashboard/panelValidation.spec.ts
+++ b/web/src/utils/dashboard/panelValidation.spec.ts
@@ -694,12 +694,18 @@ describe("validatePanel on metric, gauge, pie, table, heatmap, state timeline an
   it("rejects out-of-range numbers", () => {
     expect(run("gauge", { gauge_segments: 1 })).toEqual([
       gt("dashboard.utils.configValueOutOfRange", {
-        setting: "gauge_segments",
+        setting: gt("dashboard.gaugeSegments"),
         min: "2",
         max: "100",
       }),
     ]);
-    expect(run("donut", { donut_inner_radius: 99 })).toHaveLength(1);
+    expect(run("donut", { donut_inner_radius: 99 })).toEqual([
+      gt("dashboard.utils.configValueOutOfRange", {
+        setting: gt("dashboard.donutInnerRadius"),
+        min: "0",
+        max: "95",
+      }),
+    ]);
     expect(run("pie", { pie_other_threshold: -1 })).toHaveLength(1);
     expect(run("metric", { value_font_size: 0 })).toHaveLength(1);
     expect(run("geomap", { map_cluster_radius: 0 })).toHaveLength(1);
@@ -1498,3 +1504,153 @@ describe("validatePanel on node graph", () => {
     expect(errors.filter((error) => /unsupported|not supported/i.test(error))).toEqual([]);
   });
 });
+
+describe("validatePanel on box plot", () => {
+  const field = (alias: string) => ({
+    alias,
+    column: alias,
+    label: alias,
+    type: "raw",
+    rawQuery: alias,
+  });
+  const run = (fields: any, config: any = {}, queryType = "sql") => {
+    const errors: string[] = [];
+    validatePanel(
+      gt,
+      {
+        data: {
+          type: "boxplot",
+          queryType,
+          config,
+          queries: [
+            {
+              customQuery: queryType === "promql",
+              query: "SELECT 1",
+              fields: { x: [], y: [], breakdown: [], z: [], ...fields },
+            },
+          ],
+        },
+        layout: { currentQueryIndex: 0 },
+      },
+      errors,
+      true,
+      [],
+      "dashboard",
+      { state: { zoConfig: {} } },
+      () => true,
+    );
+    return errors;
+  };
+
+  it("accepts one y field with at most one x category", () => {
+    expect(run({ y: [field("latency")] })).toEqual([]);
+    expect(run({ x: [field("service")], y: [field("latency")] })).toEqual([]);
+  });
+
+  it("rejects a second x field or a missing y field", () => {
+    expect(run({ x: [field("a"), field("b")], y: [field("v")] })[0]).toMatch(/at most one field/);
+    expect(run({ y: [] })).toHaveLength(1);
+  });
+
+  it("does not allow box plot on PromQL", () => {
+    expect(run({}, {}, "promql")).toContain(gt("dashboard.utils.promqlChartTypeUnsupported"));
+  });
+
+  it("checks the allowed whisker values", () => {
+    expect(run({ y: [field("v")] }, { boxplot_whisker: "iqr" })).toEqual([]);
+    expect(run({ y: [field("v")] }, { boxplot_whisker: "p99" })).toHaveLength(1);
+  });
+
+  it("lists box plot as an importable panel type", () => {
+    const errors = validateDashboardJson(gt, {
+      dashboardId: "d",
+      title: "t",
+      tabs: [
+        {
+          tabId: "default",
+          name: "Default",
+          panels: [{ type: "boxplot", id: "p", title: "t", layout: { x: 0, y: 0, w: 1, h: 1 } }],
+        },
+      ],
+    });
+    expect(errors.filter((error) => /unsupported|not supported/i.test(error))).toEqual([]);
+  });
+});
+
+describe("validatePanel on logs", () => {
+  const run = (
+    query: Partial<{ query: string; customQuery: boolean }>,
+    config: any = {},
+    queryType = "sql",
+  ) => {
+    const errors: string[] = [];
+    validatePanel(
+      gt,
+      {
+        data: {
+          type: "logs",
+          queryType,
+          config,
+          queries: [
+            {
+              query: "",
+              customQuery: false,
+              fields: { x: [], y: [], breakdown: [], z: [] },
+              ...query,
+            },
+          ],
+        },
+        layout: { currentQueryIndex: 0 },
+      },
+      errors,
+      true,
+      [],
+      "dashboard",
+      { state: { zoConfig: {} } },
+      () => true,
+    );
+    return errors;
+  };
+  const sql = { customQuery: true, query: 'SELECT * FROM "demo_app"' };
+
+  it("needs a query but asks for no builder fields", () => {
+    expect(run(sql)).toEqual([]);
+    expect(run({ customQuery: true, query: "" })).toEqual([
+      gt("dashboard.utils.queryIsEmpty", { index: 1 }),
+    ]);
+  });
+
+  it("checks the allowed values of the order key", () => {
+    expect(run(sql, { logs_order: "oldest" })).toEqual([]);
+    expect(run(sql, { logs_order: "random" })).toHaveLength(1);
+  });
+
+  it("is not allowed on PromQL", () => {
+    expect(run({ customQuery: true, query: "up" }, {}, "promql")).toContain(
+      gt("dashboard.utils.promqlChartTypeUnsupported"),
+    );
+  });
+
+  it("is an importable panel type", () => {
+    const errors = validateDashboardJson(gt, {
+      dashboardId: "d",
+      title: "t",
+      tabs: [
+        {
+          tabId: "default",
+          name: "Default",
+          panels: [
+            {
+              type: "logs",
+              id: "p-logs",
+              title: "t",
+              layout: { x: 0, y: 0, w: 1, h: 1, i: "logs" },
+              queries: [{ query: "SELECT 1", customQuery: true, fields: {} }],
+            },
+          ],
+        },
+      ],
+    });
+    expect(errors.filter((error) => /unsupported|not supported/i.test(error))).toEqual([]);
+  });
+});
diff --git a/web/src/utils/dashboard/panelValidation.ts b/web/src/utils/dashboard/panelValidation.ts
index a976bb8b35..85d9f7b571 100644
--- a/web/src/utils/dashboard/panelValidation.ts
+++ b/web/src/utils/dashboard/panelValidation.ts
@@ -1,4 +1,4 @@
-import type { TranslateFn } from "@/types/i18n";
+import type { I18nKey, TranslateFn } from "@/types/i18n";
 import { CURRENT_DASHBOARD_SCHEMA_VERSION } from "@/utils/dashboard/convertDashboardSchemaVersion";
 import functionValidation from "@/components/dashboards/addPanel/dynamicFunction/functionValidation.json";
 import { isFormulaQuery } from "@/utils/dashboard/promql/formula";
@@ -38,6 +38,8 @@ import {
   ALERT_LIST_SORTS,
   ALERT_LIST_STATES,
 } from "@/utils/dashboard/alertListPanel";
+import { BOXPLOT_WHISKERS } from "@/utils/dashboard/convertBoxplotData";
+import { LOGS_ORDERS } from "@/utils/dashboard/convertLogsPanelData";
 import { HOSTMAP_MAX_GROUP_LEVELS } from "@/utils/dashboard/convertHostmapData";
 import { STATE_TIMELINE_DISPLAYS } from "@/utils/dashboard/convertStateTimelineData";
 import { TREEMAP_MAX_LEVELS, TREEMAP_SIZE_FUNCTIONS } from "@/utils/dashboard/convertTreemapData";
@@ -623,6 +625,24 @@ const validateChartFieldsConfiguration = (
       }
       break;
     }
+    case "boxplot": {
+      if (fields?.y?.length !== 1) {
+        const errorMsg =
+          pageKey === "logs"
+            ? t("dashboard.utils.unableToExtractValueField")
+            : t("dashboard.utils.addOneFieldFor", { label: yAxisLabel });
+        errors.push(errorMsg);
+      }
+      if (fields?.x?.length > 1) {
+        const errorMsg =
+          pageKey === "logs"
+            ? t("dashboard.utils.unableToExtractGroupingField")
+            : t("dashboard.utils.addAtMostOneFieldFor", { label: xAxisLabel });
+        errors.push(errorMsg);
+      }
+      break;
+    }
+
     case "hostmap": {
       if (fields?.y?.length !== 1) {
         const errorMsg =
@@ -872,6 +892,7 @@ const validatePanelContentByType = (t: TranslateFn, panel: any, errors: string[]
       );
       break;
     case "flame-graph":
+    case "logs":
       validateQueriesNotEmpty(t, [panel?.queries?.[0]], errors);
       break;
   }
@@ -1022,6 +1043,7 @@ const validatePanelContent = (t: TranslateFn, panel: any): string[] => {
     "h-stacked",
     "heatmap",
     "state-timeline",
+    "boxplot",
     "distribution",
     "treemap",
     "sunburst",
@@ -1040,6 +1062,7 @@ const validatePanelContent = (t: TranslateFn, panel: any): string[] => {
     "markdown",
     "alert-list",
     "flame-graph",
+    "logs",
   ];
 
   if (!allowedTypes.includes(panel?.type)) {
@@ -1219,6 +1242,8 @@ const PANEL_TYPE_CHOICE_KEYS: ReadonlyArray<[string, string[], readonly unknown[
   ["bar_gauge_orientation", ["bar-gauge"], BAR_GAUGE_ORIENTATIONS],
   ["state_timeline_display", ["state-timeline"], STATE_TIMELINE_DISPLAYS],
   ["sort_order", ["pie", "donut"], SORT_ORDERS],
+  ["boxplot_whisker", ["boxplot"], BOXPLOT_WHISKERS],
+  ["logs_order", ["logs"], LOGS_ORDERS],
   ["funnel_sort", ["funnel"], FUNNEL_SORTS],
   ["funnel_orient", ["funnel"], FUNNEL_ORIENTS],
   ["node_graph_layout", ["node-graph"], NODE_GRAPH_LAYOUTS],
@@ -1231,17 +1256,31 @@ const PANEL_TYPE_LIST_KEYS: ReadonlyArray<[string, string[], readonly unknown[]]
   ["alert_list_state", ["alert-list"], ALERT_LIST_STATES],
 ];
 
-// [key, chart types, lowest allowed, highest allowed, lowest is exclusive]
-const PANEL_TYPE_RANGE_KEYS: ReadonlyArray<[string, string[], number, number, boolean]> = [
-  ["value_font_size", ["metric"], 0, Infinity, true],
-  ["gauge_segments", ["gauge"], 2, 100, false],
-  ["pie_other_threshold", ["pie", "donut"], 0, 100, false],
-  ["donut_inner_radius", ["donut"], 0, 95, false],
-  ["heatmap_cell_gap", ["heatmap"], 0, Infinity, false],
-  ["map_cluster_radius", ["geomap"], 0, Infinity, true],
-  ["distribution_bucket_count", ["distribution"], 1, DISTRIBUTION_MAX_BUCKETS, false],
-  ["distribution_bucket_size", ["distribution"], 0, Infinity, true],
-  ["alert_list_max", ["alert-list"], 1, ALERT_LIST_MAX_LIMIT, false],
+// [key, label, chart types, lowest allowed, highest allowed, lowest is exclusive]
+const PANEL_TYPE_RANGE_KEYS: ReadonlyArray<[string, I18nKey, string[], number, number, boolean]> = [
+  ["value_font_size", "dashboard.valueFontSize", ["metric"], 0, Infinity, true],
+  ["gauge_segments", "dashboard.gaugeSegments", ["gauge"], 2, 100, false],
+  ["pie_other_threshold", "dashboard.pieOtherThreshold", ["pie", "donut"], 0, 100, false],
+  ["donut_inner_radius", "dashboard.donutInnerRadius", ["donut"], 0, 95, false],
+  ["heatmap_cell_gap", "dashboard.heatmapCellGap", ["heatmap"], 0, Infinity, false],
+  ["map_cluster_radius", "dashboard.mapClusterRadius", ["geomap"], 0, Infinity, true],
+  [
+    "distribution_bucket_count",
+    "dashboard.distributionBucketCount",
+    ["distribution"],
+    1,
+    DISTRIBUTION_MAX_BUCKETS,
+    false,
+  ],
+  [
+    "distribution_bucket_size",
+    "dashboard.distributionBucketSize",
+    ["distribution"],
+    0,
+    Infinity,
+    true,
+  ],
+  ["alert_list_max", "dashboard.alertListMax", ["alert-list"], 1, ALERT_LIST_MAX_LIMIT, false],
 ];
 
 const validatePanelTypeChoices = (t: TranslateFn, panel: any, errors: string[]) => {
@@ -1266,14 +1305,14 @@ const validatePanelTypeChoices = (t: TranslateFn, panel: any, errors: string[])
 
 const validatePanelTypeRanges = (t: TranslateFn, panel: any, errors: string[]) => {
   const config = panel.config;
-  for (const [key, types, min, max, exclusive] of PANEL_TYPE_RANGE_KEYS) {
+  for (const [key, label, types, min, max, exclusive] of PANEL_TYPE_RANGE_KEYS) {
     if (!types.includes(panel.type) || !isSetValue(config[key])) continue;
     const value = asFiniteNumber(config[key]);
     const tooLow = value === null || (exclusive ? value <= min : value < min);
     if (tooLow || (value as number) > max) {
       errors.push(
         t("dashboard.utils.configValueOutOfRange", {
-          setting: key,
+          setting: t(label),
           min: exclusive ? `> ${min}` : String(min),
           max: Number.isFinite(max) ? String(max) : "∞",
         }),
diff --git a/web/src/utils/dashboard/promql/formula.spec.ts b/web/src/utils/dashboard/promql/formula.spec.ts
index 9ddc53eb42..21ace7b395 100644
--- a/web/src/utils/dashboard/promql/formula.spec.ts
+++ b/web/src/utils/dashboard/promql/formula.spec.ts
@@ -21,6 +21,7 @@ import {
   isFormulaQuery,
   queryRefs,
   substituteFormula,
+  legendExprOf,
 } from "./formula";
 
 const ERR_RATE = 'sum by (job)(rate(http_requests_total{code=~"5.."}[5m]))';
@@ -212,3 +213,16 @@ describe("legendFallbackOf", () => {
     expect(legendFallbackOf(undefined, 0)).toBeUndefined();
   });
 });
+
+describe("legendExprOf", () => {
+  const queries = [{ query: 'avg(up{ns="$ns"})' }];
+
+  it("prefers the query as sent, with variables filled in", () => {
+    const metadata = { queries: [{ panelQueryIndex: 0, query: 'avg(up{ns="prod"})' }] };
+    expect(legendExprOf(queries, metadata, 0)).toBe('avg(up{ns="prod"})');
+  });
+
+  it("falls back to the saved query without metadata", () => {
+    expect(legendExprOf(queries, null, 0)).toBe('avg(up{ns="$ns"})');
+  });
+});
diff --git a/web/src/utils/dashboard/promql/formula.ts b/web/src/utils/dashboard/promql/formula.ts
index 66f5231871..2ee920a532 100644
--- a/web/src/utils/dashboard/promql/formula.ts
+++ b/web/src/utils/dashboard/promql/formula.ts
@@ -139,6 +139,15 @@ export const substituteFormula = (
   return { expr: expr + formula.slice(last) };
 };
 
+/** A query's text for naming a label-free series: as sent, with dashboard variables filled in. */
+export const legendExprOf = (
+  queries: any[] | undefined,
+  metadata: any,
+  index: number,
+): string | undefined =>
+  metadata?.queries?.find((meta: any) => meta?.panelQueryIndex === index && meta?.query)?.query ??
+  queries?.[index]?.query;
+
 /** Inputs get their letter only beside a formula, so formula-free panels keep today's legends. */
 export const legendFallbackOf = (queries: any[] | undefined, index: number): string | undefined => {
   const query = queries?.[index];
diff --git a/web/src/utils/dashboard/promql/shared/dataProcessor.ts b/web/src/utils/dashboard/promql/shared/dataProcessor.ts
index 809e45654a..3143bc19cf 100644
--- a/web/src/utils/dashboard/promql/shared/dataProcessor.ts
+++ b/web/src/utils/dashboard/promql/shared/dataProcessor.ts
@@ -69,6 +69,7 @@ export async function processPromQLData(
         .filter(Boolean),
       template: panelSchema.queries?.[queryIndexOf(index)]?.config?.promql_legend,
       fallback: legendFallbackOf(panelSchema.queries, queryIndexOf(index)),
+      expr: panelSchema.queries?.[queryIndexOf(index)]?.query,
     })),
     getCachedSemanticGroups(store?.state?.selectedOrganization?.identifier ?? "") ?? [],
   );
diff --git a/web/src/utils/dashboard/promql/shared/legendBuilder.spec.ts b/web/src/utils/dashboard/promql/shared/legendBuilder.spec.ts
index fad3bf96ae..362b7b6186 100644
--- a/web/src/utils/dashboard/promql/shared/legendBuilder.spec.ts
+++ b/web/src/utils/dashboard/promql/shared/legendBuilder.spec.ts
@@ -20,6 +20,7 @@ import {
   getPreferredLabels,
   buildPromqlSeriesNames,
   getLegendPosition,
+  labelFreeName,
 } from "./legendBuilder";
 
 describe("legendBuilder", () => {
@@ -630,3 +631,42 @@ describe("getPromqlLegendName — empty label sets", () => {
     expect(getPromqlLegendName({}, "", "")).toBe("{}");
   });
 });
+
+describe("label-free series name (issue 16022)", () => {
+  it("names a series with no labels by its query", () => {
+    const metric = {};
+    const names = buildPromqlSeriesNames([{ metrics: [metric], expr: "avg(node_load1{})" }]);
+    expect(names.get(metric)).toBe("avg(node_load1{})");
+  });
+
+  it("keeps label-based names when the series has labels", () => {
+    const metrics = [{ job: "a" }, { job: "b" }];
+    const names = buildPromqlSeriesNames([{ metrics, expr: "sum by (job) (up)" }]);
+    expect(metrics.map((m) => names.get(m))).toEqual(["a", "b"]);
+  });
+
+  it("keeps an explicit fallback over the query", () => {
+    const metric = {};
+    const names = buildPromqlSeriesNames([{ metrics: [metric], fallback: "A", expr: "avg(up)" }]);
+    expect(names.get(metric)).toBe("A");
+  });
+
+  it("uses the legend template when one is set", () => {
+    const metric = {};
+    const names = buildPromqlSeriesNames([{ metrics: [metric], template: "CPU", expr: "avg(up)" }]);
+    expect(names.get(metric)).toBe("CPU");
+  });
+
+  it("shortens long queries and collapses whitespace", () => {
+    const expr = `avg(\n  rate(${"x".repeat(80)}[5m])\n)`;
+    const name = labelFreeName({}, expr)!;
+    expect(name.endsWith("...")).toBe(true);
+    expect(name.length).toBe(63);
+    expect(name).not.toContain("\n");
+  });
+
+  it("returns undefined without a query or with labels", () => {
+    expect(labelFreeName({}, "")).toBeUndefined();
+    expect(labelFreeName({ job: "a" }, "up")).toBeUndefined();
+  });
+});
diff --git a/web/src/utils/dashboard/promql/shared/legendBuilder.ts b/web/src/utils/dashboard/promql/shared/legendBuilder.ts
index 52fefdba09..aafb5b2b69 100644
--- a/web/src/utils/dashboard/promql/shared/legendBuilder.ts
+++ b/web/src/utils/dashboard/promql/shared/legendBuilder.ts
@@ -230,6 +230,20 @@ export const getPromqlLegendName = (
   }
 };
 
+const MAX_EXPR_LEGEND = 60;
+
+/**
+ * A query that aggregates every label away (`avg(up)`) returns a series with no
+ * labels, which would otherwise read "{}". The query text names it instead.
+ * Series that carry labels keep their label-based names.
+ */
+export const labelFreeName = (metric: any, expr?: string): string | undefined => {
+  if (!metric || typeof metric !== "object" || Object.keys(metric).length) return undefined;
+  const text = expr?.replace(/\s+/g, " ").trim();
+  if (!text) return undefined;
+  return text.length > MAX_EXPR_LEGEND ? `${text.slice(0, MAX_EXPR_LEGEND)}...` : text;
+};
+
 /**
  * Names every series in a panel at once, so series that would otherwise share a
  * name can be told apart.
@@ -248,16 +262,18 @@ export const getPromqlLegendName = (
  * Returns a Map keyed by the metric object each series was built from.
  */
 export const buildPromqlSeriesNames = (
-  queries: { metrics: any[]; template?: string; fallback?: string }[],
+  queries: { metrics: any[]; template?: string; fallback?: string; expr?: string }[],
   semanticGroups: FieldAlias[] = [],
 ): Map<any, string> => {
   const names = new Map<any, string>();
+  const fallbackOf = (query: { fallback?: string; expr?: string }, metric: any) =>
+    query.fallback ?? labelFreeName(metric, query.expr);
 
   // A templated query names itself and takes no part in the shared vocabulary.
   const templated = queries.filter((q) => q.template);
   for (const query of templated) {
     for (const metric of query.metrics) {
-      names.set(metric, getPromqlLegendName(metric, query.template!, query.fallback));
+      names.set(metric, getPromqlLegendName(metric, query.template!, fallbackOf(query, metric)));
     }
   }
 
@@ -281,7 +297,7 @@ export const buildPromqlSeriesNames = (
 
   const fallbackFor = new Map<any, string | undefined>();
   for (const query of auto)
-    for (const metric of query.metrics) fallbackFor.set(metric, query.fallback);
+    for (const metric of query.metrics) fallbackFor.set(metric, fallbackOf(query, metric));
 
   for (const metric of allMetrics) {
     names.set(metric, getPromqlLegendName(metric, "", fallbackFor.get(metric), varying, preferred));
diff --git a/web/src/utils/dashboard/searchLabelsConfig.spec.ts b/web/src/utils/dashboard/searchLabelsConfig.spec.ts
index ca33703e44..cafa8956e5 100644
--- a/web/src/utils/dashboard/searchLabelsConfig.spec.ts
+++ b/web/src/utils/dashboard/searchLabelsConfig.spec.ts
@@ -46,6 +46,7 @@ describe("searchLabelsConfig", () => {
     "sparkline",
     "alertList",
     "flameGraph",
+    "logs",
   ] as const;
 
   describe("ORDERED_SECTION_IDS", () => {
diff --git a/web/src/utils/dashboard/searchLabelsConfig.ts b/web/src/utils/dashboard/searchLabelsConfig.ts
index d66550a341..956714649f 100644
--- a/web/src/utils/dashboard/searchLabelsConfig.ts
+++ b/web/src/utils/dashboard/searchLabelsConfig.ts
@@ -42,6 +42,7 @@ const SECTION_DEFS = [
   { id: "sparkline", icon: "show-chart" },
   { id: "alertList", icon: "notifications" },
   { id: "flameGraph", icon: "local-fire-department" },
+  { id: "logs", icon: "article" },
 ] as const satisfies ReadonlyArray<SectionDef>;
 
 export type SectionId = (typeof SECTION_DEFS)[number]["id"];
diff --git a/web/src/utils/dashboard/visualizeEmptyFilter.spec.ts b/web/src/utils/dashboard/visualizeEmptyFilter.spec.ts
new file mode 100644
index 0000000000..2efa1dc6a7
--- /dev/null
+++ b/web/src/utils/dashboard/visualizeEmptyFilter.spec.ts
@@ -0,0 +1,91 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect } from "vitest";
+import { mapChart } from "./dashboardAutoQueryBuilder";
+import { parseWhereClauseToFilter } from "@/utils/query/sqlUtils";
+
+// SQL -> builder filter -> SQL, with the real parser (issue 16022).
+const panel = (conditions: any[]) => ({
+  data: {
+    queries: [
+      {
+        fields: {
+          stream: "logs",
+          name: {
+            alias: "n",
+            column: "service_name",
+            functionName: null,
+            args: [{ type: "field", value: { field: "service_name" } }],
+          },
+          value_for_maps: {
+            alias: "cnt",
+            column: "count",
+            functionName: "count",
+            args: [{ type: "field", value: { field: "id" } }],
+          },
+          filter: { conditions },
+        },
+        joins: [],
+        config: { limit: 100 },
+      },
+    ],
+  },
+  layout: { currentQueryIndex: 0 },
+  meta: {
+    streamFields: {
+      groupedFields: [
+        {
+          stream_alias: null,
+          schema: [
+            { name: "service_name", type: "Utf8" },
+            { name: "id", type: "Int64" },
+          ],
+        },
+      ],
+    },
+  },
+});
+
+const roundTrip = async (where: string) => {
+  const filter = await parseWhereClauseToFilter(where);
+  return mapChart(panel(filter.conditions));
+};
+
+describe("Visualize keeps empty-string filters from SQL", () => {
+  it("keeps != '' after IS NOT NULL", async () => {
+    expect(await roundTrip("service_name IS NOT NULL AND service_name != ''")).toContain(
+      "WHERE service_name IS NOT NULL AND service_name <> '' GROUP BY",
+    );
+  });
+
+  it("keeps a lone != ''", async () => {
+    expect(await roundTrip("service_name != ''")).toContain("WHERE service_name <> '' GROUP BY");
+  });
+
+  it("keeps = ''", async () => {
+    expect(await roundTrip("service_name = ''")).toContain("WHERE service_name = '' GROUP BY");
+  });
+
+  it("does not flag a range comparison with ''", async () => {
+    const filter = await parseWhereClauseToFilter("service_name > ''");
+    expect(filter.conditions[0].emptyLiteral).toBeUndefined();
+  });
+
+  it("does not flag a non-empty literal", async () => {
+    const filter = await parseWhereClauseToFilter("service_name != 'api'");
+    expect(filter.conditions[0].emptyLiteral).toBeUndefined();
+  });
+});
diff --git a/web/src/utils/query/quickModeFieldList.spec.ts b/web/src/utils/query/quickModeFieldList.spec.ts
index 95f93c2d58..3a18613cdd 100644
--- a/web/src/utils/query/quickModeFieldList.spec.ts
+++ b/web/src/utils/query/quickModeFieldList.spec.ts
@@ -14,7 +14,11 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { describe, it, expect } from "vitest";
-import { hasSubquery, replaceSelectFieldList } from "./quickModeFieldList";
+import {
+  quickModeHiddenFieldCount,
+  hasSubquery,
+  replaceSelectFieldList,
+} from "./quickModeFieldList";
 
 describe("replaceSelectFieldList", () => {
   describe("queries containing a subquery are left alone", () => {
@@ -133,3 +137,41 @@ limit 10`;
     });
   });
 });
+
+describe("quickModeHiddenFieldCount", () => {
+  const streamFields = [
+    { name: "app", label: true },
+    { name: "_timestamp", isSchemaField: true },
+    { name: "level", isSchemaField: true },
+    { name: "message", isSchemaField: true },
+    { name: "_all", isSchemaField: true },
+    { name: "extracted", isSchemaField: false },
+  ];
+  const state = {
+    quickMode: true,
+    sqlMode: false,
+    streamCount: 1,
+    interestingFields: ["level"],
+    streamFields,
+    allFieldsName: "_all",
+  };
+  const row = { _timestamp: 1, level: "info" };
+
+  it("counts the fields a quick-mode row shows", () => {
+    expect(quickModeHiddenFieldCount(row, state)).toEqual({ shown: 2, total: 3 });
+  });
+
+  it("returns null when the row has every field", () => {
+    expect(quickModeHiddenFieldCount({ ...row, message: "m" }, state)).toBeNull();
+  });
+
+  it.each([
+    ["quick mode off", { quickMode: false }],
+    ["SQL mode", { sqlMode: true }],
+    ["several streams", { streamCount: 2 }],
+    ["no interesting fields", { interestingFields: [] }],
+    ["no schema loaded", { streamFields: [] }],
+  ])("returns null with %s", (_name, patch) => {
+    expect(quickModeHiddenFieldCount(row, { ...state, ...patch })).toBeNull();
+  });
+});
diff --git a/web/src/utils/query/quickModeFieldList.ts b/web/src/utils/query/quickModeFieldList.ts
index 586f6571b3..400da9ca81 100644
--- a/web/src/utils/query/quickModeFieldList.ts
+++ b/web/src/utils/query/quickModeFieldList.ts
@@ -130,3 +130,32 @@ export const replaceSelectFieldList = (query: string, fieldList: string): string
 };
 
 export default replaceSelectFieldList;
+
+/**
+ * Quick mode selects only the interesting fields, so an expanded log row has
+ * fewer fields than the stream. Returns the counts for a hint, or null when the
+ * row was fetched with every field (quick mode off, SQL mode, several streams or
+ * no interesting fields) or already shows them all.
+ */
+export const quickModeHiddenFieldCount = (
+  row: Record<string, any> | null | undefined,
+  state: {
+    quickMode: boolean;
+    sqlMode: boolean;
+    streamCount: number;
+    interestingFields: string[];
+    streamFields: any[];
+    allFieldsName?: string;
+  },
+): { shown: number; total: number } | null => {
+  if (!row || !state.quickMode || state.sqlMode || state.streamCount !== 1) return null;
+  if (!state.interestingFields?.length) return null;
+  const names = new Set(
+    (state.streamFields ?? [])
+      .filter((field: any) => field?.isSchemaField && field.name !== state.allFieldsName)
+      .map((field: any) => field.name),
+  );
+  if (!names.size) return null;
+  const shown = [...names].filter((name) => Object.prototype.hasOwnProperty.call(row, name)).length;
+  return shown < names.size ? { shown, total: names.size } : null;
+};
diff --git a/web/src/utils/query/sqlUtils.ts b/web/src/utils/query/sqlUtils.ts
index 8de3c90b02..6c8157bae5 100644
--- a/web/src/utils/query/sqlUtils.ts
+++ b/web/src/utils/query/sqlUtils.ts
@@ -469,6 +469,15 @@ function extractJoinConditions(onClause: any, conditions: any[]): void {
   }
 }
 
+// The builder treats an empty value as "no value yet" and skips the condition.
+// `x != ''` in SQL is a real filter, so mark it to keep it.
+const emptyLiteralFlag = (condition: any) =>
+  ["=", "!=", "<>"].includes(condition?.operator) &&
+  ["single_quote_string", "string"].includes(condition?.right?.type) &&
+  condition?.right?.value === ""
+    ? { emptyLiteral: true }
+    : {};
+
 function parseCondition(condition: any) {
   try {
     if (condition.type === "binary_expr") {
@@ -533,6 +542,7 @@ function parseCondition(condition: any) {
           column: columnObj,
           operator: condition?.operator,
           value: `${condition?.right?.value}`,
+          ...emptyLiteralFlag(condition),
           logicalOperator: "AND",
           filterType: "condition",
         };
@@ -547,6 +557,7 @@ function parseCondition(condition: any) {
           column: columnObj,
           operator: "<>",
           value: `${condition?.right?.value}`,
+          ...emptyLiteralFlag(condition),
           logicalOperator: "AND",
           filterType: "condition",
         };
diff --git a/web/src/utils/queryHistory/adapters.spec.ts b/web/src/utils/queryHistory/adapters.spec.ts
new file mode 100644
index 0000000000..2259c7b63e
--- /dev/null
+++ b/web/src/utils/queryHistory/adapters.spec.ts
@@ -0,0 +1,292 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { decodeMetricsConfig } from "@/composables/metrics/metricsUrlState";
+import { b64DecodeUnicode } from "@/utils/formatters";
+import { buildTracesRecord, tracesRestore, tracesRouteQuery } from "./traces";
+import {
+  buildMetricsRecord,
+  metricsEditorIsEmpty,
+  metricsEditorIsEmptyWith,
+  metricsRestore,
+  metricsRouteQuery,
+  metricsRunError,
+} from "./metrics";
+import { recentSearchRoute } from "./routes";
+import { recentCompletionItems } from "./recentCompletions";
+
+const entry = (overrides: Partial<QueryHistoryEntry>): QueryHistoryEntry => ({
+  id: "e",
+  source: "metrics",
+  query: "up",
+  query_key: null,
+  streams: [],
+  context: {},
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: 1,
+  updated_at: 1,
+  ...overrides,
+});
+
+describe("Traces rows", () => {
+  const time = { type: "relative" as const, period: "1h", start_time: 10, end_time: 20 };
+
+  it("keys a run by stream, mode and filter", () => {
+    const body = buildTracesRecord({
+      stream: "default",
+      searchMode: "spans",
+      query: " service_name = 'cart' ",
+      time,
+      result: { status: "error", error: "unknown field" },
+    });
+    expect(body).toMatchObject({
+      source: "traces",
+      query: "service_name = 'cart'",
+      query_key: '[["default"],"traces","spans","service_name = \'cart\'",""]',
+      streams: ["default"],
+      status: "error",
+      context: { page: { stream: "default", tab: "spans" }, time, error: "unknown field" },
+    });
+  });
+
+  it("records nothing without a filter or stream", () => {
+    const input = { searchMode: "traces", time, result: { status: "ok" as const } };
+    expect(buildTracesRecord({ ...input, stream: "default", query: "" })).toBeNull();
+    expect(buildTracesRecord({ ...input, stream: "", query: "a = 1" })).toBeNull();
+  });
+
+  it("restores now over the period and at original time over the window", () => {
+    const row = entry({
+      source: "traces",
+      query: "a = 1",
+      streams: ["default"],
+      context: { page: { stream: "default", tab: "spans" }, time },
+    });
+    expect(tracesRestore(row, "now")).toEqual({
+      stream: "default",
+      searchMode: "spans",
+      query: "a = 1",
+      window: { type: "relative", period: "1h" },
+    });
+    const link = tracesRouteQuery(row, "original", "org1");
+    expect(link).toMatchObject({ stream: "default", tab: "spans", from: "10", to: "20" });
+    expect(b64DecodeUnicode(link.query)).toBe("a = 1");
+    expect(recentSearchRoute(row, "original", "org1", "run")).toMatchObject({
+      path: "/traces",
+      query: { reload: "true" },
+    });
+  });
+});
+
+describe("Metrics rows", () => {
+  const panel = {
+    data: {
+      type: "line",
+      queryType: "promql",
+      config: { step_value: "30s" },
+      queries: [{ query: "up", fields: { stream: "up" } }],
+    },
+    layout: { hiddenQueries: [] as number[] },
+  };
+
+  it("keeps the v1.1.x context and adds the resolved window", () => {
+    const body = buildMetricsRecord({
+      panel,
+      selectedDate: { valueType: "relative", relativeTimePeriod: "6h" },
+      window: { startUs: 100, endUs: 200 },
+    });
+    expect(body).toMatchObject({
+      source: "metrics",
+      query: "up",
+      query_key: '[["up"],"metrics","promql","up",""]',
+      streams: ["up"],
+      context: {
+        time_range: { period: "6h" },
+        step: "30s",
+        chart_type: "line",
+        time: { type: "relative", period: "6h", start_time: 100, end_time: 200 },
+      },
+    });
+    expect(decodeMetricsConfig(body!.context.metrics_data)?.data.queries[0].query).toBe("up");
+  });
+
+  it("reopens a v1.1.x row (no time, no key) at its stored range either way", () => {
+    const legacy = entry({
+      context: { metrics_data: "blob", time_range: { period: "6h" }, chart_type: "bar" },
+    });
+    for (const when of ["now", "original"] as const) {
+      expect(metricsRestore(legacy, when)).toMatchObject({
+        metricsData: "blob",
+        timeRange: { valueType: "relative", relativeTimePeriod: "6h" },
+      });
+    }
+    const absolute = entry({
+      context: { metrics_data: "blob", time_range: { from: 1000, to: 2000 } },
+    });
+    expect(metricsRestore(absolute, "original")?.timeRange).toMatchObject({
+      valueType: "absolute",
+      startTime: 1000,
+      endTime: 2000,
+    });
+    expect(metricsRestore(entry({ context: {} }), "now")).toBeNull();
+  });
+
+  it("reopens a new row at its own window at original time", () => {
+    const row = entry({
+      context: {
+        metrics_data: "blob",
+        time_range: { period: "6h" },
+        time: { type: "relative", period: "6h", start_time: 5_000_000, end_time: 9_000_000 },
+      },
+    });
+    expect(metricsRestore(row, "original")?.timeRange).toMatchObject({
+      valueType: "absolute",
+      startTime: 5_000_000,
+      endTime: 9_000_000,
+    });
+    expect(metricsRestore(row, "now")?.timeRange).toMatchObject({ relativeTimePeriod: "6h" });
+    expect(metricsRouteQuery(row, "original", "org1")).toEqual({
+      org_identifier: "org1",
+      metrics_data: "blob",
+      from: "5000",
+      to: "9000",
+    });
+  });
+});
+
+describe("Metrics editor and panel errors", () => {
+  it("treats a panel as empty only when no visible query or formula has text", () => {
+    expect(metricsEditorIsEmpty({ data: { queries: [{ query: " " }] } })).toBe(true);
+    expect(metricsEditorIsEmpty({ data: { queries: [{ query: "" }, { query: "up" }] } })).toBe(
+      false,
+    );
+    expect(
+      metricsEditorIsEmpty({
+        data: { queries: [{ query: "" }, { query: "up" }] },
+        layout: { hiddenQueries: [1] },
+      }),
+    ).toBe(true);
+    expect(metricsEditorIsEmpty({ data: { queries: [{ config: { formula: "A / B" } }] } })).toBe(
+      false,
+    );
+  });
+
+  it("reads a panel error code as a search code or an HTTP status", () => {
+    expect(metricsRunError({ message: "bad", code: 400 })).toEqual({
+      httpStatus: 400,
+      message: "bad",
+    });
+    expect(metricsRunError({ message: "slow", code: "20010" })).toEqual({
+      code: 20010,
+      message: "slow",
+    });
+    expect(metricsRunError({ message: "odd", code: "" })).toEqual({ message: "odd" });
+    expect(metricsRunError({ message: "", code: "" })).toBeNull();
+    expect(metricsRunError(null)).toBeNull();
+  });
+});
+
+describe("autocomplete clock rows", () => {
+  const model = (text: string) => {
+    const lines = text.split("\n");
+    return {
+      getValue: () => text,
+      getLineCount: () => lines.length,
+      getLineMaxColumn: (n: number) => lines[n - 1].length + 1,
+      getLineContent: (n: number) => lines[n - 1],
+    };
+  };
+
+  it("replaces the whole editor text with a matching recent query", () => {
+    const items = recentCompletionItems(
+      ["level = 'error' and ns = 'checkout'"],
+      model("lev"),
+      { lineNumber: 1, column: 4 },
+      18,
+      "Recent search",
+    );
+    expect(items).toHaveLength(1);
+    expect(items[0]).toMatchObject({
+      insertText: "level = 'error' and ns = 'checkout'",
+      filterText: "lev",
+      kind: 18,
+      range: { startLineNumber: 1, startColumn: 1, endLineNumber: 1, endColumn: 4 },
+      additionalTextEdits: [],
+    });
+    expect(items[0].sortText < "a").toBe(true);
+  });
+
+  it("clears the other lines of a multi-line editor", () => {
+    const items = recentCompletionItems(
+      ["SELECT * FROM a WHERE b = 1"],
+      model("SELECT *\nFROM a"),
+      { lineNumber: 2, column: 7 },
+      18,
+      "Recent search",
+    );
+    expect(items[0].additionalTextEdits).toEqual([
+      {
+        range: { startLineNumber: 1, startColumn: 1, endLineNumber: 2, endColumn: 1 },
+        text: "",
+      },
+    ]);
+  });
+
+  it("offers nothing when no recent query matches", () => {
+    expect(
+      recentCompletionItems(["up"], model("rate"), { lineNumber: 1, column: 5 }, 18, "x"),
+    ).toEqual([]);
+  });
+});
+
+describe("metrics editor emptiness while typing", () => {
+  const panel = (
+    queries: { query?: string; formula?: string }[],
+    current = 0,
+    hidden: number[] = [],
+  ) => ({
+    data: { queries: queries.map((q) => ({ query: q.query, config: { formula: q.formula } })) },
+    layout: { currentQueryIndex: current, hiddenQueries: hidden },
+  });
+
+  it("reads the edited query from the editor text, not the debounced panel", () => {
+    expect(metricsEditorIsEmptyWith(panel([{ query: "up" }]), true)).toBe(true);
+    expect(metricsEditorIsEmptyWith(panel([{ query: "" }]), false)).toBe(false);
+  });
+
+  it("still needs every other visible query and formula empty", () => {
+    expect(metricsEditorIsEmptyWith(panel([{ query: "" }, { query: "rate(x[5m])" }]), true)).toBe(
+      false,
+    );
+    expect(
+      metricsEditorIsEmptyWith(panel([{ query: "" }, { query: "rate(x[5m])" }], 0, [1]), true),
+    ).toBe(true);
+    expect(metricsEditorIsEmptyWith(panel([{ query: "" }, { formula: "A+B" }]), true)).toBe(false);
+  });
+
+  it("treats the editor text as the whole active entry, so clearing the active formula counts", () => {
+    expect(metricsEditorIsEmptyWith(panel([{ query: "x", formula: "A+B" }]), true)).toBe(true);
+    expect(metricsEditorIsEmptyWith(panel([{ query: "" }, { formula: "A*2" }], 1), true)).toBe(
+      true,
+    );
+    expect(metricsEditorIsEmptyWith(panel([{ query: "" }, { formula: "A*2" }], 1), false)).toBe(
+      false,
+    );
+  });
+});
diff --git a/web/src/utils/queryHistory/logs.spec.ts b/web/src/utils/queryHistory/logs.spec.ts
new file mode 100644
index 0000000000..fb629bcefb
--- /dev/null
+++ b/web/src/utils/queryHistory/logs.spec.ts
@@ -0,0 +1,211 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import type { LogsSignature, RunReason } from "@/composables/useLogs/useAutoRun";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { b64DecodeUnicode } from "@/utils/formatters";
+import {
+  buildLogsRecord,
+  isRecordedLogsRun,
+  isUntouchedLogsQuery,
+  LOGS_REAPPLY_TYPE,
+  logsRouteQuery,
+  logsRunResult,
+  logsReapplyRequest,
+  requestLogsReapply,
+} from "./logs";
+
+const signature = (overrides: Partial<LogsSignature> = {}): LogsSignature => ({
+  query: "level = 'error'",
+  sqlMode: false,
+  streams: ["k8s_logs"],
+  streamType: "logs",
+  time: { type: "relative", period: "15m" },
+  transform: null,
+  quickMode: true,
+  quickModeFields: [],
+  regions: [],
+  clusters: [],
+  effectiveSortOrder: "desc",
+  definedSchemas: "user_defined_schema",
+  ...overrides,
+});
+
+describe("which Logs runs record", () => {
+  it.each<RunReason>([
+    "run",
+    "explicit",
+    "run-anyway",
+    "filter",
+    "stream",
+    "function",
+    "time",
+    "time-typed",
+    "zoom",
+    "narrow",
+    "saved-view",
+  ])("records a %s run", (reason) => {
+    expect(isRecordedLogsRun([reason])).toBe(true);
+  });
+
+  it.each<RunReason>([
+    "refresh",
+    "pagination",
+    "page-size",
+    "sort",
+    "histogram",
+    "tab",
+    "patterns",
+    "landing",
+    "url",
+    "activation",
+    "visualize-restore",
+  ])("never records a %s run", (reason) => {
+    expect(isRecordedLogsRun([reason])).toBe(false);
+  });
+
+  it("records a refresh tick coalesced with a filter click", () => {
+    expect(isRecordedLogsRun(["refresh", "filter"])).toBe(true);
+  });
+
+  it("skips the untouched SQL template on a stream or time change, but not on Run", () => {
+    const template = { query: 'SELECT * FROM "k8s_logs"', sqlMode: true };
+    expect(isRecordedLogsRun(["stream"], template)).toBe(false);
+    expect(isRecordedLogsRun(["time", "filter"], template)).toBe(false);
+    expect(isRecordedLogsRun(["run"], template)).toBe(true);
+    expect(isRecordedLogsRun(["stream", "explicit"], template)).toBe(true);
+    expect(isRecordedLogsRun(["refresh"], template)).toBe(false);
+    const edited = { query: 'SELECT * FROM "k8s_logs" WHERE a = 1', sqlMode: true };
+    expect(isRecordedLogsRun(["stream"], edited)).toBe(true);
+  });
+
+  it("maps a settled run: failure, cancel, partial", () => {
+    expect(logsRunResult({ partial: false, error: null })).toEqual({ status: "ok" });
+    expect(logsRunResult({ partial: true, error: null })).toEqual({ status: "ok", warning: "" });
+    expect(logsRunResult({ partial: false, error: { code: 20009 } })).toBeNull();
+    expect(logsRunResult({ partial: false, error: { code: 20001, message: "bad" } })).toEqual({
+      status: "error",
+      error: "bad",
+    });
+  });
+});
+
+describe("the Logs record", () => {
+  it("keys the run by streams, mode, query and VRL, and keeps the page state", () => {
+    const body = buildLogsRecord({
+      signature: signature({ transform: ".a = 1" }),
+      startUs: 100,
+      endUs: 200,
+      columns: ["msg", "level"],
+      result: { status: "ok" },
+    });
+    expect(body).toMatchObject({
+      source: "logs",
+      query: "level = 'error'",
+      query_key: '[["k8s_logs"],"logs","filter","level = \'error\'",".a = 1"]',
+      streams: ["k8s_logs"],
+      status: "ok",
+      context: {
+        time: { type: "relative", period: "15m", start_time: 100, end_time: 200 },
+        page: {
+          stream_type: "logs",
+          stream: "k8s_logs",
+          sql_mode: "false",
+          fn_editor: "true",
+        },
+      },
+    });
+    expect(b64DecodeUnicode(body!.context.page!.functionContent)).toBe(".a = 1");
+    expect(body!.context.page!.columns).toBeTruthy();
+  });
+
+  it("stores the error of a failed run and keeps no columns in SQL mode", () => {
+    const body = buildLogsRecord({
+      signature: signature({ sqlMode: true, query: 'SELECT * FROM "x" WHERE' }),
+      startUs: 1,
+      endUs: 2,
+      columns: ["msg"],
+      result: { status: "error", error: "syntax error" },
+    });
+    expect(body?.status).toBe("error");
+    expect(body?.context.error).toBe("syntax error");
+    expect(body?.context.page?.columns).toBeUndefined();
+  });
+
+  it("records nothing for an empty query", () => {
+    const body = buildLogsRecord({
+      signature: signature({ query: "  " }),
+      startUs: 1,
+      endUs: 2,
+      columns: [],
+      result: { status: "ok" },
+    });
+    expect(body).toBeNull();
+  });
+});
+
+describe("restoring a Logs row", () => {
+  const entry: QueryHistoryEntry = {
+    id: "e",
+    source: "logs",
+    query: "level = 'error'",
+    query_key: "k",
+    streams: ["k8s_logs"],
+    context: {
+      page: { stream: "k8s_logs", stream_type: "logs", sql_mode: "false" },
+      time: { type: "relative", period: "1h", start_time: 1000, end_time: 2000 },
+    },
+    status: "ok",
+    starred: false,
+    run_count: 1,
+    created_at: 1,
+    updated_at: 2,
+  };
+
+  it("re-runs now over the relative period", () => {
+    const query = logsRouteQuery(entry, "now", "org1", true);
+    expect(query).toMatchObject({
+      stream: "k8s_logs",
+      org_identifier: "org1",
+      period: "1h",
+      type: LOGS_REAPPLY_TYPE,
+    });
+    expect(query.from).toBeUndefined();
+    expect(b64DecodeUnicode(query.query)).toBe("level = 'error'");
+  });
+
+  it("re-runs at original time over the absolute window, and a link carries no re-apply type", () => {
+    const query = logsRouteQuery(entry, "original", "org1", false);
+    expect(query).toMatchObject({ from: "1000", to: "2000" });
+    expect(query.period).toBeUndefined();
+    expect(query.type).toBeUndefined();
+  });
+
+  it("makes every restore a new request that carries its own run flag", () => {
+    const before = logsReapplyRequest.value.seq;
+    requestLogsReapply(true);
+    expect(logsReapplyRequest.value).toEqual({ seq: before + 1, run: true });
+    requestLogsReapply(false);
+    expect(logsReapplyRequest.value).toEqual({ seq: before + 2, run: false });
+  });
+
+  it("treats an empty editor and the untouched SQL template as empty", () => {
+    expect(isUntouchedLogsQuery("", false)).toBe(true);
+    expect(isUntouchedLogsQuery('SELECT * FROM "k8s_logs"', true)).toBe(true);
+    expect(isUntouchedLogsQuery('SELECT * FROM "k8s_logs" WHERE a = 1', true)).toBe(false);
+    expect(isUntouchedLogsQuery("level = 'error'", false)).toBe(false);
+  });
+});
diff --git a/web/src/utils/queryHistory/logs.ts b/web/src/utils/queryHistory/logs.ts
new file mode 100644
index 0000000000..24a2339cff
--- /dev/null
+++ b/web/src/utils/queryHistory/logs.ts
@@ -0,0 +1,179 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { ref } from "vue";
+import { REASON_KIND, type RunReason, type LogsSignature } from "@/composables/useLogs/useAutoRun";
+import type {
+  HistoryTime,
+  QueryHistoryEntry,
+  QueryHistoryRecordBody,
+} from "@/services/query_history";
+import { b64DecodeUnicodeSafe, b64EncodeUnicode } from "@/utils/formatters";
+import { encodeColumns } from "@/composables/useLogs/useLogsUrl";
+import {
+  buildQueryKey,
+  fitContext,
+  restoreWindow,
+  resultContext,
+  runResultFromError,
+  type RestoreTime,
+  type RunError,
+  type RunResult,
+} from "./recentSearches";
+
+/** The user-initiated reasons (design 3.2); refresh, paging, sort, tabs, landing and links never record. */
+const RECORDED_REASONS = new Set<RunReason>([
+  "run",
+  "explicit",
+  "run-anyway",
+  "filter",
+  "stream",
+  "function",
+  "time",
+  "time-typed",
+  "zoom",
+  "narrow",
+  "compare",
+  "saved-view",
+]);
+
+/** The re-apply route type the Logs page loads without running. */
+export const LOGS_REAPPLY_TYPE = "search_history_re_apply";
+
+/** Bumped once per restore, so restoring the same row twice is two requests even when the URL does not change. */
+export const logsReapplyRequest = ref<{ seq: number; run: boolean }>({ seq: 0, run: false });
+
+export interface LogsRunRecordInput {
+  signature: LogsSignature;
+  startUs: number;
+  endUs: number;
+  columns: string[];
+  result: RunResult;
+}
+
+export type LogsRouteQuery = Record<string, string>;
+
+/** True when a user action ran the search; on the untouched template only an explicit Run counts. */
+export const isRecordedLogsRun = (
+  reasons: readonly RunReason[],
+  editor?: Pick<LogsSignature, "query" | "sqlMode">,
+): boolean => {
+  const recorded = reasons.filter((reason) => RECORDED_REASONS.has(reason));
+  if (!recorded.length) return false;
+  if (!editor || !isUntouchedLogsQuery(editor.query, editor.sqlMode)) return true;
+  return recorded.some((reason) => REASON_KIND[reason] === "explicit");
+};
+
+/** What a settled run records, or null for a cancelled one; a partial result is ok with a warning. */
+export const logsRunResult = (run: {
+  error: RunError | null;
+  partial: boolean;
+}): RunResult | null => {
+  if (run.error) return runResultFromError(run.error);
+  return run.partial ? { status: "ok", warning: "" } : { status: "ok" };
+};
+
+/** The record for a settled Logs run, or null when there is no query text to keep. */
+export const buildLogsRecord = (input: LogsRunRecordInput): QueryHistoryRecordBody | null => {
+  const { signature } = input;
+  const query = signature.query.trim();
+  if (!query) return null;
+  const vrl = signature.transform?.trim() ?? "";
+  const mode = signature.sqlMode ? "sql" : "filter";
+  const page: Record<string, string> = {
+    stream_type: signature.streamType,
+    stream: signature.streams.join(","),
+    sql_mode: String(signature.sqlMode),
+    quick_mode: String(signature.quickMode),
+    defined_schemas: signature.definedSchemas,
+    fn_editor: String(!!vrl),
+  };
+  if (vrl) page.functionContent = b64EncodeUnicode(vrl) ?? "";
+  if (!signature.sqlMode && input.columns.length) page.columns = encodeColumns(input.columns);
+  if (signature.regions.length) page.regions = signature.regions.join(",");
+  if (signature.clusters.length) page.clusters = signature.clusters.join(",");
+  const time: HistoryTime =
+    signature.time.type === "relative"
+      ? {
+          type: "relative",
+          period: signature.time.period,
+          start_time: input.startUs,
+          end_time: input.endUs,
+        }
+      : { type: "absolute", start_time: input.startUs, end_time: input.endUs };
+  return {
+    source: "logs",
+    query,
+    query_key: buildQueryKey({
+      streams: signature.streams,
+      streamType: signature.streamType,
+      mode,
+      query,
+      vrl,
+    }),
+    streams: [...signature.streams],
+    status: input.result.status,
+    context: fitContext({ page, time, ...resultContext(input.result) }),
+  };
+};
+
+/** URL query that reopens a Logs row; `reapply` loads it through the page's re-apply flow. */
+export const logsRouteQuery = (
+  entry: QueryHistoryEntry,
+  when: RestoreTime,
+  orgId: string,
+  reapply: boolean,
+): LogsRouteQuery => {
+  const query: LogsRouteQuery = {
+    ...(entry.context.page ?? {}),
+    stream: entry.context.page?.stream ?? entry.streams.join(","),
+    query: b64EncodeUnicode(entry.query) ?? "",
+    org_identifier: orgId,
+  };
+  const window = restoreWindow(entry.context.time, when);
+  if (window?.type === "relative") query.period = window.period;
+  if (window?.type === "absolute") {
+    query.from = String(window.startUs);
+    query.to = String(window.endUs);
+  }
+  if (reapply) query.type = LOGS_REAPPLY_TYPE;
+  return query;
+};
+
+/** The VRL function a Logs row ran with, or "" when it had none. */
+export const logsEntryFunction = (entry: QueryHistoryEntry): string =>
+  entry.source === "logs" ? b64DecodeUnicodeSafe(entry.context.page?.functionContent ?? "") : "";
+
+/** Asks the Logs page to apply the route it is on, and to run it when `run` is set. */
+export const requestLogsReapply = (run: boolean) => {
+  logsReapplyRequest.value = { seq: logsReapplyRequest.value.seq + 1, run };
+};
+
+/** The SQL template a new Logs search starts from counts as an empty editor. */
+export const isUntouchedLogsQuery = (query: string, sqlMode: boolean): boolean => {
+  const text = query.trim();
+  if (!text) return true;
+  return sqlMode && /^select\s+\*\s+from\s+"?[^"\s]+"?$/i.test(text);
+};
+
+export const logsExampleQueries = (stream: string, sqlMode: boolean): string[] => {
+  if (!stream) return [];
+  return sqlMode
+    ? [
+        `SELECT * FROM "${stream}" WHERE match_all('error')`,
+        `SELECT COUNT(*) AS total FROM "${stream}"`,
+      ]
+    : ["match_all('error')", "match_all('timeout')"];
+};
diff --git a/web/src/utils/queryHistory/metrics.ts b/web/src/utils/queryHistory/metrics.ts
new file mode 100644
index 0000000000..cdc47a1f85
--- /dev/null
+++ b/web/src/utils/queryHistory/metrics.ts
@@ -0,0 +1,190 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type {
+  HistoryTime,
+  QueryHistoryEntry,
+  QueryHistoryRecordBody,
+} from "@/services/query_history";
+import { buildHistoryEntry, historyEntryToLoad } from "@/utils/metrics/queryHistory";
+import { selectorMetricNames } from "@/utils/dashboard/exemplars/exemplarPlacement";
+import type { SelectedDate } from "@/utils/dashboard/urlTimeParams";
+import {
+  buildQueryKey,
+  plainMessage,
+  restoreWindow,
+  resultContext,
+  toRunError,
+  type RestoreTime,
+  type RunError,
+  type RunResult,
+} from "./recentSearches";
+
+/** The parts of the Metrics panel state the record reads. */
+export interface MetricsPanelState {
+  data?: {
+    queryType?: string;
+    queries?: { query?: string; fields?: { stream?: string }; config?: { formula?: string } }[];
+  };
+  layout?: { hiddenQueries?: number[]; currentQueryIndex?: number };
+}
+
+export interface MetricsRunRecordInput {
+  panel: MetricsPanelState;
+  selectedDate: Partial<SelectedDate> | null;
+  /** The resolved window of the run, in microseconds; null when the picker has none. */
+  window: { startUs: number; endUs: number } | null;
+}
+
+/** The panel's `{ message, code }` error, where `code` is a search error code or an HTTP status. */
+export interface PanelErrorDetail {
+  message?: unknown;
+  code?: unknown;
+}
+
+export interface MetricsRestore {
+  metricsData: string;
+  timeRange: SelectedDate;
+}
+
+/** Metric names of the visible queries, in panel order. */
+const metricStreams = (panel: MetricsPanelState): string[] => {
+  const hidden = panel.layout?.hiddenQueries ?? [];
+  const promql = (panel.data?.queryType ?? "promql") === "promql";
+  // A custom PromQL query keeps the stream picker's last metric, so its selectors are the truth.
+  const names = (panel.data?.queries ?? [])
+    .filter((_, index) => !hidden.includes(index))
+    .flatMap((q) => {
+      const text = q.query?.trim() ?? "";
+      if (promql && text) return selectorMetricNames(text);
+      return q.fields?.stream?.trim() ? [q.fields.stream.trim()] : [];
+    })
+    .filter((name) => !!name && !name.includes(","));
+  return [...new Set(names)];
+};
+
+/** True when no visible query has text, so loading a whole recent panel replaces nothing typed. */
+export const metricsEditorIsEmpty = (panel: MetricsPanelState | null | undefined): boolean => {
+  const hidden = panel?.layout?.hiddenQueries ?? [];
+  return (panel?.data?.queries ?? [])
+    .filter((_, index) => !hidden.includes(index))
+    .every((q) => !String(q.query ?? "").trim() && !String(q.config?.formula ?? "").trim());
+};
+
+/** As metricsEditorIsEmpty, with the active query's blankness read from the editor, ahead of the debounced panel. */
+export const metricsEditorIsEmptyWith = (
+  panel: MetricsPanelState | null | undefined,
+  editorBlank: boolean,
+): boolean => {
+  const current = panel?.layout?.currentQueryIndex ?? 0;
+  const hidden = panel?.layout?.hiddenQueries ?? [];
+  return (
+    editorBlank &&
+    (panel?.data?.queries ?? []).every(
+      (q, index) =>
+        index === current ||
+        hidden.includes(index) ||
+        (!String(q.query ?? "").trim() && !String(q.config?.formula ?? "").trim()),
+    )
+  );
+};
+
+/** Metrics keeps the v1.1.x context and adds the resolved window, so one loader reads both. */
+export const buildMetricsRecord = (input: MetricsRunRecordInput): QueryHistoryRecordBody | null => {
+  const legacy = buildHistoryEntry(input.panel, input.selectedDate);
+  if (!legacy) return null;
+  const streams = metricStreams(input.panel);
+  const mode = input.panel.data?.queryType ?? "promql";
+  const relative = input.selectedDate?.valueType !== "absolute";
+  const time: HistoryTime | undefined = input.window
+    ? {
+        type: relative ? "relative" : "absolute",
+        ...(relative && input.selectedDate?.relativeTimePeriod
+          ? { period: input.selectedDate.relativeTimePeriod }
+          : {}),
+        start_time: input.window.startUs,
+        end_time: input.window.endUs,
+      }
+    : undefined;
+  return {
+    source: "metrics",
+    query: legacy.query,
+    query_key: buildQueryKey({ streams, streamType: "metrics", mode, query: legacy.query }),
+    streams,
+    status: "ok",
+    context: { ...legacy.context, ...(time ? { time } : {}) },
+  };
+};
+
+/** The run error a panel error stands for, or null when the panel cleared its error. */
+export const metricsRunError = (
+  detail: PanelErrorDetail | string | null | undefined,
+): RunError | null => {
+  if (!detail) return null;
+  const message = plainMessage(typeof detail === "string" ? detail : detail.message);
+  if (!message) return null;
+  return typeof detail === "string" ? { message } : toRunError({ code: detail.code, message });
+};
+
+export const withRunResult = (
+  body: QueryHistoryRecordBody,
+  result: RunResult,
+): QueryHistoryRecordBody => ({
+  ...body,
+  status: result.status,
+  context: { ...body.context, ...resultContext(result) },
+});
+
+/** The panel and range a Metrics row reopens with; v1.1.x rows reopen at their stored range. */
+export const metricsRestore = (
+  entry: QueryHistoryEntry,
+  when: RestoreTime,
+): MetricsRestore | null => {
+  const loaded = historyEntryToLoad(entry.context);
+  if (!loaded) return null;
+  const window = restoreWindow(entry.context.time, when);
+  if (!window || window.type === "relative") return loaded;
+  return {
+    metricsData: loaded.metricsData,
+    timeRange: {
+      valueType: "absolute",
+      startTime: window.startUs,
+      endTime: window.endUs,
+      relativeTimePeriod: loaded.timeRange.relativeTimePeriod,
+    },
+  };
+};
+
+/** URL query that opens a Metrics row on its page; the Metrics link carries the window in ms. */
+export const metricsRouteQuery = (
+  entry: QueryHistoryEntry,
+  when: RestoreTime,
+  orgId: string,
+): Record<string, string> | null => {
+  const restore = metricsRestore(entry, when);
+  if (!restore) return null;
+  const query: Record<string, string> = {
+    org_identifier: orgId,
+    metrics_data: restore.metricsData,
+  };
+  const range = restore.timeRange;
+  if (range.valueType === "absolute" && range.startTime && range.endTime) {
+    query.from = String(Math.floor(Number(range.startTime) / 1000));
+    query.to = String(Math.floor(Number(range.endTime) / 1000));
+  } else {
+    query.period = range.relativeTimePeriod;
+  }
+  return query;
+};
diff --git a/web/src/utils/queryHistory/observeMoves.spec.ts b/web/src/utils/queryHistory/observeMoves.spec.ts
new file mode 100644
index 0000000000..4823d18b58
--- /dev/null
+++ b/web/src/utils/queryHistory/observeMoves.spec.ts
@@ -0,0 +1,150 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { observeMoves } from "./observeMoves";
+
+const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+const tree = () => {
+  const outer = document.createElement("div");
+  const inner = document.createElement("div");
+  const el = document.createElement("div");
+  const child = document.createElement("span");
+  el.appendChild(child);
+  inner.appendChild(el);
+  outer.appendChild(inner);
+  document.body.appendChild(outer);
+  return { outer, inner, el, child };
+};
+
+describe("observeMoves", () => {
+  afterEach(() => {
+    document.body.innerHTML = "";
+  });
+
+  it("reports an ancestor restyle, a containing scroll and a window resize, and ignores other scrolls", async () => {
+    const { outer, el } = tree();
+    const elsewhere = document.createElement("div");
+    document.body.appendChild(elsewhere);
+    await settle();
+    const onMove = vi.fn();
+    const stop = observeMoves(el, onMove);
+    await settle();
+    onMove.mockClear();
+
+    outer.style.top = "40px";
+    await settle();
+    expect(onMove).toHaveBeenCalledTimes(1);
+
+    elsewhere.dispatchEvent(new Event("scroll"));
+    expect(onMove).toHaveBeenCalledTimes(1);
+    outer.dispatchEvent(new Event("scroll"));
+    window.dispatchEvent(new Event("resize"));
+    expect(onMove).toHaveBeenCalledTimes(3);
+    stop();
+  });
+
+  it("reports style changes inside the element only when asked, as for Monaco's caret", async () => {
+    const { el, child } = tree();
+    const plain = vi.fn();
+    const withSubtree = vi.fn();
+    const stops = [observeMoves(el, plain), observeMoves(el, withSubtree, { subtreeStyles: true })];
+    await settle();
+    plain.mockClear();
+    withSubtree.mockClear();
+    child.style.left = "12px";
+    await settle();
+    expect(plain).not.toHaveBeenCalled();
+    expect(withSubtree).toHaveBeenCalledTimes(1);
+    stops.forEach((stop) => stop());
+  });
+
+  it("reports a sibling inserted before an ancestor, then watches that sibling's size", async () => {
+    const { outer, inner, el } = tree();
+    const observed: Element[] = [];
+    const RealResizeObserver = globalThis.ResizeObserver;
+    let resized: ResizeObserverCallback = () => {};
+    globalThis.ResizeObserver = class {
+      constructor(callback: ResizeObserverCallback) {
+        resized = callback;
+      }
+      observe(target: Element) {
+        observed.push(target);
+      }
+      unobserve() {}
+      disconnect() {
+        observed.length = 0;
+      }
+    } as unknown as typeof ResizeObserver;
+    try {
+      const onMove = vi.fn();
+      const stop = observeMoves(el, onMove);
+      const banner = document.createElement("div");
+      outer.insertBefore(banner, inner);
+      await settle();
+      expect(onMove).toHaveBeenCalled();
+      expect(observed).toContain(banner);
+      onMove.mockClear();
+      resized([], {} as ResizeObserver);
+      expect(onMove).toHaveBeenCalledTimes(1);
+      stop();
+    } finally {
+      globalThis.ResizeObserver = RealResizeObserver;
+    }
+  });
+
+  it("re-observes nothing when stopped after a sibling change queued a rewatch", async () => {
+    const { outer, inner, el } = tree();
+    const observed: Element[] = [];
+    const RealResizeObserver = globalThis.ResizeObserver;
+    globalThis.ResizeObserver = class {
+      observe(target: Element) {
+        observed.push(target);
+      }
+      unobserve() {}
+      disconnect() {
+        observed.length = 0;
+      }
+    } as unknown as typeof ResizeObserver;
+    try {
+      let stop: () => void = () => {};
+      // onMove runs in the same mutation callback that queues the rewatch, before that rewatch runs.
+      const onMove = vi.fn(() => stop());
+      stop = observeMoves(el, onMove);
+      expect(observed.length).toBeGreaterThan(0);
+      outer.insertBefore(document.createElement("div"), inner);
+      await settle();
+      expect(onMove).toHaveBeenCalledTimes(1);
+      expect(observed).toEqual([]);
+    } finally {
+      globalThis.ResizeObserver = RealResizeObserver;
+    }
+  });
+
+  it("stops reporting once stopped", async () => {
+    const { outer, el } = tree();
+    const onMove = vi.fn();
+    const stop = observeMoves(el, onMove, { subtreeStyles: true });
+    await settle();
+    stop();
+    onMove.mockClear();
+    outer.style.top = "1px";
+    outer.dispatchEvent(new Event("scroll"));
+    window.dispatchEvent(new Event("resize"));
+    await settle();
+    expect(onMove).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/utils/queryHistory/observeMoves.ts b/web/src/utils/queryHistory/observeMoves.ts
new file mode 100644
index 0000000000..d9568ae11f
--- /dev/null
+++ b/web/src/utils/queryHistory/observeMoves.ts
@@ -0,0 +1,81 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+/** Calls `onMove` whenever `el` may have moved on screen; returns a stop function. */
+export const observeMoves = (
+  el: Element,
+  onMove: () => void,
+  options: { subtreeStyles?: boolean } = {},
+): (() => void) => {
+  const stops: (() => void)[] = [];
+  let stopped = false;
+  const notify = () => onMove();
+  const sizes = typeof ResizeObserver !== "undefined" ? new ResizeObserver(notify) : null;
+  // Anything laid out before `el` or one of its ancestors pushes it when it grows, so each of those is watched too.
+  const watchSizes = () => {
+    // A rewatch queued just before teardown must not reconnect the observer to detached elements.
+    if (!sizes || stopped) return;
+    sizes.disconnect();
+    for (let node: Element | null = el; node && node !== document.body; node = node.parentElement) {
+      sizes.observe(node, { box: "border-box" });
+      for (
+        let before = node.previousElementSibling;
+        before;
+        before = before.previousElementSibling
+      ) {
+        sizes.observe(before, { box: "border-box" });
+      }
+    }
+  };
+  watchSizes();
+  if (sizes) stops.push(() => sizes.disconnect());
+  if (typeof MutationObserver !== "undefined") {
+    let rewatchQueued = false;
+    const layout = new MutationObserver((records) => {
+      if (!rewatchQueued && records.some((record) => record.type === "childList")) {
+        rewatchQueued = true;
+        queueMicrotask(() => {
+          rewatchQueued = false;
+          watchSizes();
+        });
+      }
+      onMove();
+    });
+    for (let node = el.parentElement; node && node !== document.body; node = node.parentElement) {
+      layout.observe(node, {
+        attributes: true,
+        attributeFilter: ["style", "class"],
+        childList: true,
+      });
+    }
+    if (options.subtreeStyles) {
+      layout.observe(el, { attributes: true, attributeFilter: ["style"], subtree: true });
+    }
+    stops.push(() => layout.disconnect());
+  }
+  const onScroll = (event: Event) => {
+    if (event.target instanceof Node && event.target.contains(el)) onMove();
+  };
+  document.addEventListener("scroll", onScroll, true);
+  window.addEventListener("resize", notify);
+  stops.push(() => {
+    document.removeEventListener("scroll", onScroll, true);
+    window.removeEventListener("resize", notify);
+  });
+  return () => {
+    stopped = true;
+    stops.forEach((stop) => stop());
+  };
+};
diff --git a/web/src/utils/queryHistory/queryHistoryContract.spec.ts b/web/src/utils/queryHistory/queryHistoryContract.spec.ts
new file mode 100644
index 0000000000..0f158781f4
--- /dev/null
+++ b/web/src/utils/queryHistory/queryHistoryContract.spec.ts
@@ -0,0 +1,241 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { effectScope, nextTick, ref, type EffectScope } from "vue";
+import http from "@/services/http";
+import type { QueryHistoryEntry, QueryHistoryRecordBody } from "@/services/query_history";
+import { queryHistoryCountQuery } from "@/services/query_history.queries";
+import { queryHistoryKeys } from "@/services/query_history.querykeys";
+import type { LogsSignature } from "@/composables/useLogs/useAutoRun";
+import { useQueryHistoryRecorder } from "@/composables/metrics/useQueryHistoryRecorder";
+import { buildLogsRecord, isRecordedLogsRun } from "./logs";
+import { buildTracesRecord } from "./traces";
+import { buildRecents, groupByDay } from "./recentSearches";
+
+const recorded = vi.hoisted(() => [] as unknown[]);
+
+vi.mock("@/services/http", () => ({ default: vi.fn() }));
+vi.mock("@/composables/queryHistory/useRecentSearches", () => ({
+  useRecentSearches: () => ({ record: (body: unknown) => body && recorded.push(body) }),
+}));
+
+const DAY_MS = 86_400_000;
+const MONDAY_MS = new Date(2026, 9, 26, 10, 0, 0).getTime();
+
+const signature = (overrides: Partial<LogsSignature> = {}): LogsSignature => ({
+  query: "level = 'error'",
+  sqlMode: false,
+  streams: ["k8s_logs"],
+  streamType: "logs",
+  time: { type: "relative", period: "15m" },
+  transform: null,
+  quickMode: true,
+  quickModeFields: [],
+  regions: [],
+  clusters: [],
+  effectiveSortOrder: "desc",
+  definedSchemas: "user_defined_schema",
+  ...overrides,
+});
+
+const logsKey = (overrides: Partial<LogsSignature> = {}, atMs = MONDAY_MS) =>
+  buildLogsRecord({
+    signature: signature(overrides),
+    startUs: (atMs - 15 * 60_000) * 1000,
+    endUs: atMs * 1000,
+    columns: [],
+    result: { status: "ok" },
+  })?.query_key;
+
+const entry = (overrides: Partial<QueryHistoryEntry> = {}): QueryHistoryEntry => ({
+  id: "e",
+  source: "logs",
+  query: "level = 'error'",
+  query_key: "k",
+  streams: ["k8s_logs"],
+  context: {},
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: MONDAY_MS * 1000,
+  updated_at: MONDAY_MS * 1000,
+  ...overrides,
+});
+
+describe("query_key: streams, stream type, mode, query and VRL, never a date", () => {
+  afterEach(() => vi.useRealTimers());
+
+  it("gives a Logs search the same key on two different days and at any clock time", () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(MONDAY_MS);
+    const monday = logsKey({}, MONDAY_MS);
+    vi.setSystemTime(MONDAY_MS + 40 * DAY_MS);
+    const later = logsKey({}, MONDAY_MS + 40 * DAY_MS);
+    expect(monday).toBe('[["k8s_logs"],"logs","filter","level = \'error\'",""]');
+    expect(later).toBe(monday);
+  });
+
+  it("splits Logs searches that differ only in VRL or mode", () => {
+    expect(logsKey({ transform: ".x = 1" })).toBe(
+      '[["k8s_logs"],"logs","filter","level = \'error\'",".x = 1"]',
+    );
+    expect(logsKey({ sqlMode: true })).toBe('[["k8s_logs"],"logs","sql","level = \'error\'",""]');
+    expect(
+      new Set([logsKey(), logsKey({ transform: ".x = 1" }), logsKey({ sqlMode: true })]).size,
+    ).toBe(3);
+  });
+
+  it("gives a Traces search the same key whatever window it ran over", () => {
+    const key = (start: number) =>
+      buildTracesRecord({
+        stream: "default",
+        searchMode: "traces",
+        query: "duration > 10",
+        time: { type: "absolute", start_time: start, end_time: start + 1 },
+        result: { status: "ok" },
+      })?.query_key;
+    expect(key(1)).toBe('[["default"],"traces","traces","duration > 10",""]');
+    expect(key(40 * DAY_MS * 1000)).toBe(key(1));
+  });
+});
+
+describe("no client dedupe: each server row is one search", () => {
+  it("shows two searches with the same text but different VRL as two rows", () => {
+    const view = buildRecents([
+      entry({ id: "plain", query_key: "plain-key" }),
+      entry({
+        id: "vrl",
+        query_key: "vrl-key",
+        updated_at: MONDAY_MS * 1000 - 1,
+      }),
+    ]);
+    expect(view.rows.map((r) => r.entry.id)).toEqual(["plain", "vrl"]);
+  });
+
+  it("shows a search merged on the server across two days once, under the day it last ran", () => {
+    const merged = entry({
+      id: "merged",
+      run_count: 2,
+      created_at: (MONDAY_MS - 3 * DAY_MS) * 1000,
+      updated_at: MONDAY_MS * 1000,
+    });
+    expect(buildRecents([merged]).rows.map((r) => r.entry.id)).toEqual(["merged"]);
+    const groups = groupByDay([merged], MONDAY_MS);
+    expect(groups.map((g) => [g.daysAgo, g.entries.map((e) => e.id)])).toEqual([[0, ["merged"]]]);
+  });
+
+  it("takes each row's starred flag as the truth, never a sibling's", () => {
+    const view = buildRecents([
+      entry({ id: "unstarred", query_key: "a", starred: false }),
+      entry({ id: "starred", query_key: "b", starred: true, updated_at: MONDAY_MS * 1000 - 1 }),
+    ]);
+    expect(view.rows.map((r) => [r.entry.id, r.starred])).toEqual([
+      ["unstarred", false],
+      ["starred", true],
+    ]);
+  });
+});
+
+describe("recording: once per user-initiated run", () => {
+  it("never records a Logs pagination, histogram or refresh run, however they coalesce", () => {
+    expect(isRecordedLogsRun(["pagination", "histogram", "refresh", "page-size", "sort"])).toBe(
+      false,
+    );
+  });
+
+  describe("the Metrics recorder", () => {
+    const panel = {
+      data: { queryType: "promql", queries: [{ query: "up", fields: { stream: "up" } }] },
+      layout: { hiddenQueries: [] as number[] },
+    };
+    const selectedDate = { valueType: "relative" as const, relativeTimePeriod: "15m" };
+    const loading = ref(false);
+    const cycle = async () => {
+      loading.value = true;
+      await nextTick();
+      loading.value = false;
+      await nextTick();
+      await nextTick();
+    };
+
+    let scope: EffectScope;
+    const recorder = () => scope.run(() => useQueryHistoryRecorder(() => loading.value))!;
+
+    beforeEach(() => {
+      recorded.length = 0;
+      loading.value = false;
+      scope = effectScope();
+    });
+
+    afterEach(() => scope.stop());
+
+    it("records a Run once, and nothing for the refreshes that follow it", async () => {
+      const metrics = recorder();
+      metrics.record(panel, selectedDate);
+      await cycle();
+      expect(recorded).toHaveLength(1);
+      expect((recorded[0] as QueryHistoryRecordBody).query_key).toBe(
+        '[["up"],"metrics","promql","up",""]',
+      );
+      await cycle();
+      await cycle();
+      expect(recorded).toHaveLength(1);
+    });
+
+    it("records nothing for a refresh no user asked for, or a cancelled Run", async () => {
+      const metrics = recorder();
+      await cycle();
+      metrics.record(panel, selectedDate);
+      metrics.cancel();
+      await cycle();
+      expect(recorded).toHaveLength(0);
+    });
+  });
+});
+
+describe("the clear dialog's count", () => {
+  const api = {
+    get: vi.fn(),
+  };
+
+  beforeEach(() => {
+    api.get.mockReset().mockResolvedValue({ data: { count: 7 } });
+    vi.mocked(http).mockReturnValue(api as unknown as ReturnType<typeof http>);
+  });
+
+  it("asks the server for count_only with the scope and fetches no rows", async () => {
+    const options = queryHistoryCountQuery("o1", "logs", false);
+    const queryFn = options.queryFn as unknown as () => Promise<number>;
+    await expect(queryFn()).resolves.toBe(7);
+    expect(api.get).toHaveBeenCalledTimes(1);
+    expect(api.get).toHaveBeenCalledWith("/api/o1/query_history", {
+      params: { source: "logs", starred: false, count_only: true },
+    });
+    expect(options.queryKey).toEqual(
+      queryHistoryKeys.list("o1", { source: "logs", starred: false, count_only: true }),
+    );
+  });
+
+  it("counts starred rows the same way, and reads a missing count as 0", async () => {
+    api.get.mockResolvedValue({ data: {} });
+    const queryFn = queryHistoryCountQuery("o1", "logs,traces", true)
+      .queryFn as unknown as () => Promise<number>;
+    await expect(queryFn()).resolves.toBe(0);
+    expect(api.get).toHaveBeenCalledWith("/api/o1/query_history", {
+      params: { source: "logs,traces", starred: true, count_only: true },
+    });
+  });
+});
diff --git a/web/src/utils/queryHistory/recentCompletions.ts b/web/src/utils/queryHistory/recentCompletions.ts
new file mode 100644
index 0000000000..1ca88864d6
--- /dev/null
+++ b/web/src/utils/queryHistory/recentCompletions.ts
@@ -0,0 +1,100 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { matchRecentQueries } from "./recentSearches";
+
+const MAX_LABEL_CHARS = 120;
+
+/** The parts of a Monaco text model the clock rows read. */
+export interface RecentCompletionModel {
+  getValue: () => string;
+  getLineCount: () => number;
+  getLineMaxColumn: (lineNumber: number) => number;
+  getLineContent: (lineNumber: number) => string;
+}
+
+interface Range {
+  startLineNumber: number;
+  startColumn: number;
+  endLineNumber: number;
+  endColumn: number;
+}
+
+export interface RecentCompletionItem {
+  label: { label: string; description: string };
+  kind: number;
+  detail: string;
+  insertText: string;
+  filterText: string;
+  sortText: string;
+  range: Range;
+  additionalTextEdits: { range: Range; text: string }[];
+}
+
+/** Clock rows that replace the whole editor text with a recent query matching what is typed. */
+export const recentCompletionItems = (
+  queries: string[],
+  model: RecentCompletionModel,
+  position: { lineNumber: number; column: number },
+  kind: number,
+  description: string,
+): RecentCompletionItem[] => {
+  if (!queries.length) return [];
+  const matches = matchRecentQueries(queries, model.getValue());
+  if (!matches.length) return [];
+  const line = position.lineNumber;
+  const lastLine = model.getLineCount();
+  // Monaco only takes a one-line range around the caret, so the other lines go through extra edits.
+  const otherLines: { range: Range; text: string }[] = [];
+  if (line > 1) {
+    otherLines.push({
+      range: { startLineNumber: 1, startColumn: 1, endLineNumber: line, endColumn: 1 },
+      text: "",
+    });
+  }
+  if (line < lastLine) {
+    otherLines.push({
+      range: {
+        startLineNumber: line,
+        startColumn: model.getLineMaxColumn(line),
+        endLineNumber: lastLine,
+        endColumn: model.getLineMaxColumn(lastLine),
+      },
+      text: "",
+    });
+  }
+  const typedOnLine = model.getLineContent(line).slice(0, position.column - 1);
+  return matches.map((query, index) => {
+    const oneLine = query.replace(/\s+/g, " ").trim();
+    return {
+      label: {
+        label: oneLine.length > MAX_LABEL_CHARS ? `${oneLine.slice(0, MAX_LABEL_CHARS)}…` : oneLine,
+        description,
+      },
+      kind,
+      detail: description,
+      insertText: query,
+      filterText: typedOnLine,
+      sortText: `\u0000${String(index).padStart(2, "0")}`,
+      range: {
+        startLineNumber: line,
+        startColumn: 1,
+        endLineNumber: line,
+        endColumn: model.getLineMaxColumn(line),
+      },
+      additionalTextEdits: otherLines,
+    };
+  });
+};
diff --git a/web/src/utils/queryHistory/recentSearches.spec.ts b/web/src/utils/queryHistory/recentSearches.spec.ts
new file mode 100644
index 0000000000..6342366eee
--- /dev/null
+++ b/web/src/utils/queryHistory/recentSearches.spec.ts
@@ -0,0 +1,521 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import {
+  buildQueryKey,
+  buildRecents,
+  dayBoundsUs,
+  defaultRestoreTime,
+  fitContext,
+  groupByDay,
+  matchRecentQueries,
+  plainMessage,
+  recentQueryList,
+  recentsOpenAfterEdit,
+  restoreWindow,
+  routeEditorKeyToRecents,
+  runResultFromError,
+  toRunError,
+} from "./recentSearches";
+
+const HOUR_US = 3_600_000_000;
+const NOW_MS = new Date(2026, 9, 27, 15, 0, 0).getTime();
+const NOW_US = NOW_MS * 1000;
+
+const entry = (overrides: Partial<QueryHistoryEntry> = {}): QueryHistoryEntry => ({
+  id: "e",
+  source: "logs",
+  query: "level = 'error'",
+  query_key: "k",
+  streams: ["k8s"],
+  context: {},
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: NOW_US,
+  updated_at: NOW_US,
+  ...overrides,
+});
+
+describe("query key", () => {
+  it("encodes sorted streams, stream type, mode, query and VRL, with no date", () => {
+    const key = buildQueryKey({
+      streams: ["b", "a"],
+      streamType: "logs",
+      mode: "sql",
+      query: "SELECT 1",
+      vrl: ".x = 1",
+    });
+    expect(key).toBe('[["a","b"],"logs","sql","SELECT 1",".x = 1"]');
+    expect(buildQueryKey({ streams: ["a"], streamType: "logs", mode: "filter", query: "x" })).toBe(
+      '[["a"],"logs","filter","x",""]',
+    );
+  });
+
+  it("keeps a separator inside the query or VRL from merging two searches", () => {
+    const base = { streams: ["a"], streamType: "logs", mode: "sql" };
+    expect(buildQueryKey({ ...base, query: "x|y", vrl: "z" })).not.toBe(
+      buildQueryKey({ ...base, query: "x", vrl: "y|z" }),
+    );
+  });
+
+  it("is one key for the same streams in any order, and two for different stream types", () => {
+    const parts = { mode: "filter", query: "x" };
+    expect(buildQueryKey({ ...parts, streams: ["a", "b"], streamType: "logs" })).toBe(
+      buildQueryKey({ ...parts, streams: ["b", "a"], streamType: "logs" }),
+    );
+    expect(buildQueryKey({ ...parts, streams: ["a"], streamType: "logs" })).not.toBe(
+      buildQueryKey({ ...parts, streams: ["a"], streamType: "enrichment_tables" }),
+    );
+  });
+
+  it("does not reorder the caller's streams", () => {
+    const streams = ["b", "a"];
+    buildQueryKey({ streams, streamType: "logs", mode: "filter", query: "x" });
+    expect(streams).toEqual(["b", "a"]);
+  });
+});
+
+describe("status mapping", () => {
+  it("records a query error (search code or 4xx) as error with its message", () => {
+    expect(runResultFromError({ code: 20001, message: "syntax <b>near</b> x" })).toEqual({
+      status: "error",
+      error: "syntax near x",
+    });
+    expect(runResultFromError({ httpStatus: 400, message: "bad" })).toEqual({
+      status: "error",
+      error: "bad",
+    });
+  });
+
+  it("records a timeout as ok with a warning", () => {
+    expect(runResultFromError({ code: 20010, message: "timed out" })).toEqual({
+      status: "ok",
+      warning: "timed out",
+    });
+    expect(runResultFromError({ httpStatus: 504 })).toEqual({ status: "ok", warning: "" });
+    expect(runResultFromError({ httpStatus: 408 })?.status).toBe("ok");
+  });
+
+  it("reads a streamed error's `code` as an HTTP status and a refused request's as a search code", () => {
+    expect(toRunError({ code: 400, message: "Search field not found" })).toEqual({
+      httpStatus: 400,
+      message: "Search field not found",
+    });
+    expect(toRunError({ status: 400, code: 20004, message: "m" })).toEqual({
+      code: 20004,
+      httpStatus: 400,
+      message: "m",
+    });
+    expect(runResultFromError(toRunError({ code: 400, message: "bad" }))?.status).toBe("error");
+    expect(runResultFromError(toRunError({ code: 500, message: "boom" }))?.status).toBe("ok");
+  });
+
+  it("never records a cancelled run", () => {
+    expect(runResultFromError({ code: 20009 })).toBeNull();
+  });
+
+  it("keeps server and rate-limit failures out of the failed list", () => {
+    expect(runResultFromError({ httpStatus: 500, message: "boom" })).toEqual({
+      status: "ok",
+      warning: "boom",
+    });
+    expect(runResultFromError({ httpStatus: 429 })?.status).toBe("ok");
+  });
+
+  it("strips markup and caps the message", () => {
+    expect(plainMessage("a <br><span>TraceID: 1</span>")).toBe("a TraceID: 1");
+    expect(plainMessage("unexpected <EOF>")).toBe("unexpected <EOF>");
+    expect(plainMessage("x".repeat(5000))).toHaveLength(1000);
+  });
+});
+
+describe("context size", () => {
+  it("drops the columns first and keeps the query, VRL and time", () => {
+    const page = { stream: "a", functionContent: "vrl", columns: "c".repeat(70 * 1024) };
+    const time = { type: "relative" as const, period: "15m", start_time: 1, end_time: 2 };
+    const fitted = fitContext({ page, time });
+    expect(fitted.page).toEqual({ stream: "a", functionContent: "vrl" });
+    expect(fitted.time).toEqual(time);
+  });
+
+  it("leaves a small context alone", () => {
+    const context = { page: { columns: "abc" } };
+    expect(fitContext(context)).toBe(context);
+  });
+});
+
+describe("the 8-row list", () => {
+  it("shows at most 8 rows, newest first", () => {
+    const entries = Array.from({ length: 12 }, (_, i) =>
+      entry({ id: `e${i}`, query: `q${i % 10}`, updated_at: NOW_US - i * HOUR_US }),
+    );
+    const view = buildRecents(entries);
+    expect(view.rows.map((r) => r.entry.id)).toEqual([
+      "e0",
+      "e1",
+      "e2",
+      "e3",
+      "e4",
+      "e5",
+      "e6",
+      "e7",
+    ]);
+    expect(view.pinnedFailure).toBeNull();
+  });
+
+  it("pins the newest run when it failed and leaves older failures out of the rows", () => {
+    const view = buildRecents([
+      entry({ id: "fail", query: "bad", status: "error", updated_at: NOW_US }),
+      entry({ id: "ok", query: "good", updated_at: NOW_US - HOUR_US }),
+      entry({ id: "old-fail", query: "worse", status: "error", updated_at: NOW_US - 2 * HOUR_US }),
+    ]);
+    expect(view.pinnedFailure?.entry.id).toBe("fail");
+    expect(view.rows.map((r) => r.entry.id)).toEqual(["ok"]);
+  });
+
+  it("keeps the pinned failure inside the 8 rows", () => {
+    const entries = [
+      entry({ id: "fail", query: "bad", status: "error", updated_at: NOW_US }),
+      ...Array.from({ length: 10 }, (_, i) =>
+        entry({ id: `e${i}`, query: `q${i}`, updated_at: NOW_US - (i + 1) * HOUR_US }),
+      ),
+    ];
+    expect(buildRecents(entries).rows).toHaveLength(7);
+  });
+
+  it("shows each entry as its own row, starred only by its own flag", () => {
+    const view = buildRecents([
+      entry({ id: "sql", updated_at: NOW_US }),
+      entry({
+        id: "other-stream",
+        streams: ["other"],
+        starred: true,
+        updated_at: NOW_US - HOUR_US,
+      }),
+    ]);
+    expect(view.rows.map((r) => [r.entry.id, r.starred])).toEqual([
+      ["sql", false],
+      ["other-stream", true],
+    ]);
+  });
+});
+
+describe("autocomplete matches", () => {
+  const queries = recentQueryList([
+    entry({ id: "a", query: "level = 'error' and ns = 'checkout'", updated_at: NOW_US }),
+    entry({ id: "b", query: "ns = 'cart' and level = 'warn'", updated_at: NOW_US - 1 }),
+    entry({ id: "c", query: "broken", status: "error", updated_at: NOW_US - 2 }),
+  ]);
+
+  it("offers recent queries containing the typed text, prefix matches first", () => {
+    expect(matchRecentQueries(queries, "LEVEL")).toEqual([
+      "level = 'error' and ns = 'checkout'",
+      "ns = 'cart' and level = 'warn'",
+    ]);
+    expect(matchRecentQueries(queries, "ns =")).toEqual([
+      "ns = 'cart' and level = 'warn'",
+      "level = 'error' and ns = 'checkout'",
+    ]);
+  });
+
+  it("needs two characters and never offers failed or identical queries", () => {
+    expect(matchRecentQueries(queries, "l")).toEqual([]);
+    expect(matchRecentQueries(queries, "broken")).toEqual([]);
+    expect(matchRecentQueries(queries, "ns = 'cart' and level = 'warn'")).toEqual([]);
+  });
+
+  it("flattens a list's queries once, then only the typed text on each keystroke", () => {
+    const list = ["level = 'error'", "ns = 'cart'", "status = 500"];
+    const lower = vi.spyOn(String.prototype, "toLowerCase");
+    try {
+      expect(matchRecentQueries(list, "le")).toEqual(["level = 'error'"]);
+      expect(lower).toHaveBeenCalledTimes(list.length + 1);
+      lower.mockClear();
+      expect(matchRecentQueries(list, "lev")).toEqual(["level = 'error'"]);
+      expect(matchRecentQueries(list, "ns")).toEqual(["ns = 'cart'"]);
+      expect(lower).toHaveBeenCalledTimes(2);
+      lower.mockClear();
+      matchRecentQueries([...list], "lev");
+      expect(lower).toHaveBeenCalledTimes(list.length + 1);
+    } finally {
+      lower.mockRestore();
+    }
+  });
+});
+
+describe("restore time", () => {
+  it("re-runs a row that last ran today ending now, an older one at its own window", () => {
+    expect(defaultRestoreTime(entry({ updated_at: NOW_US - HOUR_US }), NOW_MS)).toBe("now");
+    expect(defaultRestoreTime(entry({ updated_at: NOW_US - 24 * HOUR_US }), NOW_MS)).toBe(
+      "original",
+    );
+  });
+
+  it("restores a relative run as its period now and as its absolute window at original time", () => {
+    const time = { type: "relative" as const, period: "15m", start_time: 10, end_time: 20 };
+    expect(restoreWindow(time, "now")).toEqual({ type: "relative", period: "15m" });
+    expect(restoreWindow(time, "original")).toEqual({
+      type: "absolute",
+      startUs: 10,
+      endUs: 20,
+    });
+  });
+
+  it("moves an absolute run's span to end now", () => {
+    const time = { type: "absolute" as const, start_time: 100, end_time: 400 };
+    expect(restoreWindow(time, "now", 1000)).toEqual({
+      type: "absolute",
+      startUs: 700,
+      endUs: 1000,
+    });
+    expect(restoreWindow(undefined, "now")).toBeNull();
+  });
+});
+
+describe("drawer helpers", () => {
+  it("groups rows by the local day they last ran", () => {
+    const groups = groupByDay(
+      [
+        entry({ id: "a", updated_at: NOW_US }),
+        entry({ id: "b", updated_at: NOW_US - HOUR_US }),
+        entry({ id: "c", updated_at: NOW_US - 24 * HOUR_US }),
+      ],
+      NOW_MS,
+    );
+    expect(groups.map((g) => [g.daysAgo, g.entries.map((e) => e.id)])).toEqual([
+      [0, ["a", "b"]],
+      [1, ["c"]],
+    ]);
+  });
+
+  it("cuts days in the given timezone, so a late-evening UTC run is the next day in Kolkata", () => {
+    const now = Date.UTC(2026, 9, 28, 12, 0);
+    const lateEvening = entry({ id: "late", updated_at: Date.UTC(2026, 9, 27, 23, 30) * 1000 });
+    expect(groupByDay([lateEvening], now, "UTC")[0].daysAgo).toBe(1);
+    expect(groupByDay([lateEvening], now, "Asia/Kolkata")[0].daysAgo).toBe(0);
+    expect(groupByDay([lateEvening], now, "Asia/Kolkata")[0].dayMs).toBe(
+      Date.UTC(2026, 9, 27, 18, 30),
+    );
+    expect(defaultRestoreTime(lateEvening, now, "UTC")).toBe("original");
+    expect(defaultRestoreTime(lateEvening, now, "Asia/Kolkata")).toBe("now");
+  });
+
+  it("turns a Ran on date into that day's bounds in the given timezone", () => {
+    const bounds = dayBoundsUs("2026-10-27", "Asia/Kolkata");
+    expect(bounds?.ran_from).toBe(Date.UTC(2026, 9, 26, 18, 30) * 1000);
+    expect(bounds?.ran_to).toBe(Date.UTC(2026, 9, 27, 18, 30) * 1000 - 1);
+    expect(dayBoundsUs("2026-02-31", "UTC")).toBeNull();
+  });
+
+  it("turns a Ran on date into local-day bounds in microseconds", () => {
+    const bounds = dayBoundsUs("2026-10-27");
+    expect(bounds?.ran_from).toBe(new Date(2026, 9, 27).getTime() * 1000);
+    expect(bounds?.ran_to).toBe(new Date(2026, 9, 28).getTime() * 1000 - 1);
+    expect(dayBoundsUs("yesterday")).toBeNull();
+  });
+});
+
+describe("editor keys routed to the open recent-searches dropdown", () => {
+  const dispatch = (
+    key: string,
+    init: KeyboardEventInit = {},
+    dropdown = { focusFirst: vi.fn(() => true), pickActive: vi.fn(() => true) },
+    suggestOpen = false,
+  ) => {
+    const box = document.createElement("div");
+    if (suggestOpen) {
+      const widget = document.createElement("div");
+      widget.className = "suggest-widget visible";
+      box.appendChild(widget);
+    }
+    const monaco = document.createElement("div");
+    monaco.className = "monaco-editor";
+    const editor = document.createElement("textarea");
+    monaco.appendChild(editor);
+    box.appendChild(monaco);
+    const close = vi.fn();
+    box.addEventListener("keydown", (e) => routeEditorKeyToRecents(e, dropdown, close), true);
+    const editorSaw = vi.fn();
+    editor.addEventListener("keydown", editorSaw);
+    const event = new KeyboardEvent("keydown", { key, bubbles: true, cancelable: true, ...init });
+    editor.dispatchEvent(event);
+    return { event, close, dropdown, editorSaw };
+  };
+
+  it("closes on Escape and still lets the editor handle it", () => {
+    const { event, close, editorSaw } = dispatch("Escape");
+    expect(close).toHaveBeenCalledOnce();
+    expect(editorSaw).toHaveBeenCalledOnce();
+    expect(event.defaultPrevented).toBe(false);
+  });
+
+  it("hands ArrowDown to the list", () => {
+    const { event, dropdown } = dispatch("ArrowDown");
+    expect(dropdown.focusFirst).toHaveBeenCalledOnce();
+    expect(event.defaultPrevented).toBe(true);
+  });
+
+  it("takes Enter and Shift+Enter for the row the user pointed at, so the editor adds no newline", () => {
+    for (const shiftKey of [false, true]) {
+      const { event, dropdown, editorSaw } = dispatch("Enter", { shiftKey });
+      expect(dropdown.pickActive).toHaveBeenCalledWith(event);
+      expect(event.defaultPrevented).toBe(true);
+      expect(editorSaw).not.toHaveBeenCalled();
+    }
+  });
+
+  it("leaves Ctrl/Cmd+Enter (run query) and Tab to the editor", () => {
+    for (const [key, init] of [
+      ["Enter", { ctrlKey: true }],
+      ["Enter", { metaKey: true }],
+      ["Tab", {}],
+    ] as const) {
+      const { event, dropdown, editorSaw } = dispatch(key, init);
+      expect(dropdown.pickActive).not.toHaveBeenCalled();
+      expect(event.defaultPrevented).toBe(false);
+      expect(editorSaw).toHaveBeenCalledOnce();
+    }
+  });
+
+  it("leaves arrows and Enter to the editor's open suggestion list", () => {
+    for (const key of ["ArrowDown", "Enter"]) {
+      const { event, dropdown, editorSaw } = dispatch(key, {}, undefined, true);
+      expect(dropdown.focusFirst).not.toHaveBeenCalled();
+      expect(dropdown.pickActive).not.toHaveBeenCalled();
+      expect(event.defaultPrevented).toBe(false);
+      expect(editorSaw).toHaveBeenCalledOnce();
+    }
+  });
+
+  it("hands PageDown and PageUp to the active row's details", () => {
+    for (const [key, step] of [
+      ["PageDown", 1],
+      ["PageUp", -1],
+    ] as const) {
+      const dropdown = {
+        focusFirst: vi.fn(() => true),
+        pickActive: vi.fn(() => true),
+        scrollDetails: vi.fn(() => true),
+      };
+      const { event, editorSaw } = dispatch(key, {}, dropdown);
+      expect(dropdown.scrollDetails).toHaveBeenCalledWith(step);
+      expect(event.defaultPrevented).toBe(true);
+      expect(editorSaw).not.toHaveBeenCalled();
+    }
+  });
+
+  it("leaves PageDown to the editor when no row is active, or the list cannot scroll details", () => {
+    const idle = {
+      focusFirst: vi.fn(() => true),
+      pickActive: vi.fn(() => true),
+      scrollDetails: vi.fn(() => false),
+    };
+    for (const dropdown of [idle, undefined]) {
+      const { event, editorSaw } = dispatch("PageDown", {}, dropdown);
+      expect(event.defaultPrevented).toBe(false);
+      expect(editorSaw).toHaveBeenCalledOnce();
+    }
+  });
+
+  it("leaves PageDown to the editor's open suggestion list", () => {
+    const dropdown = {
+      focusFirst: vi.fn(() => true),
+      pickActive: vi.fn(() => true),
+      scrollDetails: vi.fn(() => true),
+    };
+    const { event } = dispatch("PageDown", {}, dropdown, true);
+    expect(dropdown.scrollDetails).not.toHaveBeenCalled();
+    expect(event.defaultPrevented).toBe(false);
+  });
+
+  it("keeps ArrowDown in an editor that already holds text, such as the Logs SQL template", () => {
+    const dropdown = { focusFirst: vi.fn(() => true), pickActive: vi.fn(() => false) };
+    const box = document.createElement("div");
+    const monaco = document.createElement("div");
+    monaco.className = "monaco-editor";
+    const editor = document.createElement("textarea");
+    monaco.appendChild(editor);
+    box.appendChild(monaco);
+    box.addEventListener(
+      "keydown",
+      (e) => routeEditorKeyToRecents(e, dropdown, vi.fn(), false),
+      true,
+    );
+    const editorSaw = vi.fn();
+    editor.addEventListener("keydown", editorSaw);
+    for (const key of ["ArrowDown", "ArrowUp", "Enter"]) {
+      const event = new KeyboardEvent("keydown", { key, bubbles: true, cancelable: true });
+      editor.dispatchEvent(event);
+      expect(event.defaultPrevented).toBe(false);
+    }
+    expect(dropdown.focusFirst).not.toHaveBeenCalled();
+    expect(editorSaw).toHaveBeenCalledTimes(3);
+  });
+
+  it("lets Enter through as the editor's newline when no row is active", () => {
+    const empty = { focusFirst: vi.fn(() => false), pickActive: vi.fn(() => false) };
+    const { event, editorSaw } = dispatch("Enter", { shiftKey: true }, empty);
+    expect(event.defaultPrevented).toBe(false);
+    expect(editorSaw).toHaveBeenCalledOnce();
+  });
+
+  it("ignores keys from other controls in the editor box, such as the AI prompt", () => {
+    const dropdown = { focusFirst: vi.fn(() => true), pickActive: vi.fn(() => true) };
+    const box = document.createElement("div");
+    const prompt = document.createElement("input");
+    box.appendChild(prompt);
+    const close = vi.fn();
+    box.addEventListener("keydown", (e) => routeEditorKeyToRecents(e, dropdown, close), true);
+    for (const [key, shiftKey] of [
+      ["Enter", false],
+      ["Enter", true],
+      ["ArrowDown", false],
+      ["Escape", false],
+    ] as const) {
+      const event = new KeyboardEvent("keydown", {
+        key,
+        shiftKey,
+        bubbles: true,
+        cancelable: true,
+      });
+      prompt.dispatchEvent(event);
+      expect(event.defaultPrevented).toBe(false);
+    }
+    expect(dropdown.pickActive).not.toHaveBeenCalled();
+    expect(dropdown.focusFirst).not.toHaveBeenCalled();
+    expect(close).not.toHaveBeenCalled();
+  });
+});
+
+describe("focus dropdown after an edit", () => {
+  it("opens when an edit empties the editor and closes on the next character", () => {
+    expect(recentsOpenAfterEdit(false, false, true)).toBe(true);
+    expect(recentsOpenAfterEdit(true, true, false)).toBe(false);
+    expect(recentsOpenAfterEdit(false, false, false)).toBe(false);
+  });
+
+  it("stays open while the editor stays empty", () => {
+    expect(recentsOpenAfterEdit(true, true, true)).toBe(true);
+  });
+
+  it("stays dismissed until the editor is emptied again", () => {
+    expect(recentsOpenAfterEdit(false, true, true)).toBe(false);
+    expect(recentsOpenAfterEdit(false, true, false)).toBe(false);
+    expect(recentsOpenAfterEdit(false, false, true)).toBe(true);
+  });
+});
diff --git a/web/src/utils/queryHistory/recentSearches.ts b/web/src/utils/queryHistory/recentSearches.ts
new file mode 100644
index 0000000000..2515074797
--- /dev/null
+++ b/web/src/utils/queryHistory/recentSearches.ts
@@ -0,0 +1,313 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { DateTime } from "luxon";
+import type {
+  HistoryContext,
+  HistorySource,
+  HistoryStatus,
+  HistoryTime,
+  QueryHistoryEntry,
+} from "@/services/query_history";
+
+/** Rows in the focus dropdown and the clock-button popover. */
+export const POPOVER_ROWS = 8;
+/** Clock rows offered in autocomplete while typing. */
+export const AUTOCOMPLETE_ROWS = 5;
+const MAX_CONTEXT_BYTES = 64 * 1024;
+// Keyed by the list itself: autocomplete asks on every keystroke, the list changes only when a run lands.
+const flatQueryCache = new WeakMap<readonly string[], string[]>();
+const MAX_MESSAGE_CHARS = 1000;
+const CANCELLED_CODE = 20009;
+const TIMEOUT_CODE = 20010;
+const QUERY_ERROR_CODES = new Set([20001, 20002, 20003, 20004, 20005, 20007, 20008, 20011]);
+const DAY_MS = 86_400_000;
+
+export interface KeyParts {
+  streams: string[];
+  streamType: string;
+  mode: string;
+  query: string;
+  vrl?: string;
+}
+
+/** The pages with recent searches; "All pages" lists, counts and clears exactly these, never dbm or profiles. */
+export const HISTORY_SOURCES: readonly HistorySource[] = ["logs", "traces", "metrics"];
+
+/** A failed run as the page saw it: the search error code, the HTTP status, the message. */
+export interface RunError {
+  code?: number;
+  httpStatus?: number;
+  message?: string;
+}
+
+export interface RunResult {
+  status: HistoryStatus;
+  error?: string;
+  warning?: string;
+}
+
+export interface RecentRow {
+  entry: QueryHistoryEntry;
+  starred: boolean;
+}
+
+export interface RecentsView {
+  pinnedFailure: RecentRow | null;
+  rows: RecentRow[];
+}
+
+export type RestoreTime = "now" | "original";
+
+export type RestoreWindow =
+  { type: "relative"; period: string } | { type: "absolute"; startUs: number; endUs: number };
+
+/** What an editor needs from its open recent-searches dropdown to hand it keys. */
+export interface RecentsKeyTarget {
+  focusFirst: () => boolean;
+  pickActive: (event: KeyboardEvent) => boolean;
+  scrollDetails?: (step: 1 | -1) => boolean;
+}
+
+export interface DayGroup {
+  /** Local midnight of the day, in milliseconds. */
+  dayMs: number;
+  /** 0 for today, 1 for yesterday, and so on. */
+  daysAgo: number;
+  entries: QueryHistoryEntry[];
+}
+
+/** Runs with the same streams, mode, query and VRL merge into one row, however far apart they ran. */
+export const buildQueryKey = (parts: KeyParts): string =>
+  JSON.stringify([
+    [...parts.streams].sort(),
+    parts.streamType,
+    parts.mode,
+    parts.query,
+    parts.vrl ?? "",
+  ]);
+
+/** Message text without HTML markup, capped so the context stays small. */
+export const plainMessage = (message: unknown): string =>
+  String(message ?? "")
+    // Only HTML tags: PromQL errors quote tokens such as `<EOF>`.
+    .replace(/<\/?(br|span|b|i|em|strong|p|div|code)\b[^>]*>/gi, " ")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, MAX_MESSAGE_CHARS);
+
+/** A search error from any transport; a streamed error event carries the HTTP status in `code`. */
+export const toRunError = (error: {
+  code?: unknown;
+  status?: unknown;
+  message?: unknown;
+}): RunError => {
+  const code = Number(error.code);
+  const status = Number(error.status);
+  const httpStatus = status >= 100 && status < 600 ? status : undefined;
+  return {
+    ...(code >= 20000 ? { code } : {}),
+    ...(code >= 100 && code < 600 && httpStatus === undefined ? { httpStatus: code } : {}),
+    ...(httpStatus !== undefined ? { httpStatus } : {}),
+    message: String(error.message ?? ""),
+  };
+};
+
+/** Null for a cancelled run, which is never recorded; only query errors count as failures. */
+export const runResultFromError = (err: RunError): RunResult | null => {
+  if (err.code === CANCELLED_CODE) return null;
+  const message = plainMessage(err.message);
+  const timedOut = err.code === TIMEOUT_CODE || err.httpStatus === 408 || err.httpStatus === 504;
+  if (timedOut) return { status: "ok", warning: message };
+  const clientError =
+    err.httpStatus !== undefined &&
+    err.httpStatus >= 400 &&
+    err.httpStatus < 500 &&
+    err.httpStatus !== 429;
+  if ((err.code !== undefined && QUERY_ERROR_CODES.has(err.code)) || clientError) {
+    return { status: "error", error: message };
+  }
+  return { status: "ok", warning: message };
+};
+
+export const resultContext = (result: RunResult): Pick<HistoryContext, "error" | "warning"> => ({
+  ...(result.error !== undefined ? { error: result.error } : {}),
+  ...(result.warning !== undefined ? { warning: result.warning } : {}),
+});
+
+const jsonBytes = (value: unknown) => new TextEncoder().encode(JSON.stringify(value)).length;
+
+/** The backend refuses a context over 64 KB; columns go first, the query, VRL and time never. */
+export const fitContext = (context: HistoryContext): HistoryContext => {
+  if (jsonBytes(context) <= MAX_CONTEXT_BYTES || !context.page?.columns) return context;
+  const page = { ...context.page };
+  delete page.columns;
+  return { ...context, page };
+};
+
+/** The 8-row list: newest first, one row per entry, the latest failure pinned on top. */
+export const buildRecents = (entries: QueryHistoryEntry[], limit = POPOVER_ROWS): RecentsView => {
+  const sorted = [...entries].sort((a, b) => b.updated_at - a.updated_at);
+  const toRow = (entry: QueryHistoryEntry): RecentRow => ({ entry, starred: entry.starred });
+  const pinned = sorted[0]?.status === "error" ? sorted[0] : null;
+  const rows = sorted
+    .filter((e) => e.status !== "error")
+    .slice(0, pinned ? limit - 1 : limit)
+    .map(toRow);
+  return { pinnedFailure: pinned ? toRow(pinned) : null, rows };
+};
+
+/** Recent successful queries, newest first, each text once: autocomplete only replaces the editor text. */
+export const recentQueryList = (entries: QueryHistoryEntry[]): string[] => [
+  ...new Set(buildRecents(entries, entries.length).rows.map(({ entry }) => entry.query.trim())),
+];
+
+const flatQuery = (text: string) => text.replace(/\s+/g, " ").trim().toLowerCase();
+
+const flatQueries = (queries: readonly string[]): string[] => {
+  let flat = flatQueryCache.get(queries);
+  if (!flat) {
+    flat = queries.map(flatQuery);
+    flatQueryCache.set(queries, flat);
+  }
+  return flat;
+};
+
+/** Recent queries that contain the typed text, prefix matches first. */
+export const matchRecentQueries = (
+  queries: string[],
+  typed: string,
+  limit = AUTOCOMPLETE_ROWS,
+): string[] => {
+  const needle = flatQuery(typed);
+  if (needle.length < 2) return [];
+  const flat = flatQueries(queries);
+  return queries
+    .map((query, i) => ({ query, at: flat[i].indexOf(needle), same: flat[i] === needle }))
+    .filter(({ at, same }) => at >= 0 && !same)
+    .sort((a, b) => Number(b.at === 0) - Number(a.at === 0))
+    .slice(0, limit)
+    .map(({ query }) => query);
+};
+
+const zoned = (zone?: string) => (zone ? { zone } : {});
+
+const dayStart = (ms: number, zone?: string) =>
+  DateTime.fromMillis(ms, zoned(zone)).startOf("day").toMillis();
+
+/** Re-run over a window ending now when the row last ran today; otherwise at its own window. */
+export const defaultRestoreTime = (
+  entry: QueryHistoryEntry,
+  now = Date.now(),
+  zone?: string,
+): RestoreTime =>
+  dayStart(entry.updated_at / 1000, zone) === dayStart(now, zone) ? "now" : "original";
+
+/** The window a restore applies, or null when the row carries no time. */
+export const restoreWindow = (
+  time: HistoryTime | undefined,
+  when: RestoreTime,
+  nowUs = Date.now() * 1000,
+): RestoreWindow | null => {
+  if (!time) return null;
+  if (when === "original") {
+    return { type: "absolute", startUs: time.start_time, endUs: time.end_time };
+  }
+  if (time.type === "relative" && time.period) return { type: "relative", period: time.period };
+  const span = Math.max(0, time.end_time - time.start_time);
+  return { type: "absolute", startUs: nowUs - span, endUs: nowUs };
+};
+
+/** Rows grouped by the day they last ran in `zone` (the browser's when unset), newest day first. */
+export const groupByDay = (
+  entries: QueryHistoryEntry[],
+  now = Date.now(),
+  zone?: string,
+): DayGroup[] => {
+  const today = dayStart(now, zone);
+  const groups = new Map<number, DayGroup>();
+  for (const entry of entries) {
+    const dayMs = dayStart(entry.updated_at / 1000, zone);
+    let group = groups.get(dayMs);
+    if (!group) {
+      group = { dayMs, daysAgo: Math.round((today - dayMs) / DAY_MS), entries: [] };
+      groups.set(dayMs, group);
+    }
+    group.entries.push(entry);
+  }
+  return [...groups.values()].sort((a, b) => b.dayMs - a.dayMs);
+};
+
+/** Bounds of a `YYYY-MM-DD` day in `zone`, in microseconds, for the "Ran on" filter. */
+export const dayBoundsUs = (
+  date: string,
+  zone?: string,
+): { ran_from: number; ran_to: number } | null => {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) return null;
+  const start = DateTime.fromISO(date, zoned(zone)).startOf("day");
+  if (!start.isValid) return null;
+  return {
+    ran_from: start.toMillis() * 1000,
+    ran_to: start.plus({ days: 1 }).toMillis() * 1000 - 1,
+  };
+};
+
+/** Absolute URL of a page route with its query string. */
+export const absoluteLink = (href: string, origin = window.location.origin): string =>
+  new URL(href, origin).href;
+
+/** After an edit the focus dropdown shows only on an empty editor, and reopens only when the edit empties it. */
+export const recentsOpenAfterEdit = (open: boolean, wasEmpty: boolean, isEmpty: boolean): boolean =>
+  isEmpty && (open || !wasEmpty);
+
+/** True inside the Monaco query editor itself, not the AI prompt or buttons that share its box. */
+export const isQueryEditorInput = (target: EventTarget | null): boolean => {
+  const el = target instanceof Node && !(target instanceof Element) ? target.parentElement : target;
+  return el instanceof Element && !!el.closest(".monaco-editor");
+};
+
+/** Routes an editor key to its open recent-searches dropdown; bind in the capture phase. */
+export const routeEditorKeyToRecents = (
+  event: KeyboardEvent,
+  dropdown: RecentsKeyTarget | null,
+  close: () => void,
+  /** False while the editor holds text, such as the Logs SQL template, so ArrowDown stays a cursor move. */
+  arrowsToList = true,
+) => {
+  if (!isQueryEditorInput(event.target)) return;
+  if (event.key === "Escape") {
+    close();
+    return;
+  }
+  // The editor's own suggestion list keeps its arrows and Enter.
+  const box = event.currentTarget instanceof Element ? event.currentTarget : null;
+  if (box?.querySelector(".suggest-widget.visible")) return;
+  const page = event.key === "PageDown" ? 1 : event.key === "PageUp" ? -1 : 0;
+  if (page && dropdown?.scrollDetails?.(page)) {
+    event.preventDefault();
+    event.stopPropagation();
+    return;
+  }
+  if (event.key === "ArrowDown" && arrowsToList && dropdown?.focusFirst()) {
+    event.preventDefault();
+    return;
+  }
+  const plainEnter = event.key === "Enter" && !event.ctrlKey && !event.metaKey && !event.altKey;
+  // Enter picks only a row the user pointed at; otherwise it stays the editor's newline.
+  if (plainEnter && dropdown?.pickActive(event)) {
+    event.preventDefault();
+    event.stopPropagation();
+  }
+};
diff --git a/web/src/utils/queryHistory/routes.spec.ts b/web/src/utils/queryHistory/routes.spec.ts
new file mode 100644
index 0000000000..5dc65ebbd4
--- /dev/null
+++ b/web/src/utils/queryHistory/routes.spec.ts
@@ -0,0 +1,131 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { Router } from "vue-router";
+import type { QueryHistoryEntry } from "@/services/query_history";
+import { LOGS_REAPPLY_TYPE } from "./logs";
+import { openRecentOnItsPage, recentSearchRoute, takeRecentLanding } from "./routes";
+import { landingRouter, landWithoutRestore } from "@/test/unit/helpers/recentLanding";
+
+const logsRow: QueryHistoryEntry = {
+  id: "l1",
+  source: "logs",
+  query: 'SELECT * FROM "app"',
+  query_key: "k",
+  streams: ["app"],
+  context: { page: { stream: "app", stream_type: "logs" } },
+  status: "ok",
+  starred: false,
+  run_count: 1,
+  created_at: 1,
+  updated_at: 2,
+};
+
+describe("recentSearchRoute", () => {
+  it("marks a Logs restore as a re-apply, so it replaces the page's cached query, but not a shared link", () => {
+    expect(recentSearchRoute(logsRow, "original", "org1", "run")?.query.type).toBe(
+      LOGS_REAPPLY_TYPE,
+    );
+    expect(recentSearchRoute(logsRow, "original", "org1", "load")?.query.type).toBe(
+      LOGS_REAPPLY_TYPE,
+    );
+    expect(recentSearchRoute(logsRow, "original", "org1", "link")?.query.type).toBeUndefined();
+  });
+});
+
+describe("restores that open another page", () => {
+  const tracesRow: QueryHistoryEntry = {
+    ...logsRow,
+    id: "t1",
+    source: "traces",
+    streams: ["default"],
+  };
+  // A push that never lands: the history entry keeps whatever state the test put there.
+  const pushThat = (result: Promise<unknown>) =>
+    ({ push: vi.fn(() => result) }) as unknown as Router & { push: ReturnType<typeof vi.fn> };
+  const pushedState = (router: { push: ReturnType<typeof vi.fn> }) =>
+    (router.push.mock.calls.at(-1)?.[0] as { state: Record<string, unknown> }).state;
+
+  afterEach(() => {
+    vi.useRealTimers();
+    landWithoutRestore();
+  });
+
+  it("is claimed once, by the navigation it pushed, as a load or a run", async () => {
+    const { router, push } = landingRouter();
+    await openRecentOnItsPage(router, logsRow, "now", "org1", false);
+    expect(push).toHaveBeenCalledWith(
+      expect.objectContaining({
+        path: "/logs",
+        query: expect.objectContaining({ type: LOGS_REAPPLY_TYPE }),
+        state: { recentRestore: expect.any(String) },
+      }),
+    );
+    expect(takeRecentLanding("traces")).toBeNull();
+    expect(takeRecentLanding("logs")).toEqual({ run: false });
+    expect(takeRecentLanding("logs")).toBeNull();
+
+    await openRecentOnItsPage(router, logsRow, "now", "org1", true);
+    expect(takeRecentLanding("logs")).toEqual({ run: true });
+  });
+
+  it("is neither claimed nor cleared by another navigation, a reload or a link", async () => {
+    const router = pushThat(new Promise(() => {}));
+    void openRecentOnItsPage(router, logsRow, "now", "org1", true);
+    const ours = pushedState(router);
+    landWithoutRestore();
+    expect(takeRecentLanding("logs")).toBeNull();
+    window.history.replaceState({ ...ours }, "");
+    expect(takeRecentLanding("logs")).toEqual({ run: true });
+  });
+
+  it("keeps a second restore when the first one's navigation is cancelled or rejected", async () => {
+    let failFirst: (failure: unknown) => void = () => {};
+    let rejectSecond: (error: unknown) => void = () => {};
+    const first = pushThat(new Promise((resolve) => (failFirst = resolve)));
+    const second = pushThat(new Promise(() => {}));
+    const third = pushThat(new Promise((_, reject) => (rejectSecond = reject)));
+    const cancelled = openRecentOnItsPage(first, logsRow, "now", "org1", false);
+    void openRecentOnItsPage(second, logsRow, "now", "org1", true);
+    const rejected = openRecentOnItsPage(third, tracesRow, "now", "org1", true);
+    failFirst({ type: 8 });
+    rejectSecond(new Error("guard threw"));
+    await cancelled;
+    await rejected;
+
+    window.history.replaceState({ ...pushedState(first) }, "");
+    expect(takeRecentLanding("logs")).toBeNull();
+    window.history.replaceState({ ...pushedState(third) }, "");
+    expect(takeRecentLanding("traces")).toBeNull();
+    window.history.replaceState({ ...pushedState(second) }, "");
+    expect(takeRecentLanding("logs")).toEqual({ run: true });
+  });
+
+  it("expires when its page has not claimed it within 30 seconds", async () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-10-28T10:00:00Z"));
+    const { router } = landingRouter();
+    await openRecentOnItsPage(router, logsRow, "now", "org1", true);
+    vi.setSystemTime(new Date("2026-10-28T10:00:31Z"));
+    expect(takeRecentLanding("logs")).toBeNull();
+  });
+
+  it("carries nothing to a page opened from a link, a reload or a bookmark", () => {
+    landWithoutRestore();
+    expect(takeRecentLanding("logs")).toBeNull();
+    expect(takeRecentLanding("metrics")).toBeNull();
+  });
+});
diff --git a/web/src/utils/queryHistory/routes.ts b/web/src/utils/queryHistory/routes.ts
new file mode 100644
index 0000000000..c49cf003a9
--- /dev/null
+++ b/web/src/utils/queryHistory/routes.ts
@@ -0,0 +1,95 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { Router } from "vue-router";
+import type { HistorySource, QueryHistoryEntry } from "@/services/query_history";
+import { logsRouteQuery } from "./logs";
+import { metricsRouteQuery } from "./metrics";
+import { tracesRouteQuery } from "./traces";
+import type { RestoreTime } from "./recentSearches";
+
+export interface RecentSearchRoute {
+  path: string;
+  query: Record<string, string>;
+}
+
+/** `run` and `load` restore the row on its page; `link` is a shareable URL the page opens as any landing. */
+export type RecentRouteMode = "run" | "load" | "link";
+
+// History state, not the URL, so a copied or shared link never carries the restore.
+const LANDING_STATE_KEY = "recentRestore";
+const LANDING_TTL_MS = 30_000;
+
+interface RecentLanding {
+  source: HistorySource;
+  run: boolean;
+  at: number;
+}
+
+// In memory, so a reload, a bookmark or a shared link never repeats a restore or records a run.
+const pendingLandings = new Map<string, RecentLanding>();
+let landingSeq = 0;
+
+/** Where a row reopens; a restore also replaces whatever the page had cached. */
+export const recentSearchRoute = (
+  entry: QueryHistoryEntry,
+  when: RestoreTime,
+  orgId: string,
+  mode: RecentRouteMode,
+): RecentSearchRoute | null => {
+  if (entry.source === "logs") {
+    return { path: "/logs", query: logsRouteQuery(entry, when, orgId, mode !== "link") };
+  }
+  if (entry.source === "traces") {
+    return { path: "/traces", query: { ...tracesRouteQuery(entry, when, orgId), reload: "true" } };
+  }
+  if (entry.source === "metrics") {
+    const query = metricsRouteQuery(entry, when, orgId);
+    return query ? { path: "/metrics", query } : null;
+  }
+  return null;
+};
+
+/** Opens another page's row on that page, which runs it only when `run` is set. */
+export const openRecentOnItsPage = (
+  router: Router,
+  entry: QueryHistoryEntry,
+  when: RestoreTime,
+  orgId: string,
+  run: boolean,
+) => {
+  const route = recentSearchRoute(entry, when, orgId, run ? "run" : "load");
+  if (!route) return;
+  landingSeq += 1;
+  const nonce = `${Date.now()}-${landingSeq}`;
+  pendingLandings.set(nonce, { source: entry.source, run, at: Date.now() });
+  const drop = () => pendingLandings.delete(nonce);
+  return router.push({ ...route, state: { [LANDING_STATE_KEY]: nonce } }).then((failure) => {
+    if (failure) drop();
+  }, drop);
+};
+
+/** The restore this navigation was pushed for, once; null for any other landing, which leaves other restores pending. */
+export const takeRecentLanding = (source: HistorySource): { run: boolean } | null => {
+  const now = Date.now();
+  for (const [nonce, landing] of pendingLandings) {
+    if (now - landing.at > LANDING_TTL_MS) pendingLandings.delete(nonce);
+  }
+  const nonce: unknown = window.history.state?.[LANDING_STATE_KEY];
+  const landing = typeof nonce === "string" ? pendingLandings.get(nonce) : undefined;
+  if (!landing || landing.source !== source) return null;
+  pendingLandings.delete(nonce as string);
+  return { run: landing.run };
+};
diff --git a/web/src/utils/queryHistory/traces.ts b/web/src/utils/queryHistory/traces.ts
new file mode 100644
index 0000000000..68323ca0f0
--- /dev/null
+++ b/web/src/utils/queryHistory/traces.ts
@@ -0,0 +1,96 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type {
+  HistoryTime,
+  QueryHistoryEntry,
+  QueryHistoryRecordBody,
+} from "@/services/query_history";
+import { b64EncodeUnicode } from "@/utils/formatters";
+import {
+  buildQueryKey,
+  fitContext,
+  restoreWindow,
+  resultContext,
+  type RestoreTime,
+  type RestoreWindow,
+  type RunResult,
+} from "./recentSearches";
+
+/** First-time examples; every traces stream carries these fields. */
+export const TRACES_EXAMPLE_QUERIES = ["span_status = 'ERROR'", "duration > 1000000"];
+
+export interface TracesRunRecordInput {
+  stream: string;
+  /** `traces` or `spans`. */
+  searchMode: string;
+  query: string;
+  time: HistoryTime;
+  result: RunResult;
+}
+
+/** What the Traces page applies to reopen a row. */
+export interface TracesRestore {
+  stream: string;
+  searchMode: string;
+  query: string;
+  window: RestoreWindow | null;
+}
+
+/** The record for a settled Traces run, or null when there is no filter text to keep. */
+export const buildTracesRecord = (input: TracesRunRecordInput): QueryHistoryRecordBody | null => {
+  const query = input.query.trim();
+  if (!query || !input.stream) return null;
+  const streams = [input.stream];
+  return {
+    source: "traces",
+    query,
+    query_key: buildQueryKey({ streams, streamType: "traces", mode: input.searchMode, query }),
+    streams,
+    status: input.result.status,
+    context: fitContext({
+      page: { stream: input.stream, tab: input.searchMode },
+      time: input.time,
+      ...resultContext(input.result),
+    }),
+  };
+};
+
+export const tracesRestore = (entry: QueryHistoryEntry, when: RestoreTime): TracesRestore => ({
+  stream: entry.context.page?.stream ?? entry.streams[0] ?? "",
+  searchMode: entry.context.page?.tab ?? "traces",
+  query: entry.query,
+  window: restoreWindow(entry.context.time, when),
+});
+
+export const tracesRouteQuery = (
+  entry: QueryHistoryEntry,
+  when: RestoreTime,
+  orgId: string,
+): Record<string, string> => {
+  const restore = tracesRestore(entry, when);
+  const query: Record<string, string> = {
+    stream: restore.stream,
+    tab: restore.searchMode,
+    query: b64EncodeUnicode(restore.query) ?? "",
+    org_identifier: orgId,
+  };
+  if (restore.window?.type === "relative") query.period = restore.window.period;
+  if (restore.window?.type === "absolute") {
+    query.from = String(restore.window.startUs);
+    query.to = String(restore.window.endUs);
+  }
+  return query;
+};
diff --git a/web/src/utils/rum/dashboardCapability.spec.ts b/web/src/utils/rum/dashboardCapability.spec.ts
index 77435f0e2b..9f30ee0f20 100644
--- a/web/src/utils/rum/dashboardCapability.spec.ts
+++ b/web/src/utils/rum/dashboardCapability.spec.ts
@@ -25,6 +25,7 @@
 import { describe, it, expect } from "vitest";
 import {
   filterDashboardBySchema,
+  keepPlatformPanels,
   presentFieldsFromSchemaMap,
   CAPABILITY_GATED_FIELDS,
   type DashboardPanel,
@@ -798,4 +799,29 @@ describe("dashboardCapability", () => {
       expect(Math.min(...panels.map((p) => p.layout.x))).toBe(0);
     });
   });
+
+  describe("keepPlatformPanels", () => {
+    const panel = (i: number, y: number, o2Platform?: string) => ({
+      layout: { x: 0, y, w: 192, h: 4, i },
+      o2Platform,
+      queries: [],
+    });
+
+    it("keeps only panels tagged for the platform and packs them to the top", () => {
+      const out = keepPlatformPanels(
+        { panels: [panel(1, 0), panel(2, 4, "browser"), panel(3, 8, "mobile")] },
+        "mobile",
+      );
+      expect(out.panels).toHaveLength(1);
+      expect(out.panels?.[0].layout.y).toBe(0);
+    });
+
+    it("handles the tabs shape", () => {
+      const out = keepPlatformPanels(
+        { tabs: [{ panels: [panel(1, 0, "browser"), panel(2, 4, "mobile")] }] },
+        "mobile",
+      );
+      expect(out.tabs?.[0].panels).toHaveLength(1);
+    });
+  });
 });
diff --git a/web/src/utils/rum/dashboardCapability.ts b/web/src/utils/rum/dashboardCapability.ts
index 775465b809..1cedde0d23 100644
--- a/web/src/utils/rum/dashboardCapability.ts
+++ b/web/src/utils/rum/dashboardCapability.ts
@@ -337,6 +337,26 @@ export const filterDashboardBySchema = (
   };
 };
 
+/** Keeps only panels tagged for `platform`, reflowed; the Overview renders the rest natively. */
+export const keepPlatformPanels = (
+  dashboard: RumDashboard,
+  platform: RumPlatformKind,
+  gridWidth: number = DASHBOARD_GRID_COLUMNS,
+): RumDashboard => {
+  const pick = (panels: DashboardPanel[] = []) =>
+    reflowPanels(
+      panels.filter((p) => panelPlatform(p) === platform),
+      gridWidth,
+    );
+  if (Array.isArray(dashboard?.tabs) && !dashboard.panels?.length) {
+    return {
+      ...dashboard,
+      tabs: (dashboard.tabs ?? []).map((tab) => ({ ...tab, panels: pick(tab?.panels) })),
+    };
+  }
+  return { ...dashboard, panels: pick(dashboard?.panels) };
+};
+
 /**
  * Build the present-field Set from the `_rumdata` schema map held in `performanceState`
  * (`{ [fieldName]: field }`). Returns null when the schema isn't loaded, which callers
diff --git a/web/src/utils/rum/performanceOverview.spec.ts b/web/src/utils/rum/performanceOverview.spec.ts
new file mode 100644
index 0000000000..ef2e2f808e
--- /dev/null
+++ b/web/src/utils/rum/performanceOverview.spec.ts
@@ -0,0 +1,882 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { PAGE_KEY_PASSES } from "@/utils/rum/productAnalyticsQueries";
+import {
+  andFilters,
+  bandCounts,
+  bandOf,
+  bandPercents,
+  biggestDifference,
+  bucketInterval,
+  chartSql,
+  deltaSentenceKey,
+  formatInZone,
+  mapSegments,
+  formatCount,
+  formatPercent,
+  intervalFromKey,
+  overviewStateOnly,
+  queryFromState,
+  stateFromQuery,
+  withoutOverviewState,
+  deltaOf,
+  drillQuery,
+  fillBuckets,
+  intervalMicros,
+  filterOptionsSql,
+  formatVital,
+  analyticsQuery,
+  impactScores,
+  dropOpenBucket,
+  releaseTone,
+  kpiSql,
+  isLowData,
+  kpiDelta,
+  pageFilter,
+  overThresholdPct,
+  pagesSql,
+  previousUsable,
+  releaseNewErrorsSql,
+  previousWindow,
+  rankPages,
+  releaseRowsFromKpi,
+  releaseSessionsSql,
+  releaseVitalsSql,
+  scopeWhere,
+  segmentDims,
+  segmentsSql,
+  seriesSql,
+  splitSegments,
+  versionPredatesRange,
+  windowRow,
+  verdictOf,
+  vitalDelta,
+  vitalsSql,
+  type QueryCtx,
+  type SegmentRow,
+} from "./performanceOverview";
+
+const FULL = [
+  "service",
+  "env",
+  "version",
+  "session_id",
+  "view_id",
+  "view_url",
+  "view_name",
+  "view_error_count",
+  "view_largest_contentful_paint",
+  "view_interaction_to_next_paint",
+  "view_cumulative_layout_shift",
+  "user_agent_user_agent_family",
+  "user_agent_user_agent_major",
+  "user_agent_device_family",
+  "geo_info_country",
+  "action_frustration_type",
+  "error_id",
+  "error_handling",
+];
+const SPLIT = 1_700_000_000_000_000;
+const ctx = (
+  fields: string[] = FULL,
+  filters = { service: [], env: [], version: [] } as QueryCtx["filters"],
+): QueryCtx => ({
+  schema: new Set(fields),
+  filters,
+});
+
+describe("bandOf", () => {
+  it.each([
+    ["lcp", 2.5e9, "good"],
+    ["lcp", 2.5e9 + 1, "needs"],
+    ["lcp", 4e9, "needs"],
+    ["lcp", 4e9 + 1, "poor"],
+    ["inp", 2e8, "good"],
+    ["inp", 5e8, "needs"],
+    ["inp", 5.1e8, "poor"],
+    ["cls", 0.1, "good"],
+    ["cls", 0.25, "needs"],
+    ["cls", 0.26, "poor"],
+  ] as const)("%s %s is %s", (vital, value, band) => {
+    expect(bandOf(vital, value)).toBe(band);
+  });
+
+  it("returns null without a value", () => {
+    expect(bandOf("lcp", null)).toBeNull();
+    expect(bandOf("lcp", undefined)).toBeNull();
+  });
+});
+
+describe("band distribution", () => {
+  it("derives needs-work as the remainder", () => {
+    expect(bandCounts(100, 70, 10)).toEqual({ good: 70, needs: 20, poor: 10 });
+  });
+
+  it("never goes negative on inconsistent counts", () => {
+    expect(bandCounts(10, 20, 20)).toEqual({ good: 10, needs: 0, poor: 0 });
+  });
+
+  it("rounds percentages to exactly 100", () => {
+    const p = bandPercents({ good: 1, needs: 1, poor: 1 });
+    expect(p.good + p.needs + p.poor).toBe(100);
+  });
+
+  it("returns zeros for an empty distribution", () => {
+    expect(bandPercents({ good: 0, needs: 0, poor: 0 })).toEqual({ good: 0, needs: 0, poor: 0 });
+  });
+});
+
+describe("verdictOf", () => {
+  it("passes when every assessed vital is good", () => {
+    expect(verdictOf({ lcp: 2e9, inp: 1e8, cls: 0.05 })).toEqual({
+      pass: true,
+      failing: [],
+      assessed: 3,
+    });
+  });
+
+  it("lists failing vitals and counts them", () => {
+    const v = verdictOf({ lcp: 2e9, inp: 3e8, cls: 0.3 });
+    expect(v.pass).toBe(false);
+    expect(v.failing).toEqual(["inp", "cls"]);
+  });
+
+  it("does not assess a vital with no data", () => {
+    expect(verdictOf({ lcp: 2e9, inp: null, cls: null })).toEqual({
+      pass: true,
+      failing: [],
+      assessed: 1,
+    });
+  });
+});
+
+describe("isLowData", () => {
+  it("is low under 100 views", () => {
+    expect(isLowData(99)).toBe(true);
+    expect(isLowData(100)).toBe(false);
+  });
+});
+
+describe("deltaOf", () => {
+  it("computes absolute and percent change", () => {
+    expect(deltaOf(120, 100)).toEqual({ abs: 20, pct: 20, direction: "up" });
+    expect(deltaOf(80, 100)?.direction).toBe("down");
+  });
+
+  it("reports flat inside half a percent", () => {
+    expect(deltaOf(100.2, 100)?.direction).toBe("flat");
+  });
+
+  it("has no percent against a zero baseline", () => {
+    expect(deltaOf(5, 0)?.pct).toBeNull();
+  });
+
+  it("is null when either side is missing", () => {
+    expect(deltaOf(null, 1)).toBeNull();
+    expect(deltaOf(1, null)).toBeNull();
+  });
+});
+
+describe("kpiDelta and vitalDelta", () => {
+  it("marks growth in errors as bad and in sessions as good", () => {
+    expect(kpiDelta(137, 100, { higherIsBetter: false })).toEqual({
+      kind: "change",
+      text: "+37%",
+      tone: "bad",
+    });
+    expect(kpiDelta(112, 100, { higherIsBetter: true })).toEqual({
+      kind: "change",
+      text: "+12%",
+      tone: "good",
+    });
+  });
+
+  it("reports points for percentages", () => {
+    expect(kpiDelta(96.2, 97.6, { higherIsBetter: true, points: true })).toEqual({
+      kind: "change",
+      text: "-1.4",
+      tone: "bad",
+    });
+  });
+
+  it("reads a lower vital as faster", () => {
+    expect(vitalDelta("lcp", 2.1e9, 2.3e9)).toEqual({ kind: "faster", text: "0.20 s" });
+    expect(vitalDelta("inp", 240e6, 202e6)).toEqual({ kind: "slower", text: "38 ms" });
+    expect(vitalDelta("cls", 0.07, 0.07)).toEqual({ kind: "none", text: "" });
+    expect(vitalDelta("cls", null, 0.07)).toBeNull();
+  });
+});
+
+describe("previousWindow", () => {
+  it("is the equal-length window ending where the current one starts", () => {
+    expect(previousWindow(1000, 1600)).toEqual({ startUs: 400, endUs: 1000 });
+  });
+});
+
+describe("impact ranking", () => {
+  it("scales the worst page to 100", () => {
+    expect(impactScores([{ bad: 50 }, { bad: 25 }, { bad: 0 }])).toEqual([100, 50, 0]);
+  });
+
+  it("scores zero when nothing is bad", () => {
+    expect(impactScores([{ bad: 0 }])).toEqual([0]);
+  });
+
+  it("hides pages under 100 views and sorts by impact", () => {
+    const row = (path: string, views: number, bad: number) => ({
+      path,
+      views,
+      lcp: null,
+      inp: null,
+      cls: null,
+      errors: 0,
+      bad,
+    });
+    const ranked = rankPages([row("/a", 150, 10), row("/b", 99, 99), row("/c", 400, 40)]);
+    expect(ranked.map((r) => r.path)).toEqual(["/c", "/a"]);
+    expect(ranked.map((r) => r.impact)).toEqual([100, 25]);
+  });
+});
+
+describe("biggestDifference", () => {
+  const seg = (label: string, views: number, inp: number): SegmentRow => ({
+    label,
+    views,
+    inp,
+    lcp: null,
+    share: 0,
+    filter: `f='${label}'`,
+  });
+
+  it("picks the segment furthest above the others", () => {
+    const d = biggestDifference({
+      browser: [seg("A", 100, 600e6), seg("B", 100, 150e6), seg("C", 100, 150e6)],
+    });
+    expect(d?.label).toBe("A");
+    expect(d?.ratio).toBeCloseTo(4);
+  });
+
+  it("returns null when nothing stands out", () => {
+    expect(biggestDifference({ browser: [seg("A", 100, 150e6), seg("B", 100, 140e6)] })).toBeNull();
+  });
+
+  it("ignores segments with too few views", () => {
+    expect(biggestDifference({ browser: [seg("A", 5, 900e6), seg("B", 100, 100e6)] })).toBeNull();
+  });
+});
+
+describe("formatVital", () => {
+  it("formats per vital", () => {
+    expect(formatVital("lcp", 2.1e9)).toBe("2.10 s");
+    expect(formatVital("inp", 240e6)).toBe("240 ms");
+    expect(formatVital("cls", 0.07)).toBe("0.07");
+    expect(formatVital("lcp", null)).toBe("\u2014");
+  });
+});
+
+describe("bucketInterval", () => {
+  it("scales the bucket with the window", () => {
+    const h = 3.6e9;
+    expect(bucketInterval(0, h)).toBe("5 minute");
+    expect(bucketInterval(0, 24 * h)).toBe("1 hour");
+    expect(bucketInterval(0, 24 * 60 * h)).toBe("1 day");
+  });
+});
+
+describe("query builders", () => {
+  it("dedupes view events to the latest row per view_id before percentiles", () => {
+    const sql = vitalsSql(ctx(), SPLIT);
+    expect(sql).toContain("GROUP BY view_id");
+    expect(sql).toContain("approx_percentile_cont(lcp, 0.75)");
+    expect(sql).toContain("MAX(view_largest_contentful_paint)");
+    expect(sql.split('FROM "_rumdata"')).toHaveLength(2);
+  });
+
+  it("compares against the published thresholds", () => {
+    const sql = vitalsSql(ctx(), SPLIT);
+    expect(sql).toContain("lcp <= 2500000000");
+    expect(sql).toContain("inp > 500000000");
+    expect(sql).toContain("cls <= 0.1");
+  });
+
+  it("reads an absent column as NULL instead of naming it", () => {
+    const sql = vitalsSql(ctx(["service", "view_id"]), SPLIT);
+    expect(sql).toContain("CAST(NULL AS BIGINT)");
+    expect(sql).not.toContain("MAX(view_largest_contentful_paint)");
+  });
+
+  it("splits each view by window flag so one scan serves both windows", () => {
+    const sql = vitalsSql(ctx(), SPLIT);
+    const flag = `CASE WHEN _timestamp >= ${SPLIT} THEN 1 ELSE 0 END`;
+    expect(sql).toContain(`${flag} AS w`);
+    expect(sql).toContain(`GROUP BY view_id, ${flag}`);
+    expect(sql).toContain("SELECT w, COUNT(*) AS views");
+    expect(sql).toContain("GROUP BY w");
+  });
+
+  it("applies service, env and version filters", () => {
+    const sql = kpiSql(ctx(FULL, { service: ["web"], env: ["prod"], version: [] }), SPLIT, true);
+    expect(sql).toContain("service IN ('web')");
+    expect(sql).toContain("env IN ('prod')");
+    expect(sql).not.toContain("version IN");
+  });
+
+  it("keeps only browser rows when the stream has a source column", () => {
+    const withSource = ctx([...FULL, "source", "error_message"]);
+    const pred = "(source IS NULL OR source IN ('', 'browser'))";
+    expect(scopeWhere(withSource)).toBe(pred);
+    for (const sql of [
+      vitalsSql(withSource, SPLIT),
+      kpiSql(withSource, SPLIT, true),
+      segmentsSql(withSource)!,
+      pagesSql(withSource),
+      seriesSql(withSource, "1 hour"),
+      chartSql(withSource, "1 hour"),
+      releaseSessionsSql(withSource)!,
+      releaseVitalsSql(withSource, ["v1"])!,
+      releaseNewErrorsSql(withSource, "v2", "v1")!,
+      filterOptionsSql(new Set(["service", "source"]))!,
+    ]) {
+      expect(sql).toContain(pred);
+    }
+    expect(scopeWhere(ctx())).not.toContain("source");
+    expect(filterOptionsSql(new Set(["service"]))).not.toContain("WHERE");
+  });
+
+  it("excludes synthetic sessions only when the column exists", () => {
+    expect(scopeWhere(ctx([...FULL, "session_type"]))).toContain("synthetics");
+    expect(scopeWhere(ctx())).toBe("1 = 1");
+  });
+
+  it("ranks pages with a poor-or-error predicate and a view floor", () => {
+    const sql = pagesSql(ctx());
+    expect(sql).toContain("HAVING COUNT(*) >= 100");
+    expect(sql).toContain("ec > 0");
+    expect(sql).toContain("lcp > 2500000000");
+  });
+
+  it("drops the error predicate without view_error_count", () => {
+    expect(pagesSql(ctx(FULL.filter((f) => f !== "view_error_count")))).not.toContain("ec > 0");
+  });
+
+  it("groups every present segment dimension in one query", () => {
+    const sql = segmentsSql(ctx([...FULL, "user_agent_os_family"]))!;
+    expect(sql.split('FROM "_rumdata"')).toHaveLength(2);
+    expect(sql).toContain("MIN(user_agent_user_agent_major) AS s0_1");
+    expect(sql).toContain("MIN(user_agent_os_family) AS s2_0");
+    expect(sql).toContain("GROUPING SETS ((s0_0, s0_1), (s1_0), (s2_0), (s3_0))");
+    expect(sql).toContain("GROUPING(s3_0) AS g3");
+    expect(sql).not.toContain("connectivity_effective_type");
+  });
+
+  it("offers OS and connection only when their columns exist", () => {
+    expect(segmentDims(ctx())).toEqual(["browser", "device", "country"]);
+    expect(
+      segmentDims(ctx([...FULL, "user_agent_os_family", "connectivity_effective_type"])),
+    ).toEqual(["browser", "device", "os", "country", "connection"]);
+    expect(segmentsSql(ctx(["view_id"]))).toBeNull();
+  });
+
+  it("splits grouped segment rows per dimension, dropping blanks and keeping the top 8", () => {
+    const c = ctx(["view_id", "user_agent_device_family", "geo_info_country"]);
+    const rows = [
+      ...Array.from({ length: 10 }, (_, i) => ({ s1_0: `C${i}`, g0: 1, g1: 0, views: 10 + i })),
+      { s0_0: "Mobile", g0: 0, g1: 1, views: 5 },
+      { s0_0: "", g0: 0, g1: 1, views: 50 },
+      { g0: 1, g1: 0, views: 99 },
+      { s1_0: "AA", g0: 1, g1: 0, views: 12 },
+    ];
+    const out = splitSegments(c, rows);
+    expect(out.device).toEqual([{ d0: "Mobile", views: 5, inp: undefined, lcp: undefined }]);
+    expect(out.country?.map((r) => r.d0)).toEqual(["C9", "C8", "C7", "C6", "C5", "C4", "C3", "AA"]);
+  });
+
+  it("folds totals, frustration and release sessions for both windows into one KPI query", () => {
+    const sql = kpiSql(ctx(), SPLIT, true);
+    expect(sql.split('FROM "_rumdata"')).toHaveLength(2);
+    expect(sql).toContain("GROUP BY GROUPING SETS ((w), (w, version))");
+    expect(sql).toContain(
+      "COUNT(DISTINCT CASE WHEN type = 'error' AND session_id IS NOT NULL THEN error_id END) AS errors",
+    );
+    expect(sql).toContain("strpos(action_frustration_type, 'rage_click') > 0");
+    expect(sql).toContain(
+      "MIN(CASE WHEN session_id IS NOT NULL THEN _timestamp END) AS first_seen",
+    );
+    expect(sql).not.toContain("session_id IS NOT NULL AND 1 = 1");
+  });
+
+  it("leaves release out of the KPI query when asked or without a version column", () => {
+    expect(kpiSql(ctx(), SPLIT, false)).not.toContain("version");
+    const bare = kpiSql(ctx(["session_id"]), SPLIT, true);
+    expect(bare).not.toContain("GROUPING");
+    expect(bare).not.toContain("rage");
+    expect(bare).toContain("0 AS unhandled");
+    expect(bare).toContain("CAST(NULL AS VARCHAR)");
+  });
+
+  it("reads the whole-window row and the two latest current versions from KPI rows", () => {
+    const rows = [
+      { w: 1, gv: 1, sessions: 9 },
+      { w: 0, gv: 1, sessions: 4 },
+      { w: 1, gv: 0, version: "1.0", first_seen: 10, sessions: 5 },
+      { w: 1, gv: 0, version: "1.2", first_seen: 30, sessions: 2 },
+      { w: 1, gv: 0, version: "1.1", first_seen: 20, sessions: 2 },
+      { w: 1, gv: 0, first_seen: 99, sessions: 1 },
+      { w: 1, gv: 0, version: "x", sessions: 0 },
+      { w: 0, gv: 0, version: "2.0", first_seen: 50, sessions: 1 },
+    ];
+    expect(windowRow(rows, 1)?.sessions).toBe(9);
+    expect(windowRow(rows, 0)?.sessions).toBe(4);
+    expect(windowRow([{ w: 1, sessions: 3 }], 1)?.sessions).toBe(3);
+    expect(windowRow([{ w: 1, sessions: 3 }], 0)).toBeUndefined();
+    expect(releaseRowsFromKpi(rows).map((r) => r.version)).toEqual(["1.2", "1.1"]);
+  });
+
+  it("buckets the series with histogram", () => {
+    expect(seriesSql(ctx(), "1 hour")).toContain("histogram(_timestamp, '1 hour')");
+  });
+
+  it("hides release queries when the version column is absent", () => {
+    const bare = ctx(["service"]);
+    expect(releaseSessionsSql(bare)).toBeNull();
+    expect(releaseVitalsSql(bare, ["v1"])).toBeNull();
+  });
+
+  it("limits release vitals to the compared versions", () => {
+    expect(releaseVitalsSql(ctx(), ["v2", "v1"])).toContain("version IN ('v2','v1')");
+  });
+
+  it("lists filter options from the columns present", () => {
+    expect(filterOptionsSql(new Set(["service", "env"]))).toContain("SELECT service, env FROM");
+  });
+});
+
+describe("drill-down filters", () => {
+  it("prefilters by substring and then requires the exact normalised page key", () => {
+    const f = pageFilter("/product/:id", new Set(FULL));
+    expect(f).toContain("strpos(view_url, '/product/') > 0");
+    expect(f.endsWith("= '/product/:id'")).toBe(true);
+    expect(f).toContain("regexp_replace(view_url");
+  });
+
+  it("escapes quotes", () => {
+    expect(pageFilter("/it's", new Set(FULL))).toContain("= '/it''s'");
+  });
+
+  it("joins filters and skips empty ones", () => {
+    expect(andFilters("a=1", null, "b=2")).toBe("a=1 AND b=2");
+  });
+});
+
+describe("missing-column SQL", () => {
+  const withoutCols = (...cols: string[]) =>
+    vitalsSql(ctx(FULL.filter((f) => !cols.includes(f))), SPLIT);
+
+  it("emits a bare typed NULL per missing vital so output names stay unique", () => {
+    const sql = withoutCols("view_interaction_to_next_paint", "view_cumulative_layout_shift");
+    expect(sql).toContain("CAST(NULL AS BIGINT) AS inp");
+    expect(sql).toContain("CAST(NULL AS DOUBLE) AS cls");
+    expect(sql).toContain("MAX(view_largest_contentful_paint) AS lcp");
+    expect(sql).not.toMatch(/MAX\(CAST\(NULL/);
+  });
+
+  it("handles all three vitals missing", () => {
+    const sql = withoutCols(
+      "view_largest_contentful_paint",
+      "view_interaction_to_next_paint",
+      "view_cumulative_layout_shift",
+    );
+    expect(sql).not.toMatch(/MAX\(/);
+    expect(sql.match(/CAST\(NULL AS/g)).toHaveLength(3);
+  });
+
+  it("uses bare NULLs for the page query extras", () => {
+    const sql = pagesSql(ctx(["view_id"]));
+    expect(sql).toContain("CAST(NULL AS VARCHAR) AS url");
+    expect(sql).toContain("CAST(NULL AS BIGINT) AS ec");
+  });
+});
+
+describe("kpiDelta zero baseline", () => {
+  it("is neutral when growing from zero", () => {
+    expect(kpiDelta(5, 0, { higherIsBetter: false })).toEqual({
+      kind: "new",
+      text: "",
+      tone: "flat",
+    });
+  });
+});
+
+describe("versionPredatesRange", () => {
+  const start = 0;
+  const end = 100;
+  it("flags a version first seen at the start of the range", () => {
+    expect(versionPredatesRange(1, start, end, 0, 2)).toBe(true);
+  });
+  it("flags a version first seen in the first bucket", () => {
+    expect(versionPredatesRange(8, start, end, 0, 10)).toBe(true);
+  });
+  it("accepts a version first seen mid-range", () => {
+    expect(versionPredatesRange(50, start, end, 0, 10)).toBe(false);
+  });
+});
+
+describe("previousUsable", () => {
+  it("needs at least the view floor in the previous window", () => {
+    expect(previousUsable({ views: 99, sessions: 5000 }, { views: 100 })).toBe(false);
+    expect(previousUsable({ views: 100, sessions: 0 }, { views: 100 })).toBe(true);
+  });
+
+  it("needs a tenth of the current traffic, so a sliver of a window is not compared", () => {
+    expect(previousUsable({ views: 224 }, { views: 43034 })).toBe(false);
+    expect(previousUsable({ views: 4304 }, { views: 43034 })).toBe(true);
+    expect(previousUsable({ sessions: 150 }, { sessions: 2000 })).toBe(false);
+  });
+  it("falls back to sessions when there are no vitals", () => {
+    expect(previousUsable({ views: null, sessions: 150 }, { sessions: 300 })).toBe(true);
+    expect(previousUsable({}, {})).toBe(false);
+  });
+});
+
+describe("overThresholdPct", () => {
+  it("sums needs-work and poor shares", () => {
+    expect(overThresholdPct({ good: 71, needs: 15, poor: 14 })).toBe(29);
+  });
+});
+
+describe("releaseNewErrorsSql", () => {
+  it("compares the latest version's error messages with the previous one", () => {
+    const sql = releaseNewErrorsSql(ctx([...FULL, "error_message"]), "v2", "v1") ?? "";
+    expect(sql).toContain("in_cur = 1 AND in_prev = 0");
+    expect(sql).toContain("version IN ('v2','v1')");
+    expect(sql.split('FROM "_rumdata"')).toHaveLength(2);
+  });
+  it("is null without version or error_message", () => {
+    expect(releaseNewErrorsSql(ctx(), "v2", "v1")).toBeNull();
+    expect(releaseNewErrorsSql(ctx(["error_message"]), "v2", "v1")).toBeNull();
+  });
+});
+
+describe("verdictOf assessed counts", () => {
+  it("has no verdict when nothing is assessed", () => {
+    expect(verdictOf({ lcp: null, inp: null, cls: null })).toEqual({
+      pass: false,
+      failing: [],
+      assessed: 0,
+    });
+  });
+  it("passes with one good vital assessed", () => {
+    expect(verdictOf({ lcp: 2e9, inp: null, cls: null })).toEqual({
+      pass: true,
+      failing: [],
+      assessed: 1,
+    });
+  });
+  it("fails when any of the three is past its threshold", () => {
+    expect(verdictOf({ lcp: 2e9, inp: 1e8, cls: 0.5 })).toEqual({
+      pass: false,
+      failing: ["cls"],
+      assessed: 3,
+    });
+  });
+});
+
+describe("pageFilter keys", () => {
+  // JS port of the SQL page-key passes, as productAnalyticsQueries.spec does it.
+  const jsKey = (url: string | null, viewName: string | null): string | null => {
+    if (url === null || url === "") return viewName || null;
+    const k = PAGE_KEY_PASSES.reduce(
+      (x, p) =>
+        x.replace(
+          new RegExp(p.pattern, p.global ? "g" : ""),
+          p.replacement.replace(/\\(\d)/g, "$$$1"),
+        ),
+      url,
+    );
+    return k || "/";
+  };
+  const prefilterHolds = (key: string, url: string | null) => {
+    if (!key.startsWith("/")) return url === null || url === "";
+    return key
+      .split(/:id|#!?/)
+      .filter((p) => p && p !== "/")
+      .every((p) => (url ?? "").includes(p));
+  };
+  const matches = (key: string, url: string | null, viewName: string | null = null) =>
+    prefilterHolds(key, url) && jsKey(url, viewName) === key;
+
+  it("excludes sibling and nested paths that only share a prefix", () => {
+    const f = pageFilter("/cart", new Set(FULL));
+    expect(f).toContain("= '/cart'");
+    expect(matches("/cart", "https://shop.example.com/cart")).toBe(true);
+    expect(matches("/cart", "https://shop.example.com/cart?step=2")).toBe(true);
+    expect(matches("/cart", "https://shop.example.com/cartography")).toBe(false);
+    expect(matches("/cart", "https://shop.example.com/cart/checkout/123")).toBe(false);
+  });
+
+  it("keeps the root page to the root key", () => {
+    const f = pageFilter("/", new Set(FULL));
+    expect(f).toContain("regexp_like(view_url");
+    expect(f).toContain("= '/'");
+    expect(matches("/", "https://shop.example.com/")).toBe(true);
+  });
+
+  it("matches a view_name key only where the URL is empty, as the page key falls back", () => {
+    const f = pageFilter("Checkout screen", new Set(FULL));
+    expect(f.startsWith("(view_url IS NULL OR view_url = '')")).toBe(true);
+    expect(f).toContain("NULLIF(view_name, '')");
+    expect(f).toContain("= 'Checkout screen'");
+    expect(matches("Checkout screen", "", "Checkout screen")).toBe(true);
+    expect(matches("Checkout screen", "https://x/checkout", "Checkout screen")).toBe(false);
+  });
+});
+
+describe("filterOptionsSql without columns", () => {
+  it("returns no query when none of service, env, version exist", () => {
+    expect(filterOptionsSql(new Set(["session_id"]))).toBeNull();
+  });
+});
+
+describe("kpiDelta kinds and sentence keys", () => {
+  it("picks a whole-sentence key per kind so word order is per language", () => {
+    const flat = kpiDelta(100, 100, { higherIsBetter: true })!;
+    const fresh = kpiDelta(5, 0, { higherIsBetter: false })!;
+    const change = kpiDelta(112, 100, { higherIsBetter: true })!;
+    expect(deltaSentenceKey(flat, false)).toBe("rum.overviewPage.deltaFlat");
+    expect(deltaSentenceKey(fresh, false)).toBe("rum.overviewPage.deltaNewMsg");
+    expect(deltaSentenceKey(change, false)).toBe("rum.overviewPage.deltaChange");
+    expect(deltaSentenceKey(change, true)).toBe("rum.overviewPage.deltaChangePts");
+  });
+  it("keeps points flat as a flat kind", () => {
+    expect(kpiDelta(96, 96, { higherIsBetter: true, points: true })?.kind).toBe("flat");
+  });
+});
+
+describe("fillBuckets", () => {
+  const zero = (ts: number) => ({ ts, v: 0 });
+  it("inserts zero buckets in gaps", () => {
+    const out = fillBuckets(
+      [
+        { ts: 0, v: 5 },
+        { ts: 30, v: 7 },
+      ],
+      10,
+      zero,
+    );
+    expect(out).toEqual([
+      { ts: 0, v: 5 },
+      { ts: 10, v: 0 },
+      { ts: 20, v: 0 },
+      { ts: 30, v: 7 },
+    ]);
+  });
+  it("leaves misaligned data untouched", () => {
+    const pts = [
+      { ts: 0, v: 1 },
+      { ts: 15, v: 2 },
+    ];
+    expect(fillBuckets(pts, 10, zero)).toBe(pts);
+  });
+  it("parses interval strings to microseconds", () => {
+    expect(intervalMicros("5 minute")).toBe(300_000_000);
+    expect(intervalMicros("1 hour")).toBe(3_600_000_000);
+    expect(intervalMicros("1 day")).toBe(86_400_000_000);
+  });
+});
+
+describe("drillQuery", () => {
+  const encode = (s: string) => `b64(${s})`;
+  const range = { startUs: 100, endUs: 200 };
+  it("passes the relative period for a relative picker", () => {
+    const q = drillQuery({
+      org: "o",
+      filter: "a=1",
+      scope: "service IN ('w')",
+      range,
+      picker: { valueType: "relative", relativeTimePeriod: "1d" },
+      encode,
+    });
+    expect(q).toEqual({
+      org_identifier: "o",
+      query: "b64(a=1 AND service IN ('w'))",
+      period: "1d",
+    });
+  });
+  it("passes absolute from and to otherwise", () => {
+    const q = drillQuery({
+      org: "o",
+      filter: "a=1",
+      scope: "1 = 1",
+      range,
+      picker: { valueType: "absolute" },
+      encode,
+    });
+    expect(q).toEqual({ org_identifier: "o", query: "b64(a=1)", from: "100", to: "200" });
+  });
+  it("omits the time range when there is none", () => {
+    expect(drillQuery({ org: "o", filter: "a=1", scope: "1 = 1", range: null, encode })).toEqual({
+      org_identifier: "o",
+      query: "b64(a=1)",
+    });
+  });
+});
+
+describe("vitalDelta wording", () => {
+  it("says lower or higher for CLS, never faster or slower", () => {
+    expect(vitalDelta("cls", 0.05, 0.1)).toEqual({ kind: "lower", text: "0.05" });
+    expect(vitalDelta("cls", 0.2, 0.1)).toEqual({ kind: "higher", text: "0.10" });
+  });
+});
+
+describe("unknown values", () => {
+  it("use an em dash everywhere", () => {
+    expect(formatCount(null)).toBe("\u2014");
+    expect(formatPercent(undefined)).toBe("\u2014");
+    expect(formatVital("inp", null)).toBe("\u2014");
+  });
+  it("formats counts in the user's locale", () => {
+    expect(formatCount(4812)).toBe((4812).toLocaleString());
+  });
+});
+
+describe("chartSql", () => {
+  it("buckets sessions and errors under the dashboard engine's axis aliases", () => {
+    const sql = chartSql(ctx(), "1 hour");
+    expect(sql).toContain("histogram(_timestamp, '1 hour') AS x_axis_1");
+    expect(sql).toContain("AS y_axis_1");
+    expect(sql).toContain("AS y_axis_2");
+    expect(sql.split('FROM "_rumdata"')).toHaveLength(2);
+  });
+  it("reads the bucket step back from a panel key", () => {
+    expect(intervalFromKey(`ov-series:${seriesSql(ctx(), "30 minute")}`)).toBe("30 minute");
+    expect(intervalFromKey(null)).toBeNull();
+  });
+});
+
+describe("route state", () => {
+  const filters = { service: ["web"], env: [], version: ["1.0", "2.0"] };
+  it("round-trips filters and percentile through the query", () => {
+    const q = queryFromState(filters, "p95");
+    expect(q).toEqual({ ov_service: ["web"], ov_version: ["1.0", "2.0"], ov_pct: "p95" });
+    expect(stateFromQuery(q)).toEqual({ filters, percentile: "p95" });
+  });
+  it("keeps a plain URL plain and defaults to p75", () => {
+    expect(queryFromState({ service: [], env: [], version: [] }, "p75")).toEqual({});
+    expect(stateFromQuery({}).percentile).toBe("p75");
+    expect(stateFromQuery({ ov_pct: "p99" }).percentile).toBe("p75");
+  });
+  it("splits the overview keys from the page's own", () => {
+    const q = { period: "1d", ov_service: "web", ov_pct: "p50" };
+    expect(withoutOverviewState(q)).toEqual({ period: "1d" });
+    expect(overviewStateOnly(q)).toEqual({ ov_service: "web", ov_pct: "p50" });
+  });
+});
+
+describe("analyticsQuery", () => {
+  it("keeps a relative period and otherwise carries the absolute range", () => {
+    expect(
+      analyticsQuery({
+        org: "o",
+        range: { startUs: 1, endUs: 2 },
+        picker: { valueType: "relative", relativeTimePeriod: "7d" },
+      }),
+    ).toEqual({ org_identifier: "o", period: "7d" });
+    expect(analyticsQuery({ org: "o", range: { startUs: 1, endUs: 2 } })).toEqual({
+      org_identifier: "o",
+      from: "1",
+      to: "2",
+    });
+  });
+});
+
+describe("drillQuery extra params", () => {
+  it("adds health=clean and drops the query for an unfiltered drill", () => {
+    const q = drillQuery({
+      org: "o",
+      filter: "",
+      scope: "1 = 1",
+      range: null,
+      extra: { health: "clean" },
+      encode: (s) => s,
+    });
+    expect(q).toEqual({ org_identifier: "o", health: "clean" });
+  });
+});
+
+describe("formatInZone", () => {
+  it("formats in the given zone, not the browser's", () => {
+    const ms = Date.UTC(2026, 0, 15, 12, 0);
+    expect(formatInZone(ms, "UTC", "en-US")).toContain("12:00");
+    expect(formatInZone(ms, "Asia/Tokyo", "en-US")).toContain("9:00");
+    expect(formatInZone(ms, "America/New_York", "en-US")).toContain("7:00");
+  });
+  it("falls back to the browser zone for an invalid zone", () => {
+    expect(() => formatInZone(Date.UTC(2026, 0, 15), "Not/AZone", "en-US")).not.toThrow();
+  });
+});
+
+describe("mapSegments share", () => {
+  const rows = [
+    { d0: "Chrome", views: 300, inp: 1, lcp: 1 },
+    { d0: "Safari", views: 100, inp: 1, lcp: 1 },
+  ];
+  it("is a share of the window's views, not of the returned rows", () => {
+    const out = mapSegments("device", ["c"], rows, 1000);
+    expect(out.map((r) => r.share)).toEqual([30, 10]);
+  });
+  it("falls back to the returned rows without a window total", () => {
+    expect(mapSegments("device", ["c"], rows).map((r) => r.share)).toEqual([75, 25]);
+  });
+  it("never exceeds 100", () => {
+    expect(mapSegments("device", ["c"], rows, 50).map((r) => r.share)).toEqual([100, 100]);
+  });
+});
+
+describe("releaseTone", () => {
+  it("calls a change inside half a percent, or equal once formatted, unchanged", () => {
+    expect(releaseTone(232_000_000, 231_000_000, false)).toBe("same");
+    expect(releaseTone(232_400_000, 231_600_000, false, { cur: "232 ms", prev: "232 ms" })).toBe(
+      "same",
+    );
+    expect(releaseTone(null, 1, false)).toBe("same");
+  });
+
+  it("calls a lower vital better and a lower error-free share worse", () => {
+    expect(releaseTone(2.9e9, 2.55e9, false)).toBe("worse");
+    expect(releaseTone(2.2e9, 2.55e9, false)).toBe("better");
+    expect(releaseTone(86.5, 90.7, true)).toBe("worse");
+  });
+});
+
+describe("dropOpenBucket", () => {
+  const pts = [{ ts: 0 }, { ts: 10 }, { ts: 20 }];
+  it("drops the bucket that still contains now", () => {
+    expect(dropOpenBucket(pts, 10, 25)).toEqual([{ ts: 0 }, { ts: 10 }]);
+  });
+  it("keeps every bucket of a range that ended", () => {
+    expect(dropOpenBucket(pts, 10, 30)).toEqual(pts);
+    expect(dropOpenBucket(pts, 0, 25)).toEqual(pts);
+  });
+});
+
+describe("kpiDelta above the percent cap", () => {
+  it("shows a multiple instead of a five-digit percentage", () => {
+    expect(kpiDelta(43034, 224, { higherIsBetter: true })?.text).toBe("192x");
+    expect(kpiDelta(1100, 100, { higherIsBetter: true })?.text).toBe("+1000%");
+    expect(kpiDelta(1200, 100, { higherIsBetter: true })?.text).toBe("12x");
+  });
+});
diff --git a/web/src/utils/rum/performanceOverview.ts b/web/src/utils/rum/performanceOverview.ts
new file mode 100644
index 0000000000..5beb55de1b
--- /dev/null
+++ b/web/src/utils/rum/performanceOverview.ts
@@ -0,0 +1,851 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { I18nKey } from "@/types/i18n";
+import { sqlIn, sqlLiteral } from "@/utils/query/sqlFilterBuilder";
+import { pageKeyExpr, urlPrefilter } from "@/utils/rum/productAnalyticsQueries";
+
+export type VitalKey = "lcp" | "inp" | "cls";
+export type Band = "good" | "needs" | "poor";
+export type Percentile = "p50" | "p75" | "p95";
+export type SegmentDim = "browser" | "device" | "os" | "country" | "connection";
+
+export interface VitalThreshold {
+  good: number;
+  poor: number;
+  column: string;
+  divisor: number;
+}
+
+// Stored LCP and INP are nanoseconds; CLS is unitless.
+export const VITAL_THRESHOLDS: Readonly<Record<VitalKey, VitalThreshold>> = {
+  lcp: { good: 2.5e9, poor: 4e9, column: "view_largest_contentful_paint", divisor: 1e9 },
+  inp: { good: 2e8, poor: 5e8, column: "view_interaction_to_next_paint", divisor: 1e6 },
+  cls: { good: 0.1, poor: 0.25, column: "view_cumulative_layout_shift", divisor: 1 },
+};
+
+export const VITAL_KEYS: readonly VitalKey[] = ["lcp", "inp", "cls"];
+export const PERCENTILES: readonly Percentile[] = ["p50", "p75", "p95"];
+export const PERCENTILE_Q: Readonly<Record<Percentile, number>> = {
+  p50: 0.5,
+  p75: 0.75,
+  p95: 0.95,
+};
+export const MIN_VIEWS = 100;
+export const MIN_SEGMENT_VIEWS = 30;
+export const MAX_PAGES = 200;
+export const MIN_DIFFERENCE_RATIO = 1.25;
+export const MIN_PREVIOUS_SHARE = 0.1;
+export const MAX_DELTA_PCT = 1000;
+// Mobile SDKs share the stream, so the browser view keeps only browser rows; a blank source is browser, as in useRumPlatforms.
+export const BROWSER_SOURCE_WHERE = "(source IS NULL OR source IN ('', 'browser'))";
+
+export const SEGMENT_COLUMNS: Readonly<Record<SegmentDim, readonly string[]>> = {
+  browser: ["user_agent_user_agent_family", "user_agent_user_agent_major"],
+  device: ["user_agent_device_family"],
+  os: ["user_agent_os_family"],
+  country: ["geo_info_country"],
+  connection: ["connectivity_effective_type"],
+};
+export const SEGMENT_DIMS = Object.keys(SEGMENT_COLUMNS) as SegmentDim[];
+export const SEGMENT_TOP = 8;
+
+export interface OverviewFilters {
+  service: string[];
+  env: string[];
+  version: string[];
+}
+
+export interface QueryCtx {
+  schema: Set<string>;
+  filters: OverviewFilters;
+}
+
+export interface VitalsRow {
+  views: number;
+  [key: string]: number | null;
+}
+
+export interface Delta {
+  abs: number;
+  pct: number | null;
+  direction: "up" | "down" | "flat";
+}
+
+export interface BandCounts {
+  good: number;
+  needs: number;
+  poor: number;
+}
+
+export interface PageRow {
+  path: string;
+  views: number;
+  lcp: number | null;
+  inp: number | null;
+  cls: number | null;
+  errors: number;
+  bad: number;
+  impact: number;
+}
+
+export interface SegmentRow {
+  label: string;
+  views: number;
+  inp: number | null;
+  lcp: number | null;
+  share: number;
+  filter: string;
+}
+
+export interface BiggestDifference {
+  dim: SegmentDim;
+  label: string;
+  filter: string;
+  views: number;
+  inp: number;
+  ratio: number;
+}
+
+export const bandOf = (vital: VitalKey, value: number | null | undefined): Band | null => {
+  if (value === null || value === undefined || Number.isNaN(value)) return null;
+  const t = VITAL_THRESHOLDS[vital];
+  if (value <= t.good) return "good";
+  if (value <= t.poor) return "needs";
+  return "poor";
+};
+
+export const bandCounts = (n: number, good: number, poor: number): BandCounts => {
+  const g = Math.max(0, Math.min(good, n));
+  const p = Math.max(0, Math.min(poor, n - g));
+  return { good: g, needs: n - g - p, poor: p };
+};
+
+// Largest-remainder rounding so the three shares always add to 100.
+export const bandPercents = (c: BandCounts): BandCounts => {
+  const total = c.good + c.needs + c.poor;
+  if (!total) return { good: 0, needs: 0, poor: 0 };
+  const raw = [c.good, c.needs, c.poor].map((x) => (x / total) * 100);
+  const floor = raw.map(Math.floor);
+  let left = 100 - floor.reduce((a, b) => a + b, 0);
+  const order = raw.map((r, i) => ({ i, f: r - floor[i] })).sort((a, b) => b.f - a.f);
+  for (const { i } of order) {
+    if (left <= 0) break;
+    floor[i] += 1;
+    left -= 1;
+  }
+  return { good: floor[0], needs: floor[1], poor: floor[2] };
+};
+
+export interface Verdict {
+  pass: boolean;
+  failing: VitalKey[];
+  assessed: number;
+}
+
+// A vital with no data is not assessed; with nothing assessed there is no verdict to give.
+export const verdictOf = (p75: Partial<Record<VitalKey, number | null>>): Verdict => {
+  const failing: VitalKey[] = [];
+  let assessed = 0;
+  for (const k of VITAL_KEYS) {
+    const band = bandOf(k, p75[k]);
+    if (!band) continue;
+    assessed += 1;
+    if (band !== "good") failing.push(k);
+  }
+  return { pass: assessed > 0 && failing.length === 0, failing, assessed };
+};
+
+export const isLowData = (views: number): boolean => views < MIN_VIEWS;
+
+export const deltaOf = (cur: number | null, prev: number | null): Delta | null => {
+  if (cur === null || prev === null || Number.isNaN(cur) || Number.isNaN(prev)) return null;
+  const abs = cur - prev;
+  const pct = prev === 0 ? null : (abs / Math.abs(prev)) * 100;
+  const eps = Math.abs(prev) * 0.005 || 1e-9;
+  return { abs, pct, direction: Math.abs(abs) <= eps ? "flat" : abs > 0 ? "up" : "down" };
+};
+
+export const previousWindow = (
+  startUs: number,
+  endUs: number,
+): { startUs: number; endUs: number } => {
+  const len = Math.max(0, endUs - startUs);
+  return { startUs: startUs - len, endUs: startUs };
+};
+
+// Impact is views with a poor or needs-work vital or an error, scaled so the worst page is 100.
+export const impactScores = <T extends { bad: number }>(rows: T[]): number[] => {
+  const max = Math.max(0, ...rows.map((r) => r.bad));
+  return rows.map((r) => (max > 0 ? Math.round((r.bad / max) * 100) : 0));
+};
+
+export const rankPages = (rows: Omit<PageRow, "impact">[]): PageRow[] => {
+  const kept = rows.filter((r) => r.views >= MIN_VIEWS);
+  const scores = impactScores(kept);
+  return kept
+    .map((r, i) => ({ ...r, impact: scores[i] }))
+    .sort((a, b) => b.impact - a.impact || b.views - a.views);
+};
+
+export const biggestDifference = (
+  byDim: Partial<Record<SegmentDim, SegmentRow[]>>,
+): BiggestDifference | null => {
+  let best: BiggestDifference | null = null;
+  for (const dim of Object.keys(byDim) as SegmentDim[]) {
+    const rows = (byDim[dim] ?? []).filter((r) => r.inp !== null && r.views >= MIN_SEGMENT_VIEWS);
+    for (const r of rows) {
+      const others = rows.filter((o) => o !== r);
+      const w = others.reduce((s, o) => s + o.views, 0);
+      if (!w) continue;
+      const base = others.reduce((s, o) => s + (o.inp as number) * o.views, 0) / w;
+      if (!base) continue;
+      const ratio = (r.inp as number) / base;
+      if (ratio < MIN_DIFFERENCE_RATIO || bandOf("inp", r.inp) === "good") continue;
+      if (!best || ratio > best.ratio) {
+        best = {
+          dim,
+          label: r.label,
+          filter: r.filter,
+          views: r.views,
+          inp: r.inp as number,
+          ratio,
+        };
+      }
+    }
+  }
+  return best;
+};
+
+export const toDisplay = (vital: VitalKey, raw: number | null | undefined): number | null =>
+  raw === null || raw === undefined ? null : raw / VITAL_THRESHOLDS[vital].divisor;
+
+export const NO_VALUE = "\u2014";
+
+export const formatVital = (vital: VitalKey, raw: number | null | undefined): string => {
+  const v = toDisplay(vital, raw);
+  if (v === null) return NO_VALUE;
+  if (vital === "lcp") return `${v.toFixed(v < 10 ? 2 : 1)} s`;
+  if (vital === "inp") return `${Math.round(v)} ms`;
+  return v.toFixed(2);
+};
+
+export const bucketInterval = (startUs: number, endUs: number): string => {
+  const hours = (endUs - startUs) / 3.6e9;
+  if (hours <= 2) return "5 minute";
+  if (hours <= 12) return "30 minute";
+  if (hours <= 48) return "1 hour";
+  if (hours <= 24 * 14) return "6 hour";
+  return "1 day";
+};
+
+const has = (ctx: QueryCtx, field: string): boolean => ctx.schema.has(field);
+
+const schemaRecord = (schema: Set<string>): Record<string, boolean> =>
+  Object.fromEntries([...schema].map((f) => [f, true]));
+
+export const scopeWhere = (ctx: QueryCtx, extra?: string): string => {
+  const parts: string[] = [];
+  if (has(ctx, "source")) parts.push(BROWSER_SOURCE_WHERE);
+  (["service", "env", "version"] as const).forEach((f) => {
+    if (has(ctx, f) && ctx.filters[f].length) parts.push(sqlIn(f, ctx.filters[f]));
+  });
+  if (has(ctx, "session_type"))
+    parts.push("(session_type IS NULL OR session_type <> 'synthetics')");
+  if (extra) parts.push(extra);
+  return parts.length ? parts.join(" AND ") : "1 = 1";
+};
+
+// A bare typed NULL keeps the output column name unique; MAX(NULL) twice collides on the server.
+const agg = (
+  ctx: QueryCtx,
+  fn: "MAX" | "MIN",
+  field: string,
+  type: string,
+  alias: string,
+): string =>
+  has(ctx, field) ? `${fn}(${field}) AS ${alias}` : `CAST(NULL AS ${type}) AS ${alias}`;
+
+const viewAggs = (ctx: QueryCtx, extra: string[] = []): string =>
+  [
+    "view_id",
+    agg(ctx, "MAX", VITAL_THRESHOLDS.lcp.column, "BIGINT", "lcp"),
+    agg(ctx, "MAX", VITAL_THRESHOLDS.inp.column, "BIGINT", "inp"),
+    agg(ctx, "MAX", VITAL_THRESHOLDS.cls.column, "DOUBLE", "cls"),
+    ...extra,
+  ].join(", ");
+
+// 1 for rows in the current window, 0 for the previous one, so one scan serves both.
+const windowFlag = (splitAtUs: number): string =>
+  `CASE WHEN _timestamp >= ${Math.round(splitAtUs)} THEN 1 ELSE 0 END`;
+
+// View events are cumulative updates, so each view_id collapses to its latest values first.
+const viewsCte = (
+  ctx: QueryCtx,
+  extra: string[] = [],
+  where?: string,
+  splitAtUs?: number,
+): string => {
+  const w = splitAtUs === undefined ? null : windowFlag(splitAtUs);
+  return `v AS (SELECT ${w ? `${w} AS w, ` : ""}${viewAggs(ctx, extra)} FROM "_rumdata" WHERE type = 'view' AND view_id IS NOT NULL AND ${scopeWhere(ctx, where)} GROUP BY view_id${w ? `, ${w}` : ""})`;
+};
+
+const pctAggs = (qs: Percentile[]): string[] =>
+  VITAL_KEYS.flatMap((k) =>
+    qs.map((q) => `approx_percentile_cont(${k}, ${PERCENTILE_Q[q]}) AS ${k}_${q}`),
+  );
+
+const bandAggs = (): string[] =>
+  VITAL_KEYS.flatMap((k) => {
+    const t = VITAL_THRESHOLDS[k];
+    return [
+      `COUNT(${k}) AS ${k}_n`,
+      `COUNT(CASE WHEN ${k} <= ${t.good} THEN 1 END) AS ${k}_good`,
+      `COUNT(CASE WHEN ${k} > ${t.poor} THEN 1 END) AS ${k}_poor`,
+    ];
+  });
+
+// A view straddling the split counts in both windows, exactly as two separate window queries would.
+export const vitalsSql = (ctx: QueryCtx, splitAtUs: number): string =>
+  `WITH ${viewsCte(ctx, [], undefined, splitAtUs)} SELECT w, COUNT(*) AS views, ${[...pctAggs([...PERCENTILES]), ...bandAggs()].join(", ")} FROM v GROUP BY w ORDER BY w DESC LIMIT 2`;
+
+const errorFlag = (ctx: QueryCtx): string => (has(ctx, "view_error_count") ? "ec > 0" : "FALSE");
+
+export const badViewPredicate = (ctx: QueryCtx): string =>
+  [
+    `lcp > ${VITAL_THRESHOLDS.lcp.good}`,
+    `inp > ${VITAL_THRESHOLDS.inp.good}`,
+    `cls > ${VITAL_THRESHOLDS.cls.good}`,
+    errorFlag(ctx),
+  ].join(" OR ");
+
+export const pagesSql = (ctx: QueryCtx): string => {
+  const extra = [
+    agg(ctx, "MIN", "view_url", "VARCHAR", "url"),
+    agg(ctx, "MAX", "view_error_count", "BIGINT", "ec"),
+    ...(has(ctx, "view_name") ? ["MIN(view_name) AS vn"] : []),
+  ];
+  const pg = pageKeyExpr("url", schemaRecord(ctx.schema), "vn");
+  return (
+    `WITH ${viewsCte(ctx, extra)}, p AS (SELECT *, ${pg} AS pg FROM v) ` +
+    `SELECT pg, COUNT(*) AS views, approx_percentile_cont(lcp, 0.75) AS lcp, approx_percentile_cont(inp, 0.75) AS inp, ` +
+    `approx_percentile_cont(cls, 0.75) AS cls, COALESCE(SUM(ec), 0) AS errors, ` +
+    `COUNT(CASE WHEN ${badViewPredicate(ctx)} THEN 1 END) AS bad ` +
+    `FROM p WHERE pg IS NOT NULL GROUP BY pg HAVING COUNT(*) >= ${MIN_VIEWS} ORDER BY bad DESC LIMIT ${MAX_PAGES}`
+  );
+};
+
+export const segmentColumns = (ctx: QueryCtx, dim: SegmentDim): string[] =>
+  SEGMENT_COLUMNS[dim].filter((c) => has(ctx, c));
+
+export const segmentDims = (ctx: QueryCtx): SegmentDim[] =>
+  SEGMENT_DIMS.filter((d) => segmentColumns(ctx, d).length);
+
+const segAlias = (dimIndex: number, colIndex: number): string => `s${dimIndex}_${colIndex}`;
+
+// Every dimension in one scan; GROUPING() tells which grouping set a row came from.
+export const segmentsSql = (ctx: QueryCtx): string | null => {
+  const dims = segmentDims(ctx);
+  if (!dims.length) return null;
+  const cols = dims.map((d, i) => segmentColumns(ctx, d).map((c, j) => [c, segAlias(i, j)]));
+  const extra = cols.flat().map(([c, a]) => `MIN(${c}) AS ${a}`);
+  const keys = cols.flat().map(([, a]) => a);
+  const flags = dims.map((_, i) => `GROUPING(${segAlias(i, 0)}) AS g${i}`);
+  const sets = cols.map((set) => `(${set.map(([, a]) => a).join(", ")})`).join(", ");
+  return (
+    `WITH ${viewsCte(ctx, extra)} SELECT ${[...keys, ...flags].join(", ")}, COUNT(*) AS views, ` +
+    `approx_percentile_cont(inp, 0.75) AS inp, approx_percentile_cont(lcp, 0.75) AS lcp ` +
+    `FROM v GROUP BY GROUPING SETS (${sets}) ORDER BY views DESC LIMIT 1000`
+  );
+};
+
+// Per dimension, as d0/d1 rows for mapSegments; ties break by label so the top 8 is stable.
+export const splitSegments = (
+  ctx: QueryCtx,
+  rows: Record<string, unknown>[],
+): Partial<Record<SegmentDim, Record<string, unknown>[]>> => {
+  const out: Partial<Record<SegmentDim, Record<string, unknown>[]>> = {};
+  segmentDims(ctx).forEach((dim, i) => {
+    const n = segmentColumns(ctx, dim).length;
+    out[dim] = rows
+      .filter((r) => toNum(r[`g${i}`]) === 0 && String(r[segAlias(i, 0)] ?? "") !== "")
+      .map((r): Record<string, unknown> => ({
+        ...Object.fromEntries(Array.from({ length: n }, (_, j) => [`d${j}`, r[segAlias(i, j)]])),
+        views: r.views,
+        inp: r.inp,
+        lcp: r.lcp,
+      }))
+      .sort(
+        (a, b) =>
+          toNum(b.views) - toNum(a.views) ||
+          `${a.d0} ${a.d1 ?? ""}`.localeCompare(`${b.d0} ${b.d1 ?? ""}`),
+      )
+      .slice(0, SEGMENT_TOP);
+  });
+  return out;
+};
+
+// Frustration rows may lack a session, so the session condition lives in each session aggregate, not the WHERE.
+const kpiAggs = (ctx: QueryCtx): string[] => {
+  const errId = has(ctx, "error_id") ? "error_id" : "CAST(NULL AS VARCHAR)";
+  const errOf = "type = 'error' AND session_id IS NOT NULL";
+  return [
+    "COUNT(DISTINCT session_id) AS sessions",
+    "COUNT(DISTINCT CASE WHEN type = 'error' THEN session_id END) AS err_sessions",
+    `COUNT(DISTINCT CASE WHEN ${errOf} THEN ${errId} END) AS errors`,
+    has(ctx, "error_handling")
+      ? `COUNT(DISTINCT CASE WHEN ${errOf} AND error_handling = 'unhandled' THEN ${errId} END) AS unhandled`
+      : "0 AS unhandled",
+    ...(has(ctx, "action_frustration_type")
+      ? [
+          "COUNT(CASE WHEN type = 'action' AND strpos(action_frustration_type, 'rage_click') > 0 THEN 1 END) AS rage",
+          "COUNT(CASE WHEN type = 'action' AND strpos(action_frustration_type, 'dead_click') > 0 THEN 1 END) AS dead",
+        ]
+      : []),
+  ];
+};
+
+// Totals and frustration for both windows, plus per-version release sessions when withRelease, in one scan.
+export const kpiSql = (ctx: QueryCtx, splitAtUs: number, withRelease: boolean): string => {
+  const rel = withRelease && has(ctx, "version");
+  const cols = [
+    "_timestamp",
+    "type",
+    "session_id",
+    ...["error_id", "error_handling", "action_frustration_type"].filter((c) => has(ctx, c)),
+    ...(rel ? ["version"] : []),
+  ];
+  const aggs = [
+    ...kpiAggs(ctx),
+    ...(rel ? ["MIN(CASE WHEN session_id IS NOT NULL THEN _timestamp END) AS first_seen"] : []),
+  ];
+  return (
+    `WITH e AS (SELECT ${windowFlag(splitAtUs)} AS w, ${cols.join(", ")} FROM "_rumdata" WHERE ${scopeWhere(ctx)}) ` +
+    (rel
+      ? `SELECT w, version, GROUPING(version) AS gv, ${aggs.join(", ")} FROM e GROUP BY GROUPING SETS ((w), (w, version)) ORDER BY gv DESC, w DESC, first_seen DESC LIMIT 1000`
+      : `SELECT w, ${aggs.join(", ")} FROM e GROUP BY w ORDER BY w DESC LIMIT 2`)
+  );
+};
+
+// The whole-window row for w; a release query also returns per-version rows, which have gv = 0.
+export const windowRow = (
+  rows: Record<string, unknown>[],
+  w: 0 | 1,
+): Record<string, unknown> | undefined =>
+  rows.find((r) => toNum(r.w) === w && (r.gv === undefined || toNum(r.gv) === 1));
+
+// The two latest versions in the current window, as releaseSessionsSql would return them.
+export const releaseRowsFromKpi = (rows: Record<string, unknown>[]): Record<string, unknown>[] =>
+  rows
+    .filter(
+      (r) =>
+        toNum(r.gv) === 0 &&
+        toNum(r.w) === 1 &&
+        String(r.version ?? "") !== "" &&
+        r.first_seen !== null &&
+        r.first_seen !== undefined,
+    )
+    .sort((a, b) => toNum(b.first_seen) - toNum(a.first_seen))
+    .slice(0, 2);
+
+export const seriesSql = (ctx: QueryCtx, interval: string): string => {
+  const errId = has(ctx, "error_id") ? "error_id" : "CAST(NULL AS VARCHAR)";
+  const handled = has(ctx, "error_handling")
+    ? `COUNT(DISTINCT CASE WHEN type = 'error' AND error_handling = 'unhandled' THEN ${errId} END)`
+    : "0";
+  return (
+    `SELECT histogram(_timestamp, ${sqlLiteral(interval)}) AS bucket, COUNT(DISTINCT session_id) AS sessions, ` +
+    `COUNT(DISTINCT CASE WHEN type = 'error' THEN session_id END) AS err_sessions, ` +
+    `COUNT(DISTINCT CASE WHEN type = 'error' THEN ${errId} END) AS errors, ${handled} AS unhandled ` +
+    `FROM "_rumdata" WHERE session_id IS NOT NULL AND ${scopeWhere(ctx)} GROUP BY bucket ORDER BY bucket LIMIT 500`
+  );
+};
+
+export const chartSql = (ctx: QueryCtx, interval: string): string => {
+  const errId = has(ctx, "error_id") ? "error_id" : "CAST(NULL AS VARCHAR)";
+  return (
+    `SELECT histogram(_timestamp, ${sqlLiteral(interval)}) AS x_axis_1, COUNT(DISTINCT session_id) AS y_axis_1, ` +
+    `COUNT(DISTINCT CASE WHEN type = 'error' THEN ${errId} END) AS y_axis_2 ` +
+    `FROM "_rumdata" WHERE session_id IS NOT NULL AND ${scopeWhere(ctx)} GROUP BY x_axis_1 ORDER BY x_axis_1`
+  );
+};
+
+// The panel key embeds its SQL, so the bucket step travels with the rows it produced.
+export const intervalFromKey = (key: string | null | undefined): string | null =>
+  /histogram\(_timestamp, '([^']+)'\)/.exec(key ?? "")?.[1] ?? null;
+
+export const releaseSessionsSql = (ctx: QueryCtx): string | null =>
+  has(ctx, "version")
+    ? `SELECT version, MIN(_timestamp) AS first_seen, COUNT(DISTINCT session_id) AS sessions, ` +
+      `COUNT(DISTINCT CASE WHEN type = 'error' THEN session_id END) AS err_sessions ` +
+      `FROM "_rumdata" WHERE version IS NOT NULL AND version <> '' AND session_id IS NOT NULL AND ${scopeWhere({ ...ctx, filters: { ...ctx.filters, version: [] } })} ` +
+      `GROUP BY version ORDER BY first_seen DESC LIMIT 2`
+    : null;
+
+export const releaseVitalsSql = (ctx: QueryCtx, versions: string[]): string | null =>
+  has(ctx, "version") && versions.length
+    ? `WITH ${viewsCte({ ...ctx, filters: { ...ctx.filters, version: [] } }, ["MIN(version) AS ver"], sqlIn("version", versions))} ` +
+      `SELECT ver, COUNT(*) AS views, approx_percentile_cont(lcp, 0.75) AS lcp, approx_percentile_cont(inp, 0.75) AS inp FROM v GROUP BY ver LIMIT 2`
+    : null;
+
+export const releaseNewErrorsSql = (ctx: QueryCtx, cur: string, prev: string): string | null =>
+  has(ctx, "version") && has(ctx, "error_message")
+    ? `WITH e AS (SELECT substr(error_message, 1, 200) AS k, ` +
+      `MAX(CASE WHEN version = ${sqlLiteral(cur)} THEN 1 ELSE 0 END) AS in_cur, ` +
+      `MAX(CASE WHEN version = ${sqlLiteral(prev)} THEN 1 ELSE 0 END) AS in_prev ` +
+      `FROM "_rumdata" WHERE type = 'error' AND error_message IS NOT NULL AND ${scopeWhere(
+        { ...ctx, filters: { ...ctx.filters, version: [] } },
+        sqlIn("version", [cur, prev]),
+      )} GROUP BY k) ` +
+      `SELECT COUNT(CASE WHEN in_cur = 1 AND in_prev = 0 THEN 1 END) AS new_errors FROM e LIMIT 1`
+    : null;
+
+export const filterOptionsSql = (schema: Set<string>): string | null => {
+  const cols = ["service", "env", "version"].filter((c) => schema.has(c));
+  const where = schema.has("source") ? ` WHERE ${BROWSER_SOURCE_WHERE}` : "";
+  return cols.length
+    ? `SELECT ${cols.join(", ")} FROM "_rumdata"${where} GROUP BY ${cols.join(", ")} LIMIT 500`
+    : null;
+};
+
+const num = (v: unknown): number | null => {
+  if (v === null || v === undefined || v === "") return null;
+  const n = Number(v);
+  return Number.isFinite(n) ? n : null;
+};
+
+export const toNum = (v: unknown): number => num(v) ?? 0;
+
+export const mapVitals = (row: Record<string, unknown> | undefined) => {
+  if (!row) return null;
+  const views = toNum(row.views);
+  const out: Record<string, unknown> = { views };
+  for (const k of VITAL_KEYS) {
+    out[k] = Object.fromEntries(PERCENTILES.map((p) => [p, num(row[`${k}_${p}`])]));
+    out[`${k}Bands`] = bandCounts(
+      toNum(row[`${k}_n`]),
+      toNum(row[`${k}_good`]),
+      toNum(row[`${k}_poor`]),
+    );
+  }
+  return out as unknown as {
+    views: number;
+    lcp: Record<Percentile, number | null>;
+    inp: Record<Percentile, number | null>;
+    cls: Record<Percentile, number | null>;
+    lcpBands: BandCounts;
+    inpBands: BandCounts;
+    clsBands: BandCounts;
+  };
+};
+
+export type VitalsSummary = NonNullable<ReturnType<typeof mapVitals>>;
+
+export const mapPages = (rows: Record<string, unknown>[]): PageRow[] =>
+  rankPages(
+    rows.map((r) => ({
+      path: String(r.pg ?? ""),
+      views: toNum(r.views),
+      lcp: num(r.lcp),
+      inp: num(r.inp),
+      cls: num(r.cls),
+      errors: toNum(r.errors),
+      bad: toNum(r.bad),
+    })),
+  );
+
+export const mapSegments = (
+  dim: SegmentDim,
+  cols: string[],
+  rows: Record<string, unknown>[],
+  windowViews?: number | null,
+): SegmentRow[] => {
+  // Only the top rows are returned, so their sum would overstate each share.
+  const total = windowViews || rows.reduce((s, r) => s + toNum(r.views), 0);
+  return rows.map((r) => {
+    const parts = cols.map((_, i) => String(r[`d${i}`] ?? "").trim()).filter(Boolean);
+    const filter =
+      dim === "browser" && parts.length > 1
+        ? `${cols[0]}=${sqlLiteral(parts[0])} AND ${cols[1]}=${sqlLiteral(parts[1])}`
+        : `${cols[0]}=${sqlLiteral(parts[0] ?? "")}`;
+    return {
+      label: parts.join(" "),
+      views: toNum(r.views),
+      inp: num(r.inp),
+      lcp: num(r.lcp),
+      share: total ? Math.min(100, Math.round((toNum(r.views) / total) * 100)) : 0,
+      filter,
+    };
+  });
+};
+
+// The substring prefilter only prunes; the normalised key decides, so /cart never matches /cartography.
+export const pageFilter = (path: string, schema: Set<string>, column = "view_url"): string =>
+  `${urlPrefilter(path, column)} AND ${pageKeyExpr(column, schemaRecord(schema))} = ${sqlLiteral(path)}`;
+
+export const versionFilter = (version: string): string => `version=${sqlLiteral(version)}`;
+
+export const andFilters = (...parts: (string | null | undefined)[]): string =>
+  parts.filter(Boolean).join(" AND ");
+
+export interface VitalDelta {
+  kind: "faster" | "slower" | "lower" | "higher" | "none";
+  text: string;
+}
+
+// Lower is better for every vital, so a negative change is an improvement; CLS is unitless, so it is lower/higher.
+export const vitalDelta = (
+  vital: VitalKey,
+  cur: number | null | undefined,
+  prev: number | null | undefined,
+): VitalDelta | null => {
+  const d = deltaOf(cur ?? null, prev ?? null);
+  if (!d) return null;
+  const text = formatVital(vital, Math.abs(d.abs));
+  const zero = formatVital(vital, 0);
+  if (d.direction === "flat" || text === zero) return { kind: "none", text: "" };
+  const down = d.abs < 0;
+  if (vital === "cls") return { kind: down ? "lower" : "higher", text };
+  return { kind: down ? "faster" : "slower", text };
+};
+
+export interface KpiDelta {
+  kind: "change" | "flat" | "new";
+  text: string;
+  tone: "good" | "bad" | "flat";
+}
+
+export const kpiDelta = (
+  cur: number | null,
+  prev: number | null,
+  opts: { higherIsBetter: boolean; points?: boolean },
+): KpiDelta | null => {
+  const d = deltaOf(cur, prev);
+  if (!d) return null;
+  if (d.direction === "flat") return { kind: "flat", text: "", tone: "flat" };
+  if (d.pct === null && !opts.points) return { kind: "new", text: "", tone: "flat" };
+  const sign = d.abs > 0 ? "+" : "-";
+  const multiple =
+    (d.pct as number) > MAX_DELTA_PCT && prev ? `${Math.round((cur as number) / prev)}x` : null;
+  const text = opts.points
+    ? `${sign}${Math.abs(d.abs).toFixed(1)}`
+    : (multiple ?? `${sign}${Math.round(Math.abs(d.pct as number))}%`);
+  return { kind: "change", text, tone: d.abs > 0 === opts.higherIsBetter ? "good" : "bad" };
+};
+
+export const deltaSentenceKey = (d: KpiDelta, points: boolean): I18nKey =>
+  d.kind === "flat"
+    ? "rum.overviewPage.deltaFlat"
+    : d.kind === "new"
+      ? "rum.overviewPage.deltaNewMsg"
+      : points
+        ? "rum.overviewPage.deltaChangePts"
+        : "rum.overviewPage.deltaChange";
+
+export const formatCount = (n: number | null | undefined): string =>
+  n === null || n === undefined ? NO_VALUE : n.toLocaleString();
+
+export const formatPercent = (n: number | null | undefined): string =>
+  n === null || n === undefined ? NO_VALUE : `${n.toFixed(1)}%`;
+
+export const sparkValues = (
+  series: { sessions: number; errSessions: number; errors: number; unhandled: number }[],
+  pick: "sessions" | "errors" | "unhandled" | "errorFree",
+): number[] =>
+  series.map((p) =>
+    pick === "errorFree"
+      ? p.sessions
+        ? ((p.sessions - p.errSessions) / p.sessions) * 100
+        : 100
+      : p[pick],
+  );
+
+// A version first seen at the start of the range, or in the first bucket, was live before it.
+export const versionPredatesRange = (
+  firstSeenUs: number,
+  startUs: number,
+  endUs: number,
+  firstBucketUs: number | null,
+  bucketUs: number,
+): boolean => {
+  const floor = Math.max(startUs + (endUs - startUs) * 0.05, (firstBucketUs ?? 0) + bucketUs);
+  return firstSeenUs < floor;
+};
+
+// A previous window needs enough views (or sessions, without vitals) and a tenth of the current traffic, or its deltas mislead.
+export const previousUsable = (
+  prev: { views?: number | null; sessions?: number | null },
+  cur: { views?: number | null; sessions?: number | null },
+): boolean => {
+  const byViews = prev.views !== null && prev.views !== undefined;
+  const p = (byViews ? prev.views : prev.sessions) ?? 0;
+  const c = (byViews ? cur.views : cur.sessions) ?? 0;
+  return p >= MIN_VIEWS && p >= c * MIN_PREVIOUS_SHARE;
+};
+
+// Within deltaOf's flat tolerance, or equal once formatted, a release is unchanged rather than better or worse.
+export const releaseTone = (
+  cur: number | null,
+  prev: number | null,
+  higherIsBetter: boolean,
+  shown?: { cur: string; prev: string },
+): "better" | "worse" | "same" => {
+  const d = deltaOf(cur, prev);
+  if (!d || d.direction === "flat" || (shown && shown.cur === shown.prev)) return "same";
+  return d.abs > 0 === higherIsBetter ? "better" : "worse";
+};
+
+// The bucket holding "now" is still filling, so drawing it would read as a drop.
+export const dropOpenBucket = <T extends { ts: number }>(
+  points: T[],
+  stepUs: number,
+  nowUs: number,
+): T[] => {
+  const last = points[points.length - 1];
+  return last && stepUs > 0 && last.ts + stepUs > nowUs ? points.slice(0, -1) : points;
+};
+
+export const overThresholdPct = (c: BandCounts): number => {
+  const p = bandPercents(c);
+  return p.needs + p.poor;
+};
+
+const INTERVAL_UNIT_US: Record<string, number> = { minute: 6e7, hour: 3.6e9, day: 8.64e10 };
+
+export const intervalMicros = (interval: string): number => {
+  const [n, unit] = interval.split(" ");
+  return Number(n) * (INTERVAL_UNIT_US[unit] ?? 0);
+};
+
+// A missing bucket means no traffic, so it is zero rather than a gap the line interpolates over.
+export const fillBuckets = <T extends { ts: number }>(
+  points: T[],
+  stepUs: number,
+  zero: (ts: number) => T,
+  maxPoints = 1000,
+): T[] => {
+  if (points.length < 2 || stepUs <= 0) return points;
+  const byTs = new Map(points.map((p) => [p.ts, p]));
+  const first = points[0].ts;
+  const last = points[points.length - 1].ts;
+  if ((last - first) / stepUs + 1 > maxPoints) return points;
+  if (points.some((p) => (p.ts - first) % stepUs !== 0)) return points;
+  const out: T[] = [];
+  for (let ts = first; ts <= last; ts += stepUs) out.push(byTs.get(ts) ?? zero(ts));
+  return out;
+};
+
+export interface PickerRange {
+  valueType?: string;
+  relativeTimePeriod?: string | null;
+}
+
+// A relative picker keeps `period` so the target page re-resolves "last 24 hours" itself.
+const timeQuery = (
+  range: { startUs: number; endUs: number } | null,
+  picker?: PickerRange | null,
+): Record<string, string> => {
+  if (picker?.valueType === "relative" && picker.relativeTimePeriod) {
+    return { period: picker.relativeTimePeriod };
+  }
+  return range ? { from: String(range.startUs), to: String(range.endUs) } : {};
+};
+
+export const drillQuery = (o: {
+  org: string;
+  filter: string;
+  scope: string;
+  range: { startUs: number; endUs: number } | null;
+  picker?: PickerRange | null;
+  extra?: Record<string, string>;
+  encode: (sql: string) => string | null;
+}): Record<string, string> => {
+  const where = andFilters(o.filter, o.scope === "1 = 1" ? null : o.scope);
+  return {
+    org_identifier: o.org,
+    ...(where ? { query: o.encode(where) ?? "" } : {}),
+    ...o.extra,
+    ...timeQuery(o.range, o.picker),
+  };
+};
+
+// Product Analytics resolves the range from the same period or from/to keys.
+export const analyticsQuery = (o: {
+  org: string;
+  range: { startUs: number; endUs: number } | null;
+  picker?: PickerRange | null;
+}): Record<string, string> => ({ org_identifier: o.org, ...timeQuery(o.range, o.picker) });
+
+const QUERY_KEYS = {
+  service: "ov_service",
+  env: "ov_env",
+  version: "ov_version",
+  percentile: "ov_pct",
+} as const;
+
+type QueryValue = string | null | (string | null)[] | undefined;
+
+const asList = (v: QueryValue): string[] =>
+  (Array.isArray(v) ? v : [v]).filter((x): x is string => typeof x === "string" && x !== "");
+
+export const stateFromQuery = (
+  query: Record<string, QueryValue>,
+): { filters: OverviewFilters; percentile: Percentile } => {
+  const pct = asList(query[QUERY_KEYS.percentile])[0];
+  return {
+    filters: {
+      service: asList(query[QUERY_KEYS.service]),
+      env: asList(query[QUERY_KEYS.env]),
+      version: asList(query[QUERY_KEYS.version]),
+    },
+    percentile: PERCENTILES.includes(pct as Percentile) ? (pct as Percentile) : "p75",
+  };
+};
+
+// Empty selections are omitted, and p75 is the default, so a plain page keeps a plain URL.
+export const queryFromState = (
+  filters: OverviewFilters,
+  percentile: Percentile,
+): Record<string, string | string[]> => ({
+  ...(filters.service.length ? { [QUERY_KEYS.service]: filters.service } : {}),
+  ...(filters.env.length ? { [QUERY_KEYS.env]: filters.env } : {}),
+  ...(filters.version.length ? { [QUERY_KEYS.version]: filters.version } : {}),
+  ...(percentile !== "p75" ? { [QUERY_KEYS.percentile]: percentile } : {}),
+});
+
+export const withoutOverviewState = <T extends Record<string, unknown>>(query: T): Partial<T> =>
+  Object.fromEntries(
+    Object.entries(query).filter(([k]) => !Object.values(QUERY_KEYS).includes(k as never)),
+  ) as Partial<T>;
+
+// The Performance page rebuilds its query on a range or refresh change, so the overview's own keys are carried over.
+export const overviewStateOnly = <T extends Record<string, unknown>>(query: T): Partial<T> =>
+  Object.fromEntries(
+    Object.entries(query).filter(([k]) => Object.values(QUERY_KEYS).includes(k as never)),
+  ) as Partial<T>;
+
+export const formatInZone = (ms: number, timeZone?: string, locale?: string): string => {
+  const opts: Intl.DateTimeFormatOptions = {
+    month: "short",
+    day: "numeric",
+    hour: "2-digit",
+    minute: "2-digit",
+  };
+  try {
+    return new Date(ms).toLocaleString(locale, { ...opts, timeZone });
+  } catch {
+    return new Date(ms).toLocaleString(locale, opts);
+  }
+};
diff --git a/web/src/utils/rum/performanceOverviewPanel.spec.ts b/web/src/utils/rum/performanceOverviewPanel.spec.ts
new file mode 100644
index 0000000000..e1a86b8cc8
--- /dev/null
+++ b/web/src/utils/rum/performanceOverviewPanel.spec.ts
@@ -0,0 +1,74 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { toZonedTime } from "date-fns-tz";
+import { raw } from "@/types/i18n";
+import { buildOverviewChartPanel } from "./performanceOverviewPanel";
+
+const labels = {
+  title: raw("Chart"),
+  time: raw("Time"),
+  sessions: raw("Sessions"),
+  errors: raw("Errors"),
+};
+const MS = Date.UTC(2026, 0, 15, 12, 0);
+
+describe("buildOverviewChartPanel", () => {
+  it("builds a custom-SQL line panel over _rumdata with sessions and errors on y", () => {
+    const panel = buildOverviewChartPanel("SELECT 1", labels, null, "UTC") as Record<string, any>;
+    const q = panel.queries[0];
+    expect(panel.type).toBe("line");
+    expect(panel.queryType).toBe("sql");
+    expect(q.customQuery).toBe(true);
+    expect(q.query).toBe("SELECT 1");
+    expect(q.fields.stream).toBe("_rumdata");
+    expect(q.fields.x.map((f: any) => f.alias)).toEqual(["x_axis_1"]);
+    expect(q.fields.y.map((f: any) => f.alias)).toEqual(["y_axis_1", "y_axis_2"]);
+    expect(panel.config.show_legends).toBe(true);
+  });
+
+  it("has no mark line without a marker", () => {
+    const panel = buildOverviewChartPanel("SELECT 1", labels, null, "UTC") as Record<string, any>;
+    expect(panel.config.mark_line).toEqual([]);
+  });
+
+  it("converts the marker time into the chart's zone, so different zones place it differently", () => {
+    const at = (tz: string) =>
+      (
+        (
+          buildOverviewChartPanel("s", labels, { version: "2.0", ms: MS }, tz) as Record<
+            string,
+            any
+          >
+        ).config.mark_line[0].value as Date
+      ).getTime();
+    expect(at("Asia/Tokyo")).toBe(toZonedTime(new Date(MS), "Asia/Tokyo").getTime());
+    expect(at("America/New_York")).toBe(toZonedTime(new Date(MS), "America/New_York").getTime());
+    expect(at("Asia/Tokyo")).not.toBe(at("America/New_York"));
+  });
+
+  it("keeps the label off, naming the line by version", () => {
+    const panel = buildOverviewChartPanel("s", labels, { version: "2.0", ms: MS }, "UTC") as Record<
+      string,
+      any
+    >;
+    expect(panel.config.mark_line[0]).toMatchObject({
+      name: "2.0",
+      type: "xAxis",
+      show_label: false,
+    });
+  });
+});
diff --git a/web/src/utils/rum/performanceOverviewPanel.ts b/web/src/utils/rum/performanceOverviewPanel.ts
new file mode 100644
index 0000000000..0c1ab4dcf2
--- /dev/null
+++ b/web/src/utils/rum/performanceOverviewPanel.ts
@@ -0,0 +1,108 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { toZonedTime } from "date-fns-tz";
+import type { I18nText } from "@/types/i18n";
+
+interface AxisField {
+  alias: string;
+  column: string;
+  color: null;
+  label: I18nText;
+}
+
+const axis = (alias: string, label: I18nText): AxisField => ({
+  alias,
+  column: alias,
+  color: null,
+  label,
+});
+
+export interface ChartMarker {
+  version: string;
+  /** Release first-seen time in epoch milliseconds. */
+  ms: number;
+}
+
+export interface ChartLabels {
+  title: I18nText;
+  time: I18nText;
+  sessions: I18nText;
+  errors: I18nText;
+}
+
+// The engine zone-shifts SQL x values, so the marker is shifted alike; its label would print the raw timestamp.
+export const buildOverviewChartPanel = (
+  sql: string,
+  labels: ChartLabels,
+  marker: ChartMarker | null,
+  timezone: string,
+): Record<string, unknown> => ({
+  version: 2,
+  id: "rum-overview-chart",
+  title: labels.title,
+  description: "",
+  type: "line",
+  config: {
+    show_legends: true,
+    legends_position: "bottom",
+    decimals: 0,
+    axis_border_show: true,
+    connect_nulls: true,
+    no_value_replacement: "",
+    show_symbol: false,
+    base_map: { type: "osm" },
+    map_view: { zoom: 1, lat: 0, lng: 0 },
+    mark_line: marker
+      ? [
+          {
+            name: marker.version,
+            type: "xAxis",
+            value: toZonedTime(new Date(marker.ms), timezone),
+            show_label: false,
+          },
+        ]
+      : [],
+  },
+  queryType: "sql",
+  queries: [
+    {
+      query: sql,
+      customQuery: true,
+      vrlFunctionQuery: "",
+      fields: {
+        stream: "_rumdata",
+        stream_type: "logs",
+        x: [axis("x_axis_1", labels.time)],
+        y: [axis("y_axis_1", labels.sessions), axis("y_axis_2", labels.errors)],
+        z: [],
+        breakdown: [],
+        filter: { filterType: "group", logicalOperator: "AND", conditions: [] },
+        latitude: null,
+        longitude: null,
+        weight: null,
+      },
+      config: {
+        promql_legend: "",
+        layer_type: "scatter",
+        weight_fixed: 1,
+        limit: 0,
+        min: 0,
+        max: 100,
+        time_shift: [],
+      },
+    },
+  ],
+});
diff --git a/web/src/utils/synthetics/buildPayload.spec.ts b/web/src/utils/synthetics/buildPayload.spec.ts
index a1da333559..2fb543352e 100644
--- a/web/src/utils/synthetics/buildPayload.spec.ts
+++ b/web/src/utils/synthetics/buildPayload.spec.ts
@@ -115,3 +115,68 @@ describe("environments round-trip", () => {
     expect(mapped.environments).toEqual(["env-1"]);
   });
 });
+
+describe("browser config extras (UI-04)", () => {
+  const stored = {
+    name: "api made",
+    target: "https://app.test",
+    enabled: true,
+    tags: [],
+    locations: ["us-east"],
+    frequency: { type: "minutes", interval: 5, cron: "" },
+    config: {
+      steps: [],
+      timeout_ms: 90000,
+      journey_budget_ms: 120000,
+      test_id_attr: "data-qa",
+      runtime: "playwright-1.50",
+      capture: { screenshot: "always", trace: "on-fail", video: "on" },
+      headers: [{ name: "Authorization", value: "Bearer secret" }],
+      secret_blob: "do-not-spread",
+    },
+  };
+
+  it("uses defaults on create", () => {
+    const config = buildCreateBrowserTestPayload(check()).config as Record<string, any>;
+    expect(config.timeout_ms).toBe(30000);
+    expect(config.capture.video).toBe("off");
+    expect("journey_budget_ms" in config).toBe(false);
+    expect("test_id_attr" in config).toBe(false);
+    expect("runtime" in config).toBe(false);
+  });
+
+  it("preserves API-set fields across an unrelated name edit", () => {
+    const loaded = mapResponseToBrowserCheck(stored);
+    const config = buildCreateBrowserTestPayload({ ...loaded, name: "renamed" }).config as Record<
+      string,
+      any
+    >;
+    expect(config.timeout_ms).toBe(90000);
+    expect(config.journey_budget_ms).toBe(120000);
+    expect(config.test_id_attr).toBe("data-qa");
+    expect(config.runtime).toBe("playwright-1.50");
+    expect(config.capture.video).toBe("on");
+  });
+
+  it("does not leak unsupported config keys into the extras", () => {
+    const loaded = mapResponseToBrowserCheck(stored);
+    expect(Object.keys(loaded.browserConfigExtras ?? {}).sort()).toEqual([
+      "journey_budget_ms",
+      "runtime",
+      "test_id_attr",
+      "timeout_ms",
+      "video",
+    ]);
+    expect(JSON.stringify(loaded.browserConfigExtras)).not.toContain("do-not-spread");
+  });
+
+  it("still applies intentional capture edits", () => {
+    const loaded = mapResponseToBrowserCheck(stored);
+    const config = buildCreateBrowserTestPayload({
+      ...loaded,
+      capture: { screenshot: "off", trace: "off" },
+    }).config as Record<string, any>;
+    expect(config.capture.screenshot).toBe("off");
+    expect(config.capture.video).toBe("on");
+  });
+});
diff --git a/web/src/utils/synthetics/buildPayload.ts b/web/src/utils/synthetics/buildPayload.ts
index dfe42b0062..938b31671c 100644
--- a/web/src/utils/synthetics/buildPayload.ts
+++ b/web/src/utils/synthetics/buildPayload.ts
@@ -102,6 +102,7 @@ export function buildCreateBrowserTestPayload(check: BrowserCheck): Record<strin
     url,
     folder,
     browserDevices,
+    browserConfigExtras: extras,
     retries,
     waitBeforeRetrySecs,
     cooldownMins,
@@ -146,11 +147,17 @@ export function buildCreateBrowserTestPayload(check: BrowserCheck): Record<strin
       // throws here — the save gate is what stops it getting this far.
       steps: buildV2Steps(journey),
       browser_devices: browserDevices ?? [{ browser: "chromium", device: "desktop" }],
-      timeout_ms: 30000,
+      // Defaults apply on create only; on edit the stored values win.
+      timeout_ms: extras?.timeout_ms ?? 30000,
+      ...(extras?.journey_budget_ms !== undefined && {
+        journey_budget_ms: extras.journey_budget_ms,
+      }),
+      ...(extras?.test_id_attr !== undefined && { test_id_attr: extras.test_id_attr }),
+      ...(extras?.runtime !== undefined && { runtime: extras.runtime }),
       capture: {
         screenshot: capture?.screenshot ?? "on-fail",
         trace: capture?.trace ?? "on-fail",
-        video: "off",
+        video: extras?.video ?? "off",
       },
       ...(secrets?.length && { secrets: secrets.map(({ id: _id, ...s }) => s) }),
       ...(headers?.length && { headers: headers.map(({ id: _id, ...h }) => h) }),
@@ -348,6 +355,18 @@ function mapFrequencyToSchedule(freq: any, start?: number): BrowserCheck["schedu
   };
 }
 
+function pickBrowserConfigExtras(config: any): BrowserCheck["browserConfigExtras"] {
+  if (!config) return undefined;
+  const out: NonNullable<BrowserCheck["browserConfigExtras"]> = {};
+  if (typeof config.journey_budget_ms === "number")
+    out.journey_budget_ms = config.journey_budget_ms;
+  if (typeof config.test_id_attr === "string") out.test_id_attr = config.test_id_attr;
+  if (typeof config.runtime === "string") out.runtime = config.runtime;
+  if (typeof config.timeout_ms === "number") out.timeout_ms = config.timeout_ms;
+  if (typeof config.capture?.video === "string") out.video = config.capture.video;
+  return Object.keys(out).length ? out : undefined;
+}
+
 export function mapResponseToBrowserCheck(data: Record<string, unknown>): BrowserCheck {
   const {
     config,
@@ -397,6 +416,9 @@ export function mapResponseToBrowserCheck(data: Record<string, unknown>): Browse
 
     browserDevices: config?.browser_devices,
 
+    // Allowlisted pick (not a spread of `config`, which can hold secrets).
+    browserConfigExtras: pickBrowserConfigExtras(config),
+
     // No `preserveWire`: a stored version-2 step is poorer than what
     // buildWireFromStep rebuilds from the UI fields, so keeping it would shadow
     // the correct reconstruction — which is how a reloaded `select` came to
diff --git a/web/src/views/Dashboards/PublicDashboard.spec.ts b/web/src/views/Dashboards/PublicDashboard.spec.ts
index 7ce7d3ec99..232db6412c 100644
--- a/web/src/views/Dashboards/PublicDashboard.spec.ts
+++ b/web/src/views/Dashboards/PublicDashboard.spec.ts
@@ -25,9 +25,10 @@ import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
 
+const routeMock = vi.hoisted(() => ({ query: {} as Record<string, string>, replace: vi.fn() }));
 vi.mock("vue-router", () => ({
-  useRoute: () => ({ params: { slug: "abc" }, query: {} }),
-  useRouter: () => ({ push: vi.fn() }),
+  useRoute: () => ({ params: { slug: "abc" }, query: routeMock.query }),
+  useRouter: () => ({ push: vi.fn(), replace: routeMock.replace }),
 }));
 vi.mock("@/services/public_dashboards", () => ({
   default: { getConfig: vi.fn(), getData: vi.fn() },
@@ -40,6 +41,8 @@ import PanelSchemaRenderer from "@/components/dashboards/PanelSchemaRenderer.vue
 import OButton from "@/lib/core/Button/OButton.vue";
 import KioskCountdownRing from "@/components/dashboards/kiosk/KioskCountdownRing.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import PoweredByOpenObserve from "@/components/common/PoweredByOpenObserve.vue";
+import { getPanelDisplayTitle } from "@/utils/dashboard/panelTitle";
 
 const CONFIG = {
   title: "My Dashboard",
@@ -147,6 +150,7 @@ const panelsConfig = (panels: Array<Record<string, unknown>>) => ({
 describe("PublicDashboard viewer", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    routeMock.query = {};
     // Lifecycle jitter off, so every cadence below is exact.
     vi.spyOn(Math, "random").mockReturnValue(0);
   });
@@ -811,6 +815,99 @@ describe("PublicDashboard viewer", () => {
     expect(list.map((v: { value: string }) => v.value)).toEqual(["default-env"]);
   });
 
+  it("names each frozen variable as the dashboard does, so a panel title resolves its value", async () => {
+    vi.mocked(service.getConfig).mockResolvedValue({
+      data: {
+        ...panelsConfig([{ id: "p1", title: "A ($level)" }]),
+        variables: [{ name: "level", label: "Level", value: "error" }],
+      },
+      status: 200,
+    } as never);
+    vi.mocked(service.getData).mockResolvedValue(okSnapshot([]) as never);
+    const w = buildWrapper();
+    await flushPromises();
+    const { tabs, variables } = grid(w).props("dashboardData");
+    expect(variables.list[0].name).toBe("level");
+    const title = getPanelDisplayTitle(
+      tabs[0].panels[0].title,
+      { values: variables.list },
+      { tabId: "t1", panelId: "p1" },
+      "All",
+    );
+    expect(title).toBe("A (error)");
+  });
+
+  it("shows a typed-in value without the picker's custom marker", async () => {
+    vi.mocked(service.getConfig).mockResolvedValue({
+      data: {
+        ...CONFIG,
+        variables: [
+          { name: "ns", label: "Namespace", value: "ziox::_o2_custom" },
+          { name: "pods", label: "Pods", value: ["a::_o2_custom", "b"] },
+        ],
+      },
+      status: 200,
+    } as never);
+    vi.mocked(service.getData).mockResolvedValue(okSnapshot([]) as never);
+    const w = buildWrapper();
+    await flushPromises();
+    const list = grid(w).props("dashboardData").variables.list;
+    expect(list.map((v: { value: string }) => v.value)).toEqual(["ziox", "a, b"]);
+  });
+
+  it("opens on the range and tab in the URL, and replaces unknown ones with the defaults", async () => {
+    const twoTabs = {
+      ...CONFIG,
+      layout: [...CONFIG.layout, { tabId: "t2", name: "Errors", panels: [] }],
+    };
+    vi.mocked(service.getConfig).mockResolvedValue({ data: twoTabs, status: 200 } as never);
+    vi.mocked(service.getData).mockResolvedValue(okSnapshot([]) as never);
+    routeMock.query = { range: "r86400", tab: "t2" };
+    buildWrapper();
+    await flushPromises();
+    expect(service.getData).toHaveBeenCalledWith("abc", "r86400", undefined);
+    expect(routeMock.replace).not.toHaveBeenCalled();
+
+    vi.mocked(service.getData).mockClear();
+    routeMock.query = { range: "r1", tab: "gone" };
+    buildWrapper();
+    await flushPromises();
+    expect(service.getData).toHaveBeenCalledWith("abc", "r3600", undefined);
+    expect(routeMock.replace).toHaveBeenCalledWith({ query: { range: "r3600", tab: "t1" } });
+  });
+
+  it("puts a range switch in the URL without adding a history entry", async () => {
+    vi.mocked(service.getConfig).mockResolvedValue({ data: CONFIG, status: 200 } as never);
+    vi.mocked(service.getData).mockResolvedValue(okSnapshot([]) as never);
+    const w = mountWithPicker();
+    await flushPromises();
+    pickRange(w, "r86400");
+    await flushPromises();
+    expect(routeMock.replace).toHaveBeenLastCalledWith({ query: { range: "r86400", tab: "t1" } });
+  });
+
+  it("says Powered by OpenObserve once, in the footer", async () => {
+    vi.mocked(service.getConfig).mockResolvedValue({ data: CONFIG, status: 200 } as never);
+    vi.mocked(service.getData).mockResolvedValue(okSnapshot([]) as never);
+    const w = shallowMount(PublicDashboard, {
+      global: {
+        plugins: [i18n],
+        provide: { store },
+        stubs: {
+          OPageHeader: {
+            template: "<div><slot name='title-trail' /><slot name='actions' /></div>",
+          },
+        },
+      },
+    });
+    await flushPromises();
+    const powered = w.findAllComponents(PoweredByOpenObserve);
+    expect(powered).toHaveLength(1);
+    expect(
+      find(w, "dashboards-public-dashboard-footer").findComponent(PoweredByOpenObserve).exists(),
+    ).toBe(true);
+  });
+
   it("falls back to the default range when the author removes the viewer's range", async () => {
     vi.mocked(service.getConfig).mockResolvedValue({ data: CONFIG, status: 200 } as never);
     vi.mocked(service.getData).mockResolvedValue(okSnapshot([]) as never);
diff --git a/web/src/views/Dashboards/PublicDashboard.vue b/web/src/views/Dashboards/PublicDashboard.vue
index 82ea0ce700..b227c1bc5a 100644
--- a/web/src/views/Dashboards/PublicDashboard.vue
+++ b/web/src/views/Dashboards/PublicDashboard.vue
@@ -46,12 +46,6 @@
         icon="dashboard"
         title-data-test="dashboards-public-dashboard-title"
       >
-        <template #title-trail>
-          <div class="flex h-8 self-center max-md:hidden">
-            <OSeparator vertical />
-          </div>
-          <PoweredByOpenObserve size="md" class="max-md:hidden" />
-        </template>
         <template #actions>
           <span
             v-if="windowLabel && !pickerShowsWindow"
@@ -226,7 +220,7 @@
 
 <script setup lang="ts">
 import { ref, computed, watch, onMounted, onBeforeUnmount, provide } from "vue";
-import { useRoute } from "vue-router";
+import { useRoute, useRouter, type LocationQueryRaw } from "vue-router";
 import { useStore } from "vuex";
 import { useI18nTyped, raw, type I18nText } from "@/types/i18n";
 import RenderDashboardCharts from "@/views/Dashboards/RenderDashboardCharts.vue";
@@ -245,6 +239,7 @@ import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OSeparator from "@/lib/core/Separator/OSeparator.vue";
 import ThemeSwitcher from "@/components/ThemeSwitcher.vue";
+import { CUSTOM_VALUE } from "@/utils/dashboard/constants";
 import publicDashboardsService from "@/services/public_dashboards";
 import { formatInTimeZone } from "date-fns-tz";
 import { durationFormatter } from "@/utils/formatters";
@@ -298,7 +293,13 @@ interface DataBody {
 }
 
 /** A frozen value as the public config lists it; scoped ones name their tab or panel. */
-type PublicVariable = { label: string; value: unknown; tab_id?: string; panel_id?: string };
+type PublicVariable = {
+  name?: string;
+  label: string;
+  value: unknown;
+  tab_id?: string;
+  panel_id?: string;
+};
 
 type ViewState =
   | "loading"
@@ -312,16 +313,23 @@ type ViewState =
   | "offline";
 
 const route = useRoute();
+const router = useRouter();
 const store = useStore();
 const { t } = useI18nTyped();
 const slug = String(route.params.slug || "");
 
+// A shared or reloaded link reopens on its range and tab; an unknown value falls back once the config loads.
+const queryParam = (name: string): string | null => {
+  const value = route.query[name];
+  return typeof value === "string" && value ? value : null;
+};
+
 const state = ref<ViewState>("loading");
 const config = ref<Record<string, any>>({});
 // The body on screen and the range it belongs to; its rev is sent back as If-None-Match.
 const body = ref<DataBody | null>(null);
 const bodyKey = ref<string | null>(null);
-const selectedKey = ref<string | null>(null);
+const selectedKey = ref<string | null>(queryParam("range"));
 // Server clock minus local clock, from the last response's Date header.
 const clockOffset = ref(0);
 // Local time a 429 or a temporary 503 ends, for its countdown; `holdKind` says which one.
@@ -349,7 +357,7 @@ const setTimezone = (tz: unknown) => {
   store.dispatch("setTimezone", tz);
 };
 // RenderDashboardCharts and TabList read and switch the active tab through this.
-const selectedTabId = ref<string>("");
+const selectedTabId = ref<string>(queryParam("tab") ?? "");
 provide("selectedTabId", selectedTabId);
 
 // Date.now() isn't reactive, so countdowns read this ticking copy.
@@ -371,7 +379,9 @@ const variableValue = (value: unknown): string => {
   if (value === null || value === undefined || value === "") {
     return t("dashboard.publicDashboard.variableUnset");
   }
-  return Array.isArray(value) ? value.join(", ") : String(value);
+  // A typed-in value is saved with the picker's custom marker, which only the search strips.
+  const shown = (v: unknown) => String(v).replace(new RegExp(`${CUSTOM_VALUE}$`), "");
+  return Array.isArray(value) ? value.map(shown).join(", ") : shown(value);
 };
 
 // Constants are read-only and query nothing, and the grid places each by scope as the live page does.
@@ -383,8 +393,8 @@ const frozenVariables = computed(() => {
       ? config.value.variables
       : [];
   return all.map((v, i) => ({
-    // Scoped entries repeat a label, and the grid keys variables by name.
-    name: `public_var_${i}`,
+    // Panel titles substitute by name; a result stored before names were sent falls back to a unique one.
+    name: v.name || `public_var_${i}`,
     label: v.label,
     type: "constant",
     value: variableValue(v.value),
@@ -712,6 +722,16 @@ const loadConfig = async () => {
   }
 };
 
+// Replaced, not pushed, so switching range or tab adds no history entry.
+watch([selectedKey, selectedTabId, configLoaded], () => {
+  if (!configLoaded.value || !selectedKey.value) return;
+  const query: LocationQueryRaw = { ...route.query, range: selectedKey.value };
+  if (selectedTabId.value) query.tab = selectedTabId.value;
+  else delete query.tab;
+  if (route.query.range === query.range && route.query.tab === query.tab) return;
+  router.replace({ query });
+});
+
 const responseOf = (e: unknown) =>
   (e as { response?: { status?: number; headers?: Record<string, unknown>; data?: any } })
     ?.response;
diff --git a/web/src/views/Dashboards/addPanel/AddCondition.spec.ts b/web/src/views/Dashboards/addPanel/AddCondition.spec.ts
index 3eea8d42f6..7f0dfceb7b 100644
--- a/web/src/views/Dashboards/addPanel/AddCondition.spec.ts
+++ b/web/src/views/Dashboards/addPanel/AddCondition.spec.ts
@@ -587,6 +587,29 @@ describe("AddCondition.vue", () => {
 
       expect(wrapper.vm.$props.condition.values).toEqual(["value1", "value2"]);
     });
+
+    it("should clear emptyLiteral when the user types a value", async () => {
+      const condition = {
+        ...defaultProps.condition,
+        operator: "<>",
+        value: "",
+        emptyLiteral: true,
+      };
+
+      wrapper = createWrapper({ condition });
+      wrapper.vm.onValueInput("api");
+
+      expect(wrapper.vm.$props.condition.value).toBe("api");
+      expect(wrapper.vm.$props.condition.emptyLiteral).toBeUndefined();
+    });
+
+    it("should keep emptyLiteral when a different condition is passed in", async () => {
+      wrapper = createWrapper({ condition: { ...defaultProps.condition, value: "x" } });
+      const next = { ...defaultProps.condition, operator: "<>", value: "", emptyLiteral: true };
+      await wrapper.setProps({ condition: next });
+
+      expect(next.emptyLiteral).toBe(true);
+    });
   });
 
   describe("Edge cases", () => {
diff --git a/web/src/views/Dashboards/addPanel/AddCondition.vue b/web/src/views/Dashboards/addPanel/AddCondition.vue
index 9a49d4b494..d9f01e6df4 100644
--- a/web/src/views/Dashboards/addPanel/AddCondition.vue
+++ b/web/src/views/Dashboards/addPanel/AddCondition.vue
@@ -110,7 +110,8 @@
                         {{ t("common.value") }}
                       </div>
                       <OCombobox
-                        v-model="conditionModel.value"
+                        :model-value="conditionModel.value"
+                        @update:model-value="onValueInput"
                         :items="dashboardVariablesFilterItems"
                         search-regex="(?:^|[^$])\$?(\w+)"
                         :placeholder="t('common.enterValueOrVariable')"
@@ -327,6 +328,15 @@ export default defineComponent({
       conditionModel.value.column = {};
     };
 
+    // `emptyLiteral` keeps a `<> ''` that came from SQL. Once the user types a
+    // value, an empty value means "not entered yet" again. Cleared on input, not
+    // by watching the prop: chips are keyed by index, so removing one hands this
+    // component a different condition and a watcher would clear the wrong flag.
+    const onValueInput = (value: any) => {
+      conditionModel.value.value = value;
+      if (conditionModel.value.emptyLiteral) delete conditionModel.value.emptyLiteral;
+    };
+
     watch(
       () => props.condition.column,
       (newColumn, oldColumn) => {
@@ -355,6 +365,7 @@ export default defineComponent({
       emitLogicalOperatorChange,
       handleFieldChange,
       removeColumnName,
+      onValueInput,
       conditionModel,
       filteredSchemaOptions,
       sortedFilteredListOptions: filteredListOptions,
diff --git a/web/src/views/Infrastructure/hostsQueries.spec.ts b/web/src/views/Infrastructure/hostsQueries.spec.ts
index e72a4375e4..7f8e02f848 100644
--- a/web/src/views/Infrastructure/hostsQueries.spec.ts
+++ b/web/src/views/Infrastructure/hostsQueries.spec.ts
@@ -101,10 +101,15 @@ describe("hostsQueries — liveness & last-seen ride the 1-series-per-host load
 });
 
 describe("hostsQueries — utilization shapes", () => {
-  it("CPU is the 1 - idle form, never a partial state sum", () => {
+  it("CPU is the idle-to-total ratio, correct with or without the per-core cpu label", () => {
     expect(HOSTS_CPU_QUERY).toBe(
-      '100 * (1 - avg by (host_name)(irate(system_cpu_time{state="idle",' + GUARD + "}[5m])))",
+      '100 * (1 - sum by (host_name)(irate(system_cpu_time{state="idle",' +
+        GUARD +
+        "}[5m])) / sum by (host_name)(irate(system_cpu_time{" +
+        GUARD +
+        "}[5m])))",
     );
+    expect(HOSTS_CPU_QUERY).not.toContain("avg");
   });
 
   // The collector computes every state as ratio(state, MemTotal) against ONE
@@ -180,9 +185,11 @@ describe("hostsQueries — utilization shapes", () => {
   it("counts cores off the DEFAULT-ON cpu metric, one series per cpu", () => {
     // system_cpu_logical_count is opt-in and this fleet emits zero series of it.
     expect(HOSTS_CORES_QUERY).toBe(
-      'count by (host_name)(count by (host_name, cpu)(system_cpu_time{state="idle",' +
+      'count by (host_name)(count by (host_name, cpu)(system_cpu_time{state="idle",cpu!="",' +
         GUARD +
-        "}))",
+        "})) or round(sum by (host_name)(rate(system_cpu_time{" +
+        GUARD +
+        "}[5m])))",
     );
     expect(HOSTS_CORES_QUERY).not.toContain("system_cpu_logical_count");
     // One state only: without it each cpu contributes a series per state.
diff --git a/web/src/views/Infrastructure/hostsQueries.ts b/web/src/views/Infrastructure/hostsQueries.ts
index 60023956a2..f5e2f1ce1e 100644
--- a/web/src/views/Infrastructure/hostsQueries.ts
+++ b/web/src/views/Infrastructure/hostsQueries.ts
@@ -43,7 +43,8 @@ export const HOSTS_LIVENESS_QUERY = `count by (host_name, os_type, k8s_node_name
 // k8s_node_name is grouped too because liveness carries it only for ACTIVE hosts, leaving dead ones pod-named.
 export const HOSTS_LAST_SEEN_SQL = `SELECT host_name, k8s_node_name, max(_timestamp) AS last_seen FROM "system_cpu_load_average_15m" WHERE ${HOSTS_PRODUCER_GUARD_SQL} GROUP BY host_name, k8s_node_name`;
 
-export const HOSTS_CPU_QUERY = `100 * (1 - avg by (host_name)(irate(system_cpu_time{state="idle",${HOSTS_PRODUCER_GUARD}}[5m])))`;
+// A ratio, not 1 - avg(idle): collectors >= 0.157 drop the cpu label and sum idle across cores.
+export const HOSTS_CPU_QUERY = `100 * (1 - sum by (host_name)(irate(system_cpu_time{state="idle",${HOSTS_PRODUCER_GUARD}}[5m])) / sum by (host_name)(irate(system_cpu_time{${HOSTS_PRODUCER_GUARD}}[5m])))`;
 
 // The six states the collector ratios against ONE MemTotal; each is a redundant MemTotal estimate.
 export const HOSTS_MEMORY_STATES = [
@@ -65,5 +66,5 @@ export const HOSTS_DISK_QUERY = `100 * max by (host_name)(sum by (host_name, mou
 
 export const HOSTS_LOAD_QUERY = `avg by (host_name)(system_cpu_load_average_15m{${HOSTS_PRODUCER_GUARD}})`;
 
-// system_cpu_logical_count is opt-in and unemitted here; system_cpu_time is default-on and carries one series per cpu.
-export const HOSTS_CORES_QUERY = `count by (host_name)(count by (host_name, cpu)(system_cpu_time{state="idle",${HOSTS_PRODUCER_GUARD}}))`;
+// system_cpu_logical_count is opt-in; without the opt-in cpu label, all states together accrue one second per second per core.
+export const HOSTS_CORES_QUERY = `count by (host_name)(count by (host_name, cpu)(system_cpu_time{state="idle",cpu!="",${HOSTS_PRODUCER_GUARD}})) or round(sum by (host_name)(rate(system_cpu_time{${HOSTS_PRODUCER_GUARD}}[5m])))`;
diff --git a/web/src/views/RUM/AppPerformance.vue b/web/src/views/RUM/AppPerformance.vue
index 272eb81cb0..da49867d65 100644
--- a/web/src/views/RUM/AppPerformance.vue
+++ b/web/src/views/RUM/AppPerformance.vue
@@ -166,6 +166,7 @@ import { useI18nTyped } from "@/types/i18n";
 import { useRouter } from "vue-router";
 import { getDashboard } from "@/utils/commons.ts";
 import { parseDuration, generateDurationLabel } from "@/utils/date";
+import { overviewStateOnly } from "@/utils/rum/performanceOverview";
 import { reactive } from "vue";
 import { useRoute } from "vue-router";
 import AutoRefreshInterval from "@/components/AutoRefreshInterval.vue";
@@ -327,6 +328,7 @@ export default defineComponent({
           org_identifier: store.state.selectedOrganization.identifier,
           refresh: generateDurationLabel(refreshInterval.value),
           ...getQueryParamsForDuration(selectedDate.value),
+          ...(activePerformanceTab.value === "overview" ? overviewStateOnly(route.query) : {}),
         },
       });
     };
@@ -479,6 +481,7 @@ export default defineComponent({
           folder: route.query.folder,
           refresh: generateDurationLabel(refreshInterval.value),
           ...getQueryParamsForDuration(selectedDate.value),
+          ...overviewStateOnly(route.query),
         },
       });
     });
diff --git a/web/src/views/RUM/RealUserMonitoring.vue b/web/src/views/RUM/RealUserMonitoring.vue
index 6ac3adc220..7af2f9c1bf 100644
--- a/web/src/views/RUM/RealUserMonitoring.vue
+++ b/web/src/views/RUM/RealUserMonitoring.vue
@@ -73,6 +73,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
+import { overviewStateOnly } from "@/utils/rum/performanceOverview";
 import { computed, nextTick, onActivated, onMounted, ref, watch, onUpdated } from "vue";
 import { useRouter } from "vue-router";
 import { useStore } from "vuex";
@@ -306,6 +307,7 @@ const changeTab = (tab: string | number) => {
       name: "rumPerformanceSummary",
       query: {
         ...getQueryParams(performanceState.data.datetime, ""),
+        ...overviewStateOnly(router.currentRoute.value.query),
         org_identifier: store.state.selectedOrganization.identifier,
       },
     });
diff --git a/web/src/views/RUM/SessionViewer.spec.ts b/web/src/views/RUM/SessionViewer.spec.ts
index dd066be3db..96e185cb18 100644
--- a/web/src/views/RUM/SessionViewer.spec.ts
+++ b/web/src/views/RUM/SessionViewer.spec.ts
@@ -866,6 +866,38 @@ describe("SessionViewer.vue — session id with an embedded single quote", () =>
   });
 });
 
+describe("SessionViewer.vue — geo columns in the session lookup", () => {
+  const savedFields = replaySchema.fields;
+
+  afterEach(() => {
+    replaySchema.fields = savedFields;
+  });
+
+  it.each([
+    ["geo_info_country", "min(geo_info_country) as country", "geo_info_city"],
+    ["geo_info_city", "min(geo_info_city) as city", "geo_info_country"],
+  ])("selects %s only, when the stream has no other geo column", async (column, select, absent) => {
+    vi.clearAllMocks();
+    replaySchema.fields = { [column]: true };
+    const router = createTestRouter();
+    await router.push({
+      path: "/rum/sessions/session-abc",
+      query: { start_time: "1692884313968000", end_time: "1692884769270000" },
+    });
+    const wrapper = mountSessionViewer(router);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    const lookup = vi
+      .mocked(searchService.search)
+      .mock.calls.map((call) => (call[0] as any).query.query.sql as string)
+      .find((sql) => sql.includes("min(start)"));
+    expect(lookup).toContain(select);
+    expect(lookup).not.toContain(absent);
+
+    wrapper.unmount();
+  });
+});
+
 describe("SessionViewer.vue — no replay recorded", () => {
   const flush = () => new Promise((resolve) => setTimeout(resolve, 0));
 
diff --git a/web/src/views/RUM/SessionViewer.vue b/web/src/views/RUM/SessionViewer.vue
index 3d53cb398f..bbacaa26ea 100644
--- a/web/src/views/RUM/SessionViewer.vue
+++ b/web/src/views/RUM/SessionViewer.vue
@@ -888,11 +888,11 @@ const searchWithRetry = (req: any, options: RetryOptions = { isCancelled: () =>
 const getSession = async () => {
   let geoFields = "";
 
-  if (performanceState.data.streams["_sessionreplay"]["schema"]["geo_info_country"]) {
+  if (performanceState.data.streams["_sessionreplay"]["schema"]["geo_info_city"]) {
     geoFields += "min(geo_info_city) as city,";
   }
 
-  if (performanceState.data.streams["_sessionreplay"]["schema"]["geo_info_city"]) {
+  if (performanceState.data.streams["_sessionreplay"]["schema"]["geo_info_country"]) {
     geoFields += "min(geo_info_country) as country,";
   }
 
diff --git a/web/src/views/SyntheticMonitoring.vue b/web/src/views/SyntheticMonitoring.vue
index d83da98682..685baf66e6 100644
--- a/web/src/views/SyntheticMonitoring.vue
+++ b/web/src/views/SyntheticMonitoring.vue
@@ -640,6 +640,25 @@ function formatTimeAgo(microseconds: number): string {
   return t("synthetics.daysAgo", { count: Math.floor(h / 24) });
 }
 
+/**
+ * Backend check status -> UI status key. The API sends strings, but the
+ * numeric enum (0 unknown, 1 passed, 2 warning, 3 failed, 4 error) may also
+ * reach us; anything unmapped becomes "unknown" so it never renders blank.
+ */
+const MONITOR_STATUS_BY_NUMBER: Record<number, string> = {
+  0: "unknown",
+  1: "passed",
+  2: "warning",
+  3: "failed",
+  4: "error",
+};
+const KNOWN_MONITOR_STATUSES = new Set(["passed", "warning", "failed", "error", "unknown"]);
+function normalizeMonitorStatus(status: unknown): string {
+  if (typeof status === "number") return MONITOR_STATUS_BY_NUMBER[status] ?? "unknown";
+  const s = String(status ?? "").toLowerCase();
+  return KNOWN_MONITOR_STATUSES.has(s) ? s : "unknown";
+}
+
 function mapMonitor(m: ApiMonitor) {
   return {
     id: m.id,
@@ -649,7 +668,7 @@ function mapMonitor(m: ApiMonitor) {
     url: m.target,
     type: m.type.toUpperCase(),
     interval: formatFrequency(m.frequency),
-    status: m.status,
+    status: normalizeMonitorStatus(m.status),
     responseTime: m.last_response_ms !== null ? `${m.last_response_ms}ms` : null,
     locations: m.locations,
     lastCheck: m.last_check_at !== null ? formatTimeAgo(m.last_check_at) : "—",
@@ -1354,6 +1373,15 @@ const summaryStats = computed<StatItem[]>(() => {
       max: share,
       dataTest: "synthetics-summary-failed",
     },
+    {
+      key: "error",
+      label: t("synthetics.filters.error"),
+      value: v(count("error")),
+      icon: "error-outline",
+      tone: "error",
+      max: share,
+      dataTest: "synthetics-summary-error",
+    },
     {
       key: "warning",
       label: t("synthetics.filters.warning"),
diff --git a/web/src/views/synthetics/PrivateLocationDetail.spec.ts b/web/src/views/synthetics/PrivateLocationDetail.spec.ts
index 44806980bc..9914eea2af 100644
--- a/web/src/views/synthetics/PrivateLocationDetail.spec.ts
+++ b/web/src/views/synthetics/PrivateLocationDetail.spec.ts
@@ -349,4 +349,44 @@ describe("PrivateLocationDetail", () => {
       );
     });
   });
+
+  describe("load failures (UI-06)", () => {
+    it("shows a retry state for a 500 and recovers on retry", async () => {
+      mockServiceGetLocation.mockRejectedValueOnce({ response: { status: 500 } });
+      wrapper = mountPage();
+      await flushPromises();
+      expect(wrapper.find('[data-test="synthetics-private-location-detail-error"]').exists()).toBe(
+        true,
+      );
+      await wrapper
+        .find('[data-test="synthetics-private-location-detail-retry-btn"]')
+        .trigger("click");
+      await flushPromises();
+      expect(mockServiceGetLocation).toHaveBeenCalledTimes(2);
+      expect(wrapper.find('[data-test="synthetics-private-location-detail-error"]').exists()).toBe(
+        false,
+      );
+    });
+
+    it("shows the retry state for a network error (no response)", async () => {
+      mockServiceGetLocation.mockRejectedValueOnce(new Error("Network Error"));
+      wrapper = mountPage();
+      await flushPromises();
+      expect(wrapper.find('[data-test="synthetics-private-location-detail-error"]').exists()).toBe(
+        true,
+      );
+    });
+
+    it("keeps the not-found state for a 404", async () => {
+      mockServiceGetLocation.mockRejectedValueOnce({ response: { status: 404 } });
+      wrapper = mountPage();
+      await flushPromises();
+      expect(wrapper.find('[data-test="synthetics-private-location-detail-error"]').exists()).toBe(
+        false,
+      );
+      expect(wrapper.find('[data-test="synthetics-private-location-detail-empty"]').exists()).toBe(
+        true,
+      );
+    });
+  });
 });
diff --git a/web/src/views/synthetics/PrivateLocationDetail.vue b/web/src/views/synthetics/PrivateLocationDetail.vue
index 83c795680b..5633524436 100644
--- a/web/src/views/synthetics/PrivateLocationDetail.vue
+++ b/web/src/views/synthetics/PrivateLocationDetail.vue
@@ -204,6 +204,25 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </div>
       </div>
 
+      <div
+        v-else-if="!loading && loadError"
+        class="flex flex-col items-center gap-3 p-6"
+        data-test="synthetics-private-location-detail-error"
+      >
+        <p class="text-status-error-text text-sm">
+          {{ t("synthetics.privateLocations.detail.loadFailed") }}
+        </p>
+        <OButton
+          variant="outline"
+          size="sm"
+          icon-left="refresh"
+          data-test="synthetics-private-location-detail-retry-btn"
+          @click="load"
+        >
+          {{ t("synthetics.privateLocations.detail.retry") }}
+        </OButton>
+      </div>
+
       <div v-else-if="!loading" class="p-6">
         <OEmptyState
           size="block"
@@ -269,6 +288,9 @@ const backTo = computed(() => syntheticsListRoute(navContext.value, { section: "
 
 const detail = ref<SyntheticLocationDetail | null>(null);
 const loading = ref(false);
+/** True after a retryable failure (network error, timeout, 5xx). 403/404 keep
+ *  the not-found/forbidden handling instead. */
+const loadError = ref(false);
 const showSetup = ref(false);
 const agentSetup = ref<AgentSetup | null>(null);
 const setupAgentName = ref<string | null>(null);
@@ -308,11 +330,15 @@ const agentsEmptyMessage = computed(() =>
 
 async function load() {
   loading.value = true;
+  loadError.value = false;
   try {
     const res = await syntheticsService.getLocation(orgIdentifier.value, String(route.params.id));
     detail.value = res.data as SyntheticLocationDetail;
   } catch (err) {
     detail.value = null;
+    const status = (err as { response?: { status?: number } })?.response?.status;
+    // No response (network/timeout) or 5xx is retryable; 403/404/other 4xx are not.
+    loadError.value = status === undefined || status >= 500;
     console.error("[synthetics] failed to load location detail", err);
   } finally {
     loading.value = false;
diff --git a/web/src/views/synthetics/RunDetail.spec.ts b/web/src/views/synthetics/RunDetail.spec.ts
index d746c0a699..04056b7123 100644
--- a/web/src/views/synthetics/RunDetail.spec.ts
+++ b/web/src/views/synthetics/RunDetail.spec.ts
@@ -795,3 +795,91 @@ describe("RunDetail — start load (row 0)", () => {
     w.unmount();
   });
 });
+
+// ── Step outcomes and locators (ENT#3140 B2/B3) ──────────────────────────────
+describe("RunDetail — skipped / unknown steps and locators", () => {
+  const detail = {
+    ...mockRunDetail,
+    status: "failed",
+    recordedSteps: [
+      { id: "s1", action: "navigate", name: "Open home", url: "https://app.test/" },
+      {
+        id: "s2",
+        action: "click",
+        name: "Dismiss banner",
+        locator: { candidates: [{ kind: "role", value: "button[name=Close]" }] },
+      },
+      { id: "s3", action: "click", name: "Sign in", selector: "#signin" },
+      { id: "s4", action: "wait", name: "Settle" },
+    ],
+    lastAttemptSteps: [
+      { step_id: "s1", status: "ok", duration_ms: 10, error: "", screenshot_key: null },
+      {
+        step_id: "s2",
+        status: "skipped",
+        duration_ms: 5,
+        error: "optional step: banner not present",
+        screenshot_key: null,
+      },
+      { step_id: "s3", status: "fail", duration_ms: 20, error: "timeout", screenshot_key: null },
+      { step_id: "s4", status: "weird", duration_ms: 1, error: "", screenshot_key: null },
+    ],
+  };
+
+  afterEach(() => {
+    mockRunDetailRef.value = { ...mockRunDetail };
+  });
+
+  async function mountWith() {
+    mockRunDetailRef.value = null;
+    const w = mountComponent();
+    await flushPromises();
+    mockRunDetailRef.value = { ...detail };
+    await flushPromises();
+    return w;
+  }
+
+  it("keeps pass, fail, skipped and unknown distinct", async () => {
+    const w = await mountWith();
+    const steps = (w.vm as any).steps;
+    expect(steps.map((s: any) => s.status)).toEqual(["pass", "skipped", "fail", "unknown"]);
+    expect((w.vm as any).stepDotState(steps[1])).toBe("skip");
+    // Unknown must never take the pass colour.
+    expect((w.vm as any).stepDotState(steps[3])).toBeUndefined();
+    expect((w.vm as any).stepStatusBadge(steps[1])?.label).toBe(
+      "synthetics.runDetail.stepStatusSkipped",
+    );
+    expect((w.vm as any).stepStatusBadge(steps[0])).toBeNull();
+    w.unmount();
+  });
+
+  it("shows the skipped count on the steps tab", async () => {
+    const w = await mountWith();
+    expect(w.find('[data-test="synthetics-run-detail-skipped-count"]').exists()).toBe(true);
+    w.unmount();
+  });
+
+  it("resolves the locator with effectiveSelector and never falls back to the step id", async () => {
+    const w = await mountWith();
+    const steps = (w.vm as any).steps;
+    expect(steps[1].selector).toBe("button[name=Close]");
+    expect(steps[2].selector).toBe("#signin");
+    expect(steps[0].selector).toBeNull();
+    expect(steps[3].selector).toBeNull();
+    expect(steps[3].detail).toBe("");
+    w.unmount();
+  });
+
+  it("renders Selector and Step ID on the failed step, and the skip reason when expanded", async () => {
+    const w = await mountWith();
+    // The failed step auto-expands.
+    expect(w.find('[data-test="synthetics-run-detail-step-selector"]').text()).toContain("#signin");
+    expect(w.find('[data-test="synthetics-run-detail-step-id"]').text()).toContain("s3");
+    (w.vm as any).handleUpdateExpanded(["2"]);
+    await flushPromises();
+    expect(w.find('[data-test="synthetics-run-detail-step-skip-reason"]').text()).toContain(
+      "banner not present",
+    );
+    w.unmount();
+  });
+});
diff --git a/web/src/views/synthetics/RunDetail.vue b/web/src/views/synthetics/RunDetail.vue
index 5fcd746a02..5c75404dad 100644
--- a/web/src/views/synthetics/RunDetail.vue
+++ b/web/src/views/synthetics/RunDetail.vue
@@ -182,6 +182,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <OTab name="steps" data-test="synthetics-run-detail-tab-steps">
             {{ t("synthetics.runs.tabSteps") }}
             <OBadge variant="default" size="sm">{{ steps.length }}</OBadge>
+            <OBadge
+              v-if="skippedStepCount > 0"
+              variant="default"
+              size="sm"
+              data-test="synthetics-run-detail-skipped-count"
+              >{{ t("synthetics.runDetail.skippedCount", { n: skippedStepCount }) }}</OBadge
+            >
           </OTab>
           <OTab name="evidence" data-test="synthetics-run-detail-tab-evidence">
             {{ t("synthetics.runDetail.evidenceSection") }}
@@ -332,6 +339,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       detail-key="detail"
                       icon-key="icon"
                       :dot-state-fn="stepDotState"
+                      :step-badge-fn="stepStatusBadge"
                       :expanded-ids="expandedStepIdsArr"
                       @update:expanded-ids="handleUpdateExpanded"
                     >
@@ -435,20 +443,80 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                                 {{ t("synthetics.runDetail.detailAction") }}
                               </dt>
                               <dd class="text-text-secondary">{{ row.action }}</dd>
-                              <dt
-                                class="text-text-secondary text-sm font-semibold tracking-wide capitalize"
-                              >
-                                {{ t("synthetics.runDetail.detailSelector") }}
-                              </dt>
-                              <dd class="text-text-secondary">{{ row.detail }}</dd>
-                              <dt
-                                class="text-text-secondary text-sm font-semibold tracking-wide capitalize"
-                              >
-                                {{ t("synthetics.runDetail.detailUrl") }}
-                              </dt>
-                              <OTruncatedText as="dd" class="text-text-secondary">
-                                {{ row.url || currentRun.url }}
-                              </OTruncatedText>
+                              <template v-if="row.selector">
+                                <dt
+                                  class="text-text-secondary text-sm font-semibold tracking-wide capitalize"
+                                >
+                                  {{ t("synthetics.runDetail.detailSelector") }}
+                                </dt>
+                                <OTruncatedText
+                                  as="dd"
+                                  class="text-text-secondary font-mono"
+                                  data-test="synthetics-run-detail-step-selector"
+                                >
+                                  {{ row.selector }}
+                                </OTruncatedText>
+                              </template>
+                              <!-- The configured navigation target, not the page the
+                                   step observed: the probe does not report that yet. -->
+                              <template v-if="row.url">
+                                <dt
+                                  class="text-text-secondary text-sm font-semibold tracking-wide capitalize"
+                                >
+                                  {{ t("synthetics.runDetail.detailTargetUrl") }}
+                                </dt>
+                                <OTruncatedText
+                                  as="dd"
+                                  class="text-text-secondary"
+                                  data-test="synthetics-run-detail-step-target-url"
+                                >
+                                  {{ row.url }}
+                                </OTruncatedText>
+                              </template>
+                              <template v-if="row.stepId && row.id > 0">
+                                <dt
+                                  class="text-text-secondary text-sm font-semibold tracking-wide capitalize"
+                                >
+                                  {{ t("synthetics.runDetail.detailStepId") }}
+                                </dt>
+                                <OTruncatedText
+                                  as="dd"
+                                  class="text-text-secondary font-mono"
+                                  data-test="synthetics-run-detail-step-id"
+                                >
+                                  {{ row.stepId }}
+                                </OTruncatedText>
+                              </template>
+                              <template v-if="row.status === 'skipped' || row.status === 'unknown'">
+                                <dt
+                                  class="text-text-secondary text-sm font-semibold tracking-wide capitalize"
+                                >
+                                  {{ t("synthetics.runDetail.detailStatus") }}
+                                </dt>
+                                <dd
+                                  class="text-text-secondary"
+                                  data-test="synthetics-run-detail-step-status"
+                                >
+                                  {{
+                                    row.status === "skipped"
+                                      ? t("synthetics.runDetail.stepStatusSkipped")
+                                      : t("synthetics.runDetail.stepStatusUnknown")
+                                  }}
+                                </dd>
+                              </template>
+                              <template v-if="row.status === 'skipped' && row.error">
+                                <dt
+                                  class="text-text-secondary text-sm font-semibold tracking-wide capitalize"
+                                >
+                                  {{ t("synthetics.runDetail.detailSkipReason") }}
+                                </dt>
+                                <dd
+                                  class="text-text-secondary break-words whitespace-pre-wrap"
+                                  data-test="synthetics-run-detail-step-skip-reason"
+                                >
+                                  {{ row.error }}
+                                </dd>
+                              </template>
                               <dt
                                 class="text-text-secondary text-sm font-semibold tracking-wide capitalize"
                               >
@@ -631,7 +699,11 @@ import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OTabPanels from "@/lib/navigation/Tabs/OTabPanels.vue";
 import OTabPanel from "@/lib/navigation/Tabs/OTabPanel.vue";
-import { buildAttemptViews, stepOwnDetail } from "@/composables/synthetics/syntheticResultsSchema";
+import {
+  buildAttemptViews,
+  effectiveSelector,
+  stepOwnDetail,
+} from "@/composables/synthetics/syntheticResultsSchema";
 import type {
   AttemptView,
   EvidenceEvent,
@@ -815,7 +887,13 @@ interface StepRow {
    * When the probe starts emitting `start_time`, this becomes a read of it.
    */
   offsetMs: number;
-  status: "pass" | "fail";
+  status: StepRowStatus;
+  /**
+   * The locator the step acted on, from this run's recorded snapshot via
+   * `effectiveSelector`. Null for actions without a locator (navigate, wait),
+   * so the Selector row is omitted instead of showing the step ID.
+   */
+  selector: string | null;
   icon: string;
   statusIcon: string;
   durStr: string;
@@ -830,6 +908,27 @@ interface StepRow {
   bundleEvents: EvidenceEvent[];
 }
 
+/**
+ * A step's outcome as shown. Skipped and unknown stay distinct: a skipped
+ * optional step is neutral, not passed, and a status the UI does not know
+ * must never be shown as a pass.
+ */
+type StepRowStatus = "pass" | "fail" | "skipped" | "unknown";
+
+function stepRowStatus(raw: unknown): StepRowStatus {
+  if (raw === "ok" || raw === "passed" || raw === "pass") return "pass";
+  if (raw === "fail" || raw === "failed") return "fail";
+  if (raw === "skipped" || raw === "skip") return "skipped";
+  return "unknown";
+}
+
+const STEP_STATUS_ICON: Record<StepRowStatus, string> = {
+  pass: "check-circle",
+  fail: "cancel",
+  skipped: "do-not-disturb-on",
+  unknown: "help",
+};
+
 function fmtDur(ms: number): string {
   return ms >= 1000 ? (ms / 1000).toFixed(1) + "s" : ms + "ms";
 }
@@ -857,21 +956,25 @@ function buildSteps(
   let elapsedMs = 0;
   return steps.map((ex, idx) => {
     const recorded = recordedMap.get(ex.step_id);
-    const isFail = ex.status === "fail";
+    const status = stepRowStatus(ex.status);
+    const isFail = status === "fail";
+    const selector = recorded ? effectiveSelector(recorded) : null;
     const offsetMs = elapsedMs;
     elapsedMs += ex.duration_ms ?? 0;
     return {
       id: idx + 1,
       stepId: ex.step_id,
       action: recorded?.action ?? "step",
-      name: recorded?.name || recorded?.selector || recorded?.url || ex.step_id.slice(0, 8),
-      detail: recorded?.selector ?? recorded?.url ?? ex.step_id,
+      name: recorded?.name || selector || recorded?.url || ex.step_id.slice(0, 8),
+      // The step ID is shown only under "Step ID", never as the locator.
+      detail: selector ?? recorded?.url ?? "",
+      selector,
       url: recorded?.url ?? "",
       duration: ex.duration_ms,
       offsetMs,
-      status: isFail ? ("fail" as const) : ("pass" as const),
+      status,
       icon: recorded ? actionIcon(recorded.action) : "radio_button_checked",
-      statusIcon: isFail ? "cancel" : "check-circle",
+      statusIcon: STEP_STATUS_ICON[status],
       durStr: fmtDur(ex.duration_ms),
       durColor: isFail ? "var(--color-status-error-text)" : "var(--color-text-secondary)",
       error: ex.error,
@@ -915,6 +1018,7 @@ function buildStartRow(
     action: "navigate",
     name: t("synthetics.runDetail.startLoadLabel", { url: load.url }),
     detail: load.url,
+    selector: null,
     url: load.url,
     duration: load.duration_ms,
     offsetMs: 0,
@@ -1256,7 +1360,28 @@ watch(
 );
 
 function stepDotState(row: any): StepDotState | undefined {
-  return row.status === "fail" ? "fail" : "pass";
+  switch (row.status as StepRowStatus) {
+    case "fail":
+      return "fail";
+    case "pass":
+      return "pass";
+    case "skipped":
+      return "skip";
+    default:
+      // Unknown: the neutral outline, never the pass colour.
+      return undefined;
+  }
+}
+
+/** Text label for the outcomes the dot colour alone cannot carry. */
+function stepStatusBadge(row: any): { label: string; variant: "default" | "error" } | null {
+  if (row.status === "skipped") {
+    return { label: t("synthetics.runDetail.stepStatusSkipped"), variant: "default" };
+  }
+  if (row.status === "unknown") {
+    return { label: t("synthetics.runDetail.stepStatusUnknown"), variant: "default" };
+  }
+  return null;
 }
 
 /**
@@ -1360,6 +1485,8 @@ const steps = computed<StepRow[]>(() => {
   return [];
 });
 
+const skippedStepCount = computed(() => steps.value.filter((s) => s.status === "skipped").length);
+
 const startRow = computed<StepRow | null>(() => {
   const detail = synthetics.runDetail.value;
   if (!detail) return null;